Company Data Policy
Last updated October 21, 2026
This policy explains what data Elevated Dealer Software LLC (“we”, “us”) handles through Service Advisor Battle Royale (SABR), who owns it, where it is stored, how we protect it and what happens to it when a subscription ends. It applies to dealerships and dealer groups that use SABR (“Customers”), their employees who sign in (“Users”), and visitors to our website.
1. Our role: your data, our care
Customers own their data. When we process information about a Customer's employees and sales, we do so on the Customer's behalf and under its instructions, as its service provider (sometimes called a “processor”). The Customer decides who is added, what is tracked and how long the program runs. We do not use Customer data for our own purposes except as described in this policy.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account information | Name, display alias, work email address, role, store, active or inactive status | Customer administrators; Google or Microsoft if a User signs in with them |
| Sales activity | Service items sold, repair order numbers, time of submission, spiff and pot values, labor and parts amounts set by the store, voids and void reasons | Users and managers |
| Program activity | Teams, drafts, game moves and results, bonuses, penalties, records, time-off entries, notifications and pay reports | Generated by the Service from Customer settings and User activity |
| Communications | In-app chat messages | Users |
| Audit records | Who changed a role, voided a sale, or ran or canceled a pay report, and when | Generated by the Service |
| Technical data | IP address, browser type, request times and error logs | Our hosting provider's standard server logs |
| Website inquiries | Name, email and message when you contact us about a demo | You |
What we do not collect
SABR is built to work without consumer data. We do not ask for, and Customers must not enter, vehicle owner names, phone numbers, addresses, VINs, payment card or bank details, Social Security numbers or other government IDs. We do not hold anyone's payroll or bank information, because we never pay anyone. We do not use advertising or tracking cookies (see our Cookie Policy).
3. How we use data
- to run the Service: leaderboards, games, teams, reports, notifications and sign-in;
- to secure the Service, prevent abuse and investigate problems;
- to provide support when a Customer asks for it;
- to prepare reports and analyses of program results for the Customer and for us, including measuring results against any performance guarantee;
- to send service emails, such as invitations, password resets and nightly reports;
- to meet legal obligations;
- to produce aggregated, de-identified statistics (for example, “close rates improved across deployments”) that cannot reasonably identify a Customer, store or person.
We do not sell or rent data, share it for advertising, or use it to profile anyone for marketing. We do not use Customer data to train artificial intelligence models.
4. Who can see it
- Within a Customer: access is based on role. Advisors see the competition views their store has turned on. Managers, owners and administrators see more, including pay reports and audit history, for the stores they are responsible for.
- Our personnel: authorized staff of Elevated Dealer Software LLC can access Customer data at any time, for any legitimate business purpose related to the Service. That includes onboarding and support, maintaining and securing the Service, preparing reports and analyses of program results (including measuring results against any performance guarantee), and meeting legal obligations. They are bound by confidentiality obligations, and we limit access to people with a business need.
- Other Customers: never. We keep each Customer's data separate from every other Customer's. Depending on the Customer's plan, we do this with a separate database and deployment, or with strict access controls and database-level row security inside a shared system.
5. Service providers (subprocessors)
We use a small number of trusted providers to run the Service:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and server logs | United States |
| Supabase Inc. | Database, authentication and password storage | United States (Oregon) |
| Resend (Plus Five Five, Inc.) | Sending service emails such as invitations and reports | United States |
| Google LLC / Microsoft Corp. | Optional sign-in, only if a User chooses it | United States |
Each provider is bound by contract to protect the data and use it only to provide its service to us. We will give Customers at least 30 days' notice, by email or on this page, before adding a provider that stores Customer data. A Customer may object on reasonable data-protection grounds; if we cannot address the objection, the Customer may end the affected subscription and receive a refund of prepaid fees for the unused term.
6. Where data is stored
Customer data is stored and processed in the United States. We do not transfer it outside the United States except as needed for a User who signs in from abroad.
7. How we protect it
- All traffic is encrypted in transit with HTTPS/TLS.
- Data is encrypted at rest by our database provider.
- Passwords are never stored in readable form; they are salted and hashed by our authentication provider.
- Role-based permissions are checked on every request, and database-level row security limits what each User can reach.
- Every User is signed out automatically each night, so no session lasts longer than a day.
- Key actions, such as role changes, voided sales and pay report runs, are written to append-only audit logs.
- Secrets and administrative credentials are kept out of source code and limited to the people who need them.
No system is perfectly secure. Customers help by giving each person their own account, using the lowest role needed, and deactivating people promptly when they leave.
8. Security incidents
If we confirm unauthorized access to Customer data, we will notify the affected Customer without undue delay, and no later than 72 hours after confirming it. The notice will explain what happened, what data was involved, what we are doing about it and what the Customer should do. We will cooperate with the Customer on any notices it must give to its employees or regulators.
9. Retention and deletion
- During a subscription: we keep Customer data for as long as the Customer uses the Service, so that history, records and reports stay complete. Deactivating a User keeps that person's past activity as part of the Customer's records.
- On request: a Customer may ask us to delete specific data, such as a former employee's account details. We will do so within 30 days, except for records the Customer asks us to keep or the law requires us to keep.
- After a subscription ends: a Customer has 30 days to request an export of its data in a common format such as CSV. We then delete Customer data from the live Service within a further 60 days. Copies in provider backups are overwritten on the provider's normal backup cycle.
- Website inquiries: kept for as long as needed to respond and follow up, and deleted on request.
10. Rights of individuals
Depending on where they live, people may have rights to access, correct, delete or get a copy of their personal information. Because Customers control the data about their employees, Users should send these requests to their employer first. If we receive a request directly, we will pass it to the right Customer and help them respond. We will not discriminate against anyone for exercising their privacy rights.
11. Requests from authorities
If a government or court asks us for Customer data, we will direct the request to the Customer where possible. If we are legally required to disclose data, we will notify the Customer first unless the law prohibits it, and we will disclose only what is required.
12. Age
SABR is a workplace tool for adults. It is not directed at anyone under 18, and we do not knowingly collect information from children.
13. Changes
We will post any update to this policy here with a new date. For material changes that reduce protections for Customer data, we will give Customers at least 30 days' notice.
14. Contact
Data and privacy questions, deletion requests or security reports: info@elevateddealer.com, or Elevated Dealer Software LLC, 9613 S 173rd Ave, Omaha, Nebraska 68136.