Privacy policy

Last updated October 15, 2026

What we collect

Account details you enter when you sign up: your name, email, company name, yard type and your business phone number. We use the business phone number to reach you about your account and, together with your email and company name, to check that each business gets only one free trial; for that check we keep a normalized copy of the email, phone number and company name. We also keep the information you add to the app: vehicle records, lot layouts, team names and access codes, notes and photos. To price each lot by its size, we count the vehicles in it and keep each lot’s plan size; the count uses only the vehicle’s status and type, not who owns it.

Where it is stored

Accounts and yard data are stored with our database and sign-in provider, Supabase, in the United States. Each company’s data is kept in a separate workspace, and database rules allow only that company’s owners and drivers to read or change it. The website itself is served by Cloudflare. Vehicle photos, release signatures and photos of release paperwork are kept in private storage that only your company’s signed-in team can open, through links that expire after an hour. For release records we keep only the last four digits of an ID number. To work without signal, the app keeps a copy of your company’s yard data on each signed-in phone until it syncs; signing out removes it.

Passwords and access codes

Passwords are handled by Supabase Auth and stored only as one-way hashes; we never see them. When you choose a password, Supabase checks it against the Have I Been Pwned list of leaked passwords by sending only the first five characters of a scrambled copy of it, never the password itself. Driver access codes are at least 10 characters, are shown once when created, and are stored only as a keyed hash, so not even we can read them back. Repeated wrong codes are slowed down and locked out. An owner can replace or cancel a code at any time.

Status links and imports

A yard can make a private status link for one vehicle and send it to the vehicle’s owner, the police or an insurer. Anyone who has the link can see the business name and contact, the lot, the vehicle description, its status and days on the lot, with the plate and VIN partly hidden, plus only the extras the yard switched on (the parking spot, the amount owed, the redemption deadline, the hold reason). Links stop working when they expire or the yard turns them off. Status pages are not indexed by search engines. A yard can also send vehicles to Lot Helix from its own systems with a private import key; only a scrambled copy of that key is stored.

Third parties

When you use photo VIN reading, that photo is sent to Anthropic’s Claude service to read the VIN and is not stored by Lot Helix. VINs are looked up in the free U.S. NHTSA vehicle database to fill in the year, make and model. Fonts load from Google Fonts, so Google receives your IP address as it does for any font request. Sign-in and data storage are provided by Supabase; its sign-in library is served from this website, not from an outside network. The sign-up, sign-in and password reset forms use Cloudflare Turnstile to keep out bots; Turnstile checks your browser and is run by Cloudflare under its own privacy policy, without advertising cookies. Subscriptions are paid through Stripe. You enter your card on Stripe’s own secure page; we never see or store your card number. We keep only your Stripe customer and subscription IDs, whether your subscription is active, whether you pay monthly or yearly, and whether you are a founding customer, so we can turn your account on and off and bill the right price. Account emails (confirming your address, password resets and messages about your trial) are sent through our email provider, Resend, which receives your name and email address to deliver them.

How long we keep it

While your account is open, we keep your data so the service works. If you cancel, your account stays read-only and your data stays viewable and exportable for 90 days after your paid time or trial ends; after that we delete your company’s yards, vehicles, photos, invoices and team. If you ask us to delete your account, we delete it within 30 days of your request. Deleted data can stay in encrypted backups for up to 30 more days before those backups expire. Some records are kept longer: Stripe keeps billing records as payment and tax law require, the free-trial check keeps the normalized email, phone number and company name for 3 years so a business cannot restart its trial, driver sign-in attempts, with the IP address and the network block they came from, are kept for about a day to stop code guessing, and a status link stops working when it expires or is turned off.

Cookies and tracking

We do not use advertising or analytics cookies. We use your browser’s local storage to keep you signed in and to remember display settings such as light or dark theme.

Your choices

You can export your vehicles from the app menu at any time. To have your company’s account and data deleted, or to ask us about anything, email [email protected].

Children

Lot Helix is made for businesses and is not meant for children.

Changes and contact

If this policy changes, the date above changes. Operator: Thrash Digital LLC, 4501 Jackson St Extension, Ste C #217, Alexandria, LA 71303.