Privacy Policy

1. Information we collect

To create an account and run a search, we collect:

• Your first name, last name, email address, and phone number — every account requires all four before a search can start.
• ZIP code, target monthly payment, mileage preference, and the make/model/trim you're shopping for.
• Your account password, stored as a salted argon2id hash — we never store or can see your plaintext password.

If you buy a Scout or Concierge engagement, Stripe (our payment processor) collects your payment details directly. LeasePrism never receives or stores your card number.

If you connect Concierge, we additionally store:

• An encrypted Gmail refresh token, so LeasePrism can send and read email on your behalf for the negotiation only. It's encrypted at rest (Fernet/AES) with a key that's never stored alongside the data.
• The full transcript of every message sent to and received from dealers through your connected mailbox, so you can review the entire negotiation in your dashboard.

2. How we use it

• To scan live inventory near your ZIP code and benchmark it against real signed lease deals.
• To draft outreach emails in your voice (Scout), or to send and negotiate those emails on your behalf within the walk-away price you set (Concierge).
• To authenticate your account and keep your session secure.
• To contact you about your search, your engagement, or your account — never for marketing you haven't asked for.

3. Who we share it with

We don't sell your data. We share the minimum necessary with the services that make LeasePrism work:

• Stripe — processes your payment. LeasePrism never sees your full card number.
• Google (Gmail API) — only if you connect Concierge, and only to send/read the dealer negotiation emails you authorize. See "Google user data" below.
• Anthropic (Claude) — drafts and, for Concierge, negotiates your outreach emails using your car details and stated preferences. It does not receive your password or payment information.
• auto.dev — an inventory data provider we query by make and ZIP code only, to find live dealer listings. No name, email, or other personal identifier is ever sent.
• Our email delivery provider — sends your account verification and sign-in links. It only ever sees your email address and the link itself, never your password or search data.

4. Google user data (Gmail)

Concierge is opt-in: nothing is sent from or read out of your mailbox until you explicitly connect it. When connected, LeasePrism requests exactly two Gmail scopes — gmail.send and gmail.readonly — used only to send negotiation emails to dealers on your approved car list and to read their replies into your dashboard. We never read, send, or otherwise touch any other email in your mailbox.

LeasePrism's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect your mailbox at any time from your account page; disconnecting revokes LeasePrism's access immediately and deletes the stored refresh token.

5. Cookies

LeasePrism uses exactly one cookie: a session cookie that keeps you logged in. It's httponly (invisible to page scripts), Secure, and SameSite-protected. We don't run third-party analytics, ad trackers, or marketing pixels.

6. Data retention & deletion

We keep your account and search data for as long as your account is active, plus as long as needed to satisfy tax and payment record-keeping. To request deletion or export of your data, email leaselaboratory@gmail.com — we'll confirm and complete the request within 30 days.

7. Security

Passwords are hashed with argon2id and never stored or logged in plaintext. Gmail refresh tokens are encrypted at rest. All traffic to LeasePrism is served over HTTPS. No system is perfectly secure, but we design for the principle of least data: we collect what the product needs and nothing more.

8. Children

LeasePrism is not directed to, and we do not knowingly collect information from, anyone under 18.

9. Changes to this policy

If we make a material change to how we handle your data, we'll update the effective date above and, where required, notify you directly.

10. Contact

Questions, data requests, or concerns: leaselaboratory@gmail.com