The short version
- This website sets no cookies and uses no analytics or advertising trackers.
- Dealerships own their customer data. We process it for them so Aria can reply, qualify, book and follow up, and they decide how it is used.
- We share information only with the service providers that run QualiFlow, such as messaging, calling, email and AI providers, and as the law requires.
- We do not sell personal information, and we never share mobile numbers for marketing.
- Reply STOP to any text to opt out. Contact us or the dealership to use your privacy rights.
This summary is here to help. The full policy below is what applies.
1. Scope and our role
This policy explains how QualiFlow AI ("QualiFlow," "we" or "us") collects, uses and shares personal information. It covers three groups of people:
- Website visitors: people who visit qualiflow.ai.
- Dealership users: the employees of dealerships who use the QualiFlow app.
- Dealership customers: shoppers, owners and anyone else who texts, calls, messages, emails or chats with a dealership that uses QualiFlow, or whose details a dealership adds to QualiFlow.
For website visitors and dealership users, we decide how personal information is used. For dealership customers, we act as a service provider (also called a processor) for the dealership: we handle that information on the dealership's behalf, following its instructions and our contract with it. The dealership's own privacy policy explains how it uses your information. If you are a dealership customer, please contact the dealership first; if you contact us, we will pass your request to the dealership and help it respond.
This policy does not cover other companies' websites or services, such as Meta or your email provider, or how a dealership uses information outside QualiFlow.
2. Information we collect
2.1 Website visitors
- What you send us. If you email us, including through the demo request form (which opens your own email app rather than sending anything to us directly), we receive what you write, such as your name, email address and dealership.
- Technical information. Like any website, our servers receive your IP address, browser details and the page you request so that they can deliver it. Our application logs record the timing and outcome of each request, not your IP address or the page address.
- No trackers. This website does not use analytics, advertising pixels or third-party scripts, and it sets no cookies. See Section 7.
2.2 Dealership users
- Account details: your name, email address, password (stored only as a salted hash), dealership and workspace, role, locations and permissions.
- Sign in with Google or Microsoft: if you use it, the provider shares your name, email address and an account ID with us.
- Connected accounts: when you connect a mailbox or calendar, we receive access tokens or app passwords (stored encrypted) and the email and calendar data described in 2.3.
- Activity and security records: actions you take in the app, such as approvals, edits, takeovers and exports; sign-in events; and short-lived counters that limit repeated sign-in attempts.
- Browser notifications: if you turn them on, the push subscription your browser gives us (an address for your browser's push service and encryption keys).
- Help and support: questions you ask the in-app help assistant and the support tickets you open.
2.3 Dealership customers (on a dealership's behalf)
- Contact details: name, phone numbers, email addresses, and Facebook Messenger, Instagram or WhatsApp account IDs, plus the profile name (and, where a dealership turns it on, the profile photo) those platforms share.
- Conversations: text messages and the photos you send (for example of a trade-in), social messages, emails, website chat messages, and form and survey answers.
- Calls: phone numbers, time, length and outcome of calls with Aria or staff, and a summary of what was discussed. Live call audio is processed while an AI-handled call is in progress. QualiFlow does not currently record calls.
- Shopping, sales and service details: the vehicles you are interested in, new or used, budget, timing, trade-in details, whether you plan to pay cash, finance or lease, appointments, visits and test drives, sale and delivery status, lease or finance end dates the dealership records, service requests and feedback.
- Preferences and permissions: preferred language, contact preferences, consent and opt-out records (with their source and time), and wrong-number reports.
- Notes and decision records: facts that Aria or staff note from conversations, each with its source, and records explaining why Aria took or skipped an action.
- Source details: how you reached the dealership, such as the form, QR code, link or campaign (UTM) details.
QualiFlow is not designed to collect Social Security numbers, driver's license numbers, full payment card or bank account numbers, credit applications or reports, or health information. Aria does not take payments or credit applications.
2.4 Where the information comes from
From you directly; from dealerships and their staff (including contact lists they import); from the channels that deliver your messages, such as wireless carriers, our messaging provider, Meta and email providers; from accounts a dealership connects; and automatically when you use our website or app.
3. How we use information
- To run the Service for dealerships: receive and route messages and calls, reply, book appointments, send reminders and follow-up, run the campaigns a dealership approves, and show staff their inbox, calendar and reports.
