Privacy Policy

Scope of this policy

This policy applies to the PermitSmash web platform, the student portal, the PermitSmash mobile apps for iOS and Android published by Flintime Inc., and the PermitSmash browser extension for Google Chrome. If a school configures optional features such as lesson signatures, messaging, or notifications, the data involved in those features is also covered here.

Information we collect

• Account and profile. Name, email, password (hashed by our authentication provider), role, and account preferences for school staff, mobile app users, and student portal users.
• Student portal activity. Lesson bookings, invoice views, and other actions taken in the student portal linked to a driving school account.
• Billing and subscription details. School subscription status, payment-related metadata, and entitlement information used to operate the service.
• Support communications. Messages you send to support, surveys, or feedback forms.
• Driving school operations data. Student and instructor contact details, lesson scheduling records, enrollment records, invoices, and messaging preferences submitted through the school platform.
• Device and log data. IP address, browser type, operating system, device identifiers, and interaction logs collected through our hosting and analytics providers to keep the service secure and reliable.
• Mobile app data. When you use the PermitSmash apps for iOS or Android, we may also collect push notification tokens (if you enable notifications), mobile device type, operating system and app version, language settings, diagnostic and crash data, and app activity linked to your account such as schedule views, lesson updates, notes, and signatures or images you submit through enabled workflows.
• Browser extension activity. When an authorized school owner uses the PermitSmash Chrome extension to autofill a form on a third-party website, we process the page URL and title, descriptors for visible form fields on that page (such as field labels, names, types, and select options), the selected student identifier, and the school identifier. We use student profile data already stored in PermitSmash to suggest field values. We do not upload the full HTML of third-party pages. Values are written into the page only after the owner initiates autofill and only for fields the owner can see in the extension results.
• Cookies and similar technologies. Cookies help keep you signed in, remember preferences, and measure how features are used. See “Cookies and analytics” for details.

How we use information

• Provide the driving school platform, student portal, PermitSmash mobile apps, and browser extension.
• Manage school subscriptions, billing, and service availability.
• Send service-related messages (account notices, product updates, support responses).
• Deliver mobile push notifications you enable for schedule changes, lesson reminders, and other operational alerts tied to your PermitSmash account.
• Support driving school workflows such as student scheduling, class reminders, school notifications, and operational communications by email and SMS.
• Help authorized school owners autofill third-party web forms (such as DMV or state portals) using student data stored in PermitSmash, including automated field matching assisted by AI when needed.
• Monitor performance, prevent abuse, and secure accounts.
• Analyze usage to improve product experience and reliability.
• Comply with legal obligations and enforce our Terms of Service.

Browser extension (Chrome autofill)

The PermitSmash browser extension is available to authorized driving school owners with dashboard access. It helps fill web forms on external sites using student information already stored in PermitSmash.

• What runs in your browser. The extension scans visible form fields on the page you are viewing, displays a sidebar, and applies selected values to those fields. A sign-in session is stored locally in your browser using Chrome extension storage so you can stay signed in between visits.
• What we send to PermitSmash.When you start autofill, field descriptors and page context are sent to PermitSmash over encrypted connections so we can map fields to the selected student's profile. We do not send the entire contents of third-party pages.
• AI-assisted matching. If simple matching rules cannot map a field, we may send the unresolved field descriptors and relevant student profile fields to an AI service provider to suggest a match. We instruct that provider not to invent data that is not present in the student profile.
• Third-party websites.When fields are filled, the entered information is placed into the third-party form you are viewing. That site's own privacy policy and terms govern how it handles submitted data. The extension does not submit forms or click Next/Submit on your behalf.
• Your responsibility. School owners should review autofilled values and any unmatched fields before submitting a government or regulatory form.
• Signing out. You can sign out from the extension sidebar to remove the locally stored session from your browser.

SMS communications and consent

• We only send SMS messages when a user or student provides express consent for a specific messaging purpose, such as scheduling updates, onboarding, support, or account notices.
• Message frequency varies by school activity. Message and data rates may apply based on the recipient's carrier plan.
• Recipients can opt out any time by replying STOP and can request help by replying HELP.
• Consent for SMS is not required to purchase services and is not shared or sold for third-party marketing.

How we share information

• Service providers. We use trusted vendors to host data (e.g., Vercel and Supabase), send emails, provide AI-assisted form matching for the browser extension, and provide analytics (Google Analytics). They may access information only to perform services for us under confidentiality obligations.
• Analytics. We use Google Analytics to understand feature adoption. Data is aggregated and not sold.
• Legal and safety. We may disclose information if required by law, to protect the rights and safety of PermitSmash, our users, or others, or to investigate fraud or security issues.
• Business events. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you if this happens and any new policy applies.

Cookies and analytics

We use cookies and similar technologies to operate and improve PermitSmash:

• Essential cookies. Required to keep you signed in, secure the service, and remember preferences.
• Analytics cookies. Google Analytics helps us understand usage and performance. You can use browser settings or opt-out tools from Google to limit analytics cookies.

You can manage cookies in your browser settings. If you disable certain cookies, some features may not work as expected.

Data retention

We keep your information while your account is active or as needed to provide PermitSmash. We may retain certain data to meet legal, accounting, or security obligations, and we may aggregate or de-identify data for analytics.

Your rights (GDPR/UK GDPR/CCPA-CPRA)

Depending on where you live, you may have rights such as access, correction, deletion, portability, or the right to opt out of certain processing. California residents may have additional rights under the CCPA/CPRA. We do not sell personal information. To exercise rights, contact us; we will verify your request and respond as required by applicable law.

Security

We use industry-standard security controls, including encryption in transit, access controls, and monitoring. No online service can guarantee absolute security, but we work to protect your information and promptly investigate potential issues.

Data Processing Addendum

If you are a business customer that needs a DPA (for example under GDPR/UK GDPR), contact us and we can provide our standard DPA for signature. See our Data Processing Addendum page for a summary.

Account deletion

If you created a PermitSmash account through the web platform, the PermitSmash mobile apps, or the browser extension, you may request deletion of your account and associated personal information by emailing support@permitsmash.com. We will verify your request and delete or de-identify personal information associated with your account, except where we must retain limited data for legal, security, fraud-prevention, or billing purposes.

Your choices and rights

• Update your account information in your profile or by contacting support.
• Unsubscribe from non-essential emails using the unsubscribe link or by contacting us.
• Request access, correction, export, or deletion of your personal information by email.
• Disable push notifications for the PermitSmash apps in your device settings.
• Sign out of the PermitSmash browser extension to clear its locally stored session.
• Control cookies through your browser settings.

Children's privacy

PermitSmash is designed for driving schools and their students. It is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided us information, contact us and we will take appropriate action.

International users

We are based in the United States and primarily serve U.S. users. By using PermitSmash, you understand that your information may be transferred to and processed in the United States.

Changes to this policy

If we make material changes, we will update the effective date and notify you through the product or by email. Your continued use of PermitSmash after changes take effect means you accept the updated policy.

Contact us

Flintime Inc. (PermitSmash)
For questions or requests about this Privacy Policy or your data, email us at support@permitsmash.com.