Privacy Policy

Overview

RTAFlow LLC ("RTAFlow", "we", "us", "our") provides appraisal workflow software for independent vehicle appraisers, including a web application at rtaflow.com and a companion Chrome extension ("Comp Capture"). This policy explains what data we collect, how we use it, and your rights. Our Terms of Service govern your use of RTAFlow.

Chrome Extension — Comp Capture

What the extension does

The Comp Capture extension helps appraisers document vehicle comparable sales. When you visit an auto listing page (dealer websites, auction platforms, listing aggregators), the extension can read visible listing details — such as VIN, price, mileage, and dealer zip code — directly from the page and send them to your RTAFlow account. It can also capture a PDF of the listing page using Chrome's built-in print-to-PDF capability.

Data read from auto listing pages

The extension reads the following fields from auto listing pages you visit when you choose to add a comparable:

• Vehicle Identification Number (VIN)
• Listed sale or asking price
• Odometer reading (mileage)
• Dealer or seller zip code

This data is sent to the RTAFlow API (rtaflow.com) solely to create a comp record in your appraisal file. It is not used for any other purpose.

Authentication token

When you log in to RTAFlow in your browser, the extension automatically reads your authentication token from the browser's local storage for rtaflow.com. This token is stored locally in the extension's own storage (chrome.storage.local) and used to make authenticated requests to the RTAFlow API on your behalf. The token is never sent to any third party.

Chrome Debugger API

The extension uses Chrome's Debugger API exclusively to invoke Page.printToPDF — the same mechanism as Chrome's built-in print dialog — to capture a listing page as a PDF. The debugger is attached only during the capture operation and immediately detached. No debugging data, page source, or network traffic is recorded or transmitted.

Permissions summary

• storage — stores your auth token and active appraisal selection locally in the browser
• activeTab / scripting — reads visible listing data from the current tab when you initiate a capture
• debugger — captures the current tab as a PDF via Chrome's print-to-PDF function
• host permissions (<all_urls>) — required because auto listings appear on hundreds of different dealer and auction websites; there is no finite list of domains

Web Application

When you use RTAFlow at rtaflow.com, we collect the information you provide directly: account details (name, email, business name, phone, and address), your settings and templates, appraisal data you enter, and documents and photos you upload. We also keep basic records of how the service is used, such as sign-in times and server logs, to keep it secure and working. This data is used only to provide the RTAFlow service.

Your Customers' Data

Appraisers use RTAFlow to work with their own customers (vehicle owners). Customer information, such as name, contact details, vehicle and insurance claim details, and documents like repair estimates, is entered by the appraiser or submitted by the customer through a link the appraiser sends. We process this information on the appraiser's behalf and only to provide the service to them. If you are a customer and have a question about your information, contact your appraiser first; we will help them respond.

Payment and Accounting Integrations

Appraisers can connect a Square account to request and track payments from their customers. QuickBooks Online is coming soon, and this section will apply to it in the same way. Connecting is optional and is done by the appraiser through the provider's own sign-in and authorization screen.

• What we access: only what the integration needs, such as the business's location and invoice settings, the customer records, invoices, and payment links we create, and whether those have been paid.
• What we store: encrypted access tokens, and on each claim the payment amount, date, status, and the provider's reference IDs. We never see or store card or bank account numbers; the provider handles those directly.
• How we use it: only to create payment requests, record payments, and show payment status to the appraiser. We do not sell this data, use it for advertising, or use it to train AI models.
• When you disconnect: we ask the provider to revoke our access, delete the stored tokens immediately, and stop syncing. Payment records already saved to your claims stay as part of your claim history until you delete those claims or your account. You can also revoke access from your Square account settings.

Service Providers

We share data only with the services we need to run RTAFlow:

• Resend: sends transactional email, such as links, letters, and reports
• Your own email provider: if you set up sending from your own mailbox (for example, Gmail), customer emails go out through it instead
• Stripe: bills RTAFlow subscriptions; your card details go directly to Stripe
• Square: only when an appraiser connects it, as described above (and Intuit, once QuickBooks Online is available)
• Marketcheck: receives vehicle details (year, make, model, and sometimes the VIN) and a ZIP code when you search for comparable listings
• NHTSA: receives a vehicle's VIN to decode its year, make, and model
• Google Fonts: serves the app's fonts, so your browser's IP address and user agent reach Google when a page loads
• Error monitoring: receives technical error reports, which can include details of the request that failed; we use them only to fix problems

Data We Do Not Collect

• We do not track your browsing history or pages you visit outside of an active capture
• We do not sell your data to any third party
• We do not use your data for advertising
• We do not share your data with anyone except the service providers listed above, or when the law requires it

Data Retention and Deletion

Your account data is retained for as long as your account is active. Appraisers can delete individual claims at any time. You may request deletion of your account and associated data at any time by contacting us. We delete it within 30 days of the request, except records we must keep by law (such as billing records). Backups are overwritten on our normal backup cycle.

Security

All data transmitted between the extension, the web application, and our servers is encrypted using HTTPS/TLS. Your web session uses a secure, HttpOnly cookie. A copy of your sign-in token is also kept in your browser's localStorage so the Chrome extension can use it, and in the extension's chrome.storage.local. We do not load third-party scripts into the web app. Tokens for connected payment accounts are encrypted at rest, and access to production systems is limited to the people who operate the service.

Children

RTAFlow is a business tool and is not directed at anyone under 18.

Changes to This Policy

If we make a material change to this policy, we will notify account holders by email or in the app before it takes effect, and update the date at the top of this page.

Contact

If you have questions about this policy or want to request data deletion, email us at support@rtaflow.com.