Cardinal HallHow We Handle Data
A plain account of what each product stores, where it lives, and how to delete it. The legal version is in our Privacy Policy.
The Short Version
- Cardinal Verified processes your lead file in your browser. We never receive it.
- Cardinal Relay and Cardinal Owe identify a customer by first name, last initial and stock number. No phone numbers, emails or addresses.
- Financial details differ by product: Relay records only the deal type (finance, cash or outside financing). Owe records what was promised, with an optional dollar amount, such as a down payment still owed or a lender stipulation, plus notes your team types.
- No product is built to hold Social Security numbers, full account numbers, driver’s license numbers, or credit reports and scores. Owe’s notes are free text, so keep those out of them.
- Your dealership owns its data. You can export it at any time and ask us to delete it.
- We do not sell data, share it for advertising, or use it to train AI models.
- This website sets no cookies, runs no analytics, and loads nothing from third parties.
Product by Product
| Cardinal Verified | Cardinal Relay | Cardinal Owe | |
|---|---|---|---|
| Where It Runs | In your browser | Our server, hosted by Render in the United States | Our server, hosted by Render in the United States |
| Customer Data | Whatever is in your export, processed only on your computer | First name, last initial, stock number, new or used, deal type | First name, last initial, stock number, vehicle description |
| Financial Details | Payment, rate and equity figures from your export, kept only in that browser | Deal type only: finance, cash or outside financing. No dollar amounts | What was promised, with an optional dollar amount and due date, such as a down payment or lender stipulation, plus free-text notes |
| Do Not Enter | Social Security numbers, full account numbers, driver’s license numbers, credit reports or scores. Nothing asks for them and neither product is designed to hold them. Owe’s notes are free text, so staff are told not to enter them | ||
| Staff Data | Sign-in email, managed by Netlify Identity | Name, role, optional email, PIN stored as a keyed hash | Name, role, optional email, PIN stored as a keyed hash |
| Stored Where | That browser's local storage, encrypted | A database on the server, with daily backups kept 14 days | A database on the server, with daily backups kept 14 days |
| Contacts Customers | No | No | No. It drafts messages for your team to send |
| How to Delete | Clear All Saved Leads in Scoring Settings, or clear that browser's site data | Ask us. Deleted within 30 days of the end of service | Ask us. Deleted within 30 days of the end of service |
The Owner View
A private page for a dealership group's owners, on our server hosted by Render in the United States. It stores each owner's email, a password kept only as a hash, and the key behind their six-digit sign-in code. From each store it holds summary counts only (average customer wait, deals past a red limit, past-due promises and, if the store shares them, Verified tier counts), never customer or staff names. Owner sign-ins and changes are logged with the owner's email. It ranks stores, never people.
If you are subject to the FTC Safeguards Rule
Dealerships that arrange financing are treated as financial institutions under the FTC Safeguards Rule and have to oversee the service providers that handle customer information. We designed our products to keep that oversight simple: Verified never sends customer financial data to Cardinal's own servers - everything is scored in the browser. It does save a working record locally in that browser (the current run, saved feedback, and a run history), which can include customer names, phone numbers, email addresses, VINs, and the payment, rate, and equity figures that came from your export. Verified encrypts that record (AES-256), and only the signed-in Verified account that saved it can unlock it. Notes, history and saved runs are deleted 90 days after they were saved, the next time Verified opens on that computer. The record stays, encrypted, through sign-out and comes back at the next sign-in; Clear All Saved Leads in Scoring Settings deletes it. Relay stores only a first name and last initial, nothing else about the customer. Owe is different: it tracks obligations like down-payment amounts and lender stipulations by design, so it does hold limited financial detail tied to a deal, plus whatever a store types into its own free-text notes. Do not enter full account numbers, SSNs, or other sensitive identifiers into Owe's notes fields.
Because Verified runs in the browser, the results live on the computer that ran it, encrypted. Securing that computer, and the export files and printouts made from it, stays with your dealership. We are happy to complete a vendor security questionnaire. Email cameron@cardinalhall.co.
How We Protect What We Do Hold
- All traffic is encrypted in transit over HTTPS.
- PINs are never stored in readable form, and repeated wrong PINs lock the sign-in for fifteen minutes.
- Access is split by role. Salespeople can act only on their own customers, and only an administrator can change settings.
- Every action is recorded in a history log your managers can review.
- Backups are taken daily and kept for fourteen days.
Reporting a Security Problem
If you believe you have found a security issue in any Cardinal Hall product, email cameron@cardinalhall.co with "Security" in the subject. We will acknowledge it within two business days.