Privacy Policy

Information we collect

• Account and profile. Name, email, password (hashed by our authentication provider), role, and account preferences for school staff and student portal users.
• Student portal activity. Lesson bookings, invoice views, and other actions taken in the student portal linked to a driving school account.
• Billing and subscription details. School subscription status, payment-related metadata, and entitlement information used to operate the service.
• Support communications. Messages you send to support, surveys, or feedback forms.
• Driving school operations data. Student and instructor contact details, lesson scheduling records, enrollment records, invoices, and messaging preferences submitted through the school platform.
• Device and log data. IP address, browser type, operating system, device identifiers, and interaction logs collected through our hosting and analytics providers to keep the service secure and reliable.
• Cookies and similar technologies. Cookies help keep you signed in, remember preferences, and measure how features are used. See “Cookies and analytics” for details.

How we use information

• Provide the driving school platform and student portal.
• Manage school subscriptions, billing, and service availability.
• Send service-related messages (account notices, product updates, support responses).
• Support driving school workflows such as student scheduling, class reminders, school notifications, and operational communications by email and SMS.
• Monitor performance, prevent abuse, and secure accounts.
• Analyze usage to improve product experience and reliability.
• Comply with legal obligations and enforce our Terms of Service.

SMS communications and consent

• We only send SMS messages when a user or student provides express consent for a specific messaging purpose, such as scheduling updates, onboarding, support, or account notices.
• Message frequency varies by school activity. Message and data rates may apply based on the recipient's carrier plan.
• Recipients can opt out any time by replying STOP and can request help by replying HELP.
• Consent for SMS is not required to purchase services and is not shared or sold for third-party marketing.

How we share information

• Service providers. We use trusted vendors to host data (e.g., Vercel and Supabase), send emails, and provide analytics (Google Analytics). They may access information only to perform services for us under confidentiality obligations.
• Analytics. We use Google Analytics to understand feature adoption. Data is aggregated and not sold.
• Legal and safety. We may disclose information if required by law, to protect the rights and safety of PermitSmash, our users, or others, or to investigate fraud or security issues.
• Business events. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you if this happens and any new policy applies.

Cookies and analytics

We use cookies and similar technologies to operate and improve PermitSmash:

• Essential cookies. Required to keep you signed in, secure the service, and remember preferences.
• Analytics cookies. Google Analytics helps us understand usage and performance. You can use browser settings or opt-out tools from Google to limit analytics cookies.

You can manage cookies in your browser settings. If you disable certain cookies, some features may not work as expected.

Data retention

We keep your information while your account is active or as needed to provide PermitSmash. We may retain certain data to meet legal, accounting, or security obligations, and we may aggregate or de-identify data for analytics.

Your rights (GDPR/UK GDPR/CCPA-CPRA)

Depending on where you live, you may have rights such as access, correction, deletion, portability, or the right to opt out of certain processing. California residents may have additional rights under the CCPA/CPRA. We do not sell personal information. To exercise rights, contact us; we will verify your request and respond as required by applicable law.

Security

We use industry-standard security controls, including encryption in transit, access controls, and monitoring. No online service can guarantee absolute security, but we work to protect your information and promptly investigate potential issues.

Data Processing Addendum

If you are a business customer that needs a DPA (for example under GDPR/UK GDPR), contact us and we can provide our standard DPA for signature. See our Data Processing Addendum page for a summary.

Your choices and rights

• Update your account information in your profile or by contacting support.
• Unsubscribe from non-essential emails using the unsubscribe link or by contacting us.
• Request access, correction, export, or deletion of your personal information by email.
• Control cookies through your browser settings.

Children's privacy

PermitSmash is designed for driving schools and their students. It is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided us information, contact us and we will take appropriate action.

International users

We are based in the United States and primarily serve U.S. users. By using PermitSmash, you understand that your information may be transferred to and processed in the United States.

Changes to this policy

If we make material changes, we will update the effective date and notify you through the product or by email. Your continued use of PermitSmash after changes take effect means you accept the updated policy.

Contact us

Flintime Inc. (PermitSmash)
For questions or requests about this Privacy Policy or your data, email us at support@PermitSmash.com.