Two roles: your account vs. your customers' data
For a dealership's own account (the people who log in, and your subscription), we act as the business responsible for that information (a "controller").
For the data a dealership puts into Truss DMS about its own customers, inventory, and transactions, the dealership is responsible for that information and we process it only on the dealership's behalf and instructions (a "processor"). If you are a consumer who bought from, or inquired with, a dealership that uses Truss DMS, please contact that dealership to exercise your rights — they control that record.
Information we collect
- Account & profile. Names, email addresses, roles, and login credentials for the people at a dealership who use Truss DMS. Passwords are stored only as salted hashes by our authentication provider — we never see them.
- Business data you enter. Inventory and VINs, parts, repair orders, deals, invoices, rentals, leads, signed documents, and the contact details of your customers (names, emails, phone numbers, and addresses) that you or your staff add.
- Payment information. When you pay us, or collect payment from a customer, card details are entered directly into our payment processor (Stripe). We store only non-sensitive references such as the last four digits, brand, and status — never full card numbers or security codes.
- Usage & device data. Basic technical logs (IP address, browser type, timestamps, and actions taken) that we use to operate and secure the service.
- Cookies. We use strictly necessary cookies to keep you signed in and to protect your session. We do not use advertising or cross-site tracking cookies.
How we use information
- To provide, operate, maintain, and secure Truss DMS.
- To authenticate users and enforce role-based access within a dealership.
- To process subscription billing and to facilitate payments you collect from customers.
- To power optional AI assistance (see below) that you choose to invoke.
- To provide support, send service and security notices, and respond to your requests.
- To detect, prevent, and investigate fraud, abuse, and security incidents.
- To comply with legal obligations and enforce our agreements.
We do not sell your personal information, and we do not use your customers' data for advertising.
AI-assisted features
Some optional features use a third-party AI provider (Anthropic) to draft content — for example, turning unit photos and specs into a listing, drafting service lines from a complaint, or suggesting a reply to a lead. When you invoke one of these features, only the relevant business content is sent — such as unit details and photos, a repair complaint, lead message text, or aggregate business figures for a report question.
We do not send payment card numbers, government IDs, or passwords to the AI provider. Content sent for AI processing is used only to generate the output you requested and, under our provider's commercial terms, is not used to train their models. AI output can be imperfect — it is meant for a person to review before use.
Service providers (sub-processors)
We share information with a small set of vendors that process data on our behalf, under contracts that require them to protect it and use it only to provide their service to us:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and encrypted file storage |
| Vercel | Application hosting and content delivery |
| Stripe | Payment processing — card details go directly to Stripe and are never stored by us |
| Anthropic | AI features that draft listings, service lines, and message replies |
| Twilio | Text-message (SMS) delivery, only when a dealership enables it |
| Intuit QuickBooks | Accounting synchronization, only when a dealership connects it |
How we share information
- Within your dealership — with the users your dealership authorizes.
- With the sub-processors above — to operate the service.
- For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and property of you, our users, the public, or us.
- In a business transfer — if we are involved in a merger, acquisition, or sale of assets, subject to this policy.
How we protect information
The safeguards built into Truss DMS include:
- Encryption of data in transit (TLS) and at rest.
- Strict per-dealership isolation enforced in the database with row-level security, so one dealership cannot see another's data.
- Private file storage for photos and documents, served only through short-lived, expiring links.
- API keys stored only as hashes; the full key is shown once and never stored.
- Role-based access controls within each dealership and least-privilege service credentials.
- Audit logging of sensitive actions, and card data kept entirely within our PCI-compliant payment processor.
No system is perfectly secure, but we work to protect your information and to promptly address issues. If you believe you've found a vulnerability, email privacy@trussdms.com.
Data retention
We keep information for as long as a dealership's account is active and as needed to provide the service. After an account is closed, we delete or de-identify data within a reasonable period, except where we must retain it to meet legal, tax, accounting, or security obligations. Residual copies may persist in backups for a limited time before being overwritten.
Your choices and rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. Dealership account holders can exercise these by emailing privacy@trussdms.com. If your data was entered by a dealership using Truss DMS(for example, you are that dealership's customer), please contact the dealership directly, as they control that record; we will assist them as their processor.
International users
Truss DMS is operated from the United States, and information is processed and stored there. If you access the service from another region, you understand your information will be transferred to and processed in the United States.
Children's privacy
Truss DMS is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "last updated" date and, where appropriate, notify account holders. Continued use of Truss DMS after changes take effect means you accept the updated policy.
Contact us
Questions about privacy? Email privacy@trussdms.com.