Last updated: October 15, 2026
MyDealRecap LLC uses a small number of carefully selected third-party service providers ("subprocessors") to operate our platform. Each subprocessor is bound by a Data Processing Agreement or equivalent contractual terms requiring them to protect personal data and use it only as directed by MyDealRecap. We will provide dealership clients with 30 days' notice before adding any new subprocessor.
Infrastructure & Data
Purpose
Database, authentication, and real-time APIs. Stores all deal records, user accounts, and customer data with row-level security isolation between dealerships.
Data Processed
All Nonpublic Personal Information (NPI): names, VINs, deal terms, F&I products
Purpose
Website hosting (Cloudflare Pages), content delivery, DDoS protection, TLS termination and DNS for mydealrecap.com. Serves the MyDealRecap web pages, including customer deal summary pages.
Data Processed
IP addresses and request metadata for visits to mydealrecap.com, including page addresses such as deal summary links. The deal itself is loaded directly from Supabase and is not stored by Cloudflare.
Communications
Purpose
Transactional email delivery. Sends deal summary links to vehicle purchasers at the direction of dealership clients, account emails to dealership staff (such as invitations and password resets), and internal operations alerts to the MyDealRecap team.
Data Processed
Customer email address and first name, dealership name, vehicle description, deal summary link; for staff account emails, the staff member's email address and a sign-in link; internal alerts can include a customer's first name and a deal reference, or the name, email address and dealership given in a demo request
Purpose
SMS delivery and inbound texts. Sends the deal summary link to purchasers who gave consent; replies to texts sent to our number, such as RECAP; sends a one-time code requested at /find, only to the phone number already on a customer's deal; sends the vehicle-update texts (service reminders, recall notices, coverage-expiry alerts) a customer turns on; and receives customer replies such as STOP and HELP.
Data Processed
Customer mobile number and message content, which can include the customer's first name, dealership name, vehicle (year, make, model), the service or coverage a text is about, one-time codes, and the deal summary link
Purpose
Business email for MyDealRecap mailboxes, including support@ and privacy@. Replies to deal summary emails go to support@ by default.
Data Processed
Emails that customers and dealership staff send us, which can include names, contact details and questions about a deal
Resources our pages load from third parties
Some of our web pages load fonts from an outside provider or send a request to one. When they do, the visitor's browser connects to that provider directly, so it receives the visitor's IP address and browser details. Our pages tell browsers to send these providers only the site's address (mydealrecap.com), not the page path, so a deal summary link is not shared with them.
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com): the typefaces used on our pages.
- NHTSA vPIC (vpic.nhtsa.dot.gov), a U.S. government service: when an F&I manager enters a VIN in the Manager Portal, the VIN alone is sent to decode the vehicle's year, make and model. No customer name or contact details are sent.
Adding New Subprocessors
MyDealRecap will provide dealership clients with at least 30 days' written notice before engaging a new subprocessor that will process personal data. This notice will be sent by email to the primary contact on the dealership's account. Dealership clients who have executed a Data Processing Agreement may object to a new subprocessor within 15 days of receiving notice.
Data Transfers
All subprocessors listed above are headquartered in the United States. MyDealRecap does not intentionally transfer personal data outside the United States. To the extent any subprocessor processes data outside the US, they are required to maintain equivalent protections under applicable data transfer mechanisms.
Questions about our subprocessors?
Contact our data protection team at privacy@mydealrecap.com. Dealership clients may also request a copy of our Data Processing Agreement or Written Information Security Program.