- To let Aria do its job: understand messages, reply in the customer's language, ask qualifying questions, match vehicles, offer appointment times, summarize calls and prepare handoff notes for staff (see Section 4). Language is never guessed from a name, location or ethnicity.
- To honor choices: process opt-outs before any AI step, recheck permission right before each proactive message, and keep people who opted out from being contacted again.
- To manage accounts and support: create and secure accounts, sign users in, send staff notifications, and answer help requests.
- To keep QualiFlow safe: prevent fraud, spam and abuse, enforce our Terms, and investigate security issues.
- To maintain and improve QualiFlow: using information about how the Service performs, such as errors and response times.
- To meet legal obligations: comply with the law, respond to lawful requests and protect rights.
- To talk with you: reply when you contact us and send dealership users service announcements. We do not send our own marketing to dealership customers.
4. AI processing
QualiFlow uses third-party AI model providers to write Aria's replies and plans, hold AI-handled phone calls, search a dealership's Knowledge and power the in-app help assistant. We currently use OpenAI's API.
- What providers receive: only what a task needs, such as the new message, relevant conversation history and customer facts, matching inventory and Knowledge, and live call audio during an AI-handled call.
- How they may use it: providers process this information to return a result to us. Where a provider's service lets us choose, we ask it not to store responses for later reuse, and we turn off tracing for live calls. Providers handle data under their own terms, which may allow limited retention, for example for abuse monitoring.
- People stay in charge: dealerships choose Manual, Ask or Autopilot mode, approve proposals and campaigns, and can take over any conversation. Every Aria action has a decision record staff can review.
- No consequential decisions: Aria does not decide whether anyone qualifies for credit, financing, insurance or employment.
5. How we share information
- With the dealership. Information about a dealership's customers is available to that dealership's authorized users, who see only the locations they have access to. Each dealership's data is kept separate from every other dealership's.
- With service providers that help us run QualiFlow, under contracts that limit how they use it (table below).
- For legal reasons: to comply with law or legal process, or to protect the rights, safety and security of people, dealerships or QualiFlow.
- In a business transfer: as part of a merger, acquisition or sale of assets, subject to this policy.
- With your direction or consent.
| Category | What they do | Examples |
|---|---|---|
| Hosting | Run the servers, database and file storage behind QualiFlow | Our US hosting provider |
| Texting and calling | Provide phone numbers and deliver text messages and calls | Twilio and wireless carriers |
| Social messaging | Deliver Facebook Messenger, Instagram and WhatsApp messages | Meta |
| Email, calendar and sign-in | Read and send email from a dealership's connected mailbox, sync optional calendars, and sign users in | Google, Microsoft or the dealership's own mail provider |
| AI models | Generate replies, plans, call conversations and search results | OpenAI |
| Browser notifications | Deliver staff notifications in encrypted form, so the push service cannot read them | The push service run by your browser's maker |
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Mobile information is not shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties, except the providers that deliver messages for us.
6. Texts, calls and opting out
Dealerships collect permission to contact their customers, and QualiFlow records that permission by channel and purpose. A permission for appointment reminders is not treated as permission for marketing, and importing a contact list never grants permission to contact anyone.
- Text messages: reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT; BAJA in Spanish; ARRÊT in French) at any time. Opt-outs are processed immediately, before Aria sees the message, and cancel that dealership's scheduled texts to you. Reply HELP for help. Message frequency varies, and message and data rates may apply. See the SMS terms.
- Facebook, Instagram and WhatsApp: reply STOP or UNSUBSCRIBE.
- Email: marketing emails sent through QualiFlow include an unsubscribe link.
- Phone calls: tell Aria or the dealership's staff that you do not want to be contacted. Aria notes the request and hands it to the dealership's staff without promising any follow-up.
- Wrong number: tell us or the dealership, and the number is blocked for the old contact right away.
Each dealership's permissions are separate, so opting out with one dealership does not change your choices with another.
7. Cookies and browser storage
This website sets no cookies. It loads no analytics, advertising or other third-party scripts, fonts or images. It stores one optional preference in your browser:
| Name | Type and purpose | How long |
|---|---|---|
qf-motion-paused |
Local storage. Remembers that you paused the page animations. | Until you resume the animations or clear your browser data |
The QualiFlow app uses only the cookies and browser storage it needs to work:
| Name | Type and purpose | How long |
|---|---|---|
__Host-qf_session |
Cookie, strictly necessary. Keeps you signed in. | Until you sign out, at most 8 hours |
__Host-qf_csrf |
Cookie, strictly necessary. Protects your account against forged requests from other websites. | At most 8 hours |
__Host-qf_oidc and related
|
Cookies, strictly necessary. Complete sign-in with Google or Microsoft securely. | Up to 10 minutes |
| App preferences | Local storage. Remembers chart views and your browser notification setup. | Until you clear your browser data |
| Unsent work | Session storage. Keeps an instruction you are still writing if the page reloads. | Until you close the tab |
On a dealership's website, the QualiFlow chat widget keeps a
chat session token in session storage (qualiflow-widget:
followed by the widget ID) so your conversation survives a page
reload. It is cleared when you close the tab. The widget sets no
cookies.
8. Data retention
- Dealership customer information is kept while the dealership's account is active and as the dealership directs; dealerships can delete records. After an account ends, we delete or de-identify it within a reasonable period.
- Opt-out and wrong-number records are kept in minimal form even after other data is deleted, so that a deleted or re-imported contact is not messaged again.
- Dealership user accounts are kept while the account is active and afterward only as long as needed for security, legal and dispute purposes.
- Contact import files that are uploaded but never confirmed are deleted automatically after a short time.
- Logs and backups are kept for limited periods and then deleted on a regular schedule.
- Emails you send us are kept as long as needed to respond and keep business records.
9. Security
We protect personal information with measures such as:
- encrypted connections (HTTPS) between your browser and QualiFlow, and between QualiFlow and its providers;
- passwords stored only as salted hashes, and sign-in cookies that scripts on the page cannot read;
- access checks on every request so users see only their own dealership and permitted locations, with database-level separation between dealerships as an extra safeguard;
- mailbox and calendar credentials stored encrypted, with the encryption key kept apart from the database;
- verification of the signatures on messages our providers send us, so forged messages are rejected;
- application logs that leave out message content, passwords, tokens and IP addresses.
No system is perfectly secure, and we do not claim any security certification. If a breach affects your personal information, we will notify you or the dealership as the law requires. To report a security concern, contact us using Section 15.
10. Your privacy rights
Depending on where you live, including California and other US states with privacy laws, you may have the right to:
- know what personal information we have about you and get a copy of it;
- correct inaccurate information;
- delete your information;
- opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
- limit the use of sensitive personal information (we do not use it to infer characteristics about you);
- appeal our decision on your request; and
- be treated without discrimination for using any of these rights.
Sections 2, 3 and 5 describe the categories of personal information we collect, where it comes from, why we use it and who receives it.
How to make a request
- Website visitors and dealership users: email privacy@qualiflow.ai. We will verify your request, usually by confirming details we already hold, and respond within the time the law requires. An authorized agent can make a request for you with your signed permission. If we decline your request, you can appeal by replying to our decision, and if you are not satisfied, you can contact your state attorney general.
- Dealership customers: please send your request to the dealership, which controls your information. If you write to us, we will forward it to the dealership where we can identify it and help the dealership respond.
11. Legal bases for processing
Where the law requires a legal basis, such as in the UK or the European Economic Area, we rely on: performing our contract with dealerships and their users; our legitimate interests in running, securing and improving our website and Service and in answering inquiries; complying with legal obligations; and your consent where we ask for it, which you can withdraw at any time. For dealership customers, the dealership determines the legal basis.
12. Children
Our website and Service are for businesses and are not directed to children. We do not knowingly collect personal information from children under 13, or under 16 where a state law sets a higher age. If you believe a child has given us personal information, contact us and we will delete it, or ask the dealership involved to do so.
13. International users
QualiFlow is built for US dealerships, and we host our Service in the United States. If you use our website or Service from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Some of our providers may process information in other countries under their own safeguards.
14. Changes to this policy
We will update this policy as QualiFlow changes, post the new version here and update the date at the top. If a change is material, we will tell dealership users by email or in the app before it takes effect.
15. Contact us
Questions or requests about privacy? Email privacy@qualiflow.ai or write to QualiFlow AI, Attn: Privacy, [Company mailing address].