Your dealership's data is yours. Period.

QoreAI maintains SOC 2 Type II certification and implements industry-standard security measures including encryption at rest and in transit, access controls, regular security audits, and continuous monitoring. We follow the Guardian Framework principles for data governance.

We are compliant with the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). You have the right to request access to, correction of, or deletion of your personal information.

Your data belongs to you. QoreAI operates on a dealer-first data architecture. Reports, notes, attachments, and KPIs you upload are visible only to people inside your dealership account. We do not sell, rent, or share your dealership data with third parties. We do not use it to train AI models for anyone else.

When you use AI features (like the agenda or weekly summary), your data is sent to our AI provider only to generate that response for you, and is not retained for model training.

• General Manager: sees every department's submissions and the full meeting view.
• Department managers: see only their own department's submissions and history.
• Other dealerships: cannot see, query, or even know your data exists.
• QoreAI staff: do not access dealership data except for explicit support requests you initiate.

All data is encrypted in transit (TLS 1.2+) and at rest using our cloud provider's managed encryption. Database queries are filtered server-side by your dealership ID using row-level security, so another dealership physically cannot read your rows.

File attachments are stored in a private bucket. Download links are short-lived and scoped to the requesting user.

Sign in with email and password (passwords are checked against the Have I Been Pwned breach database) or with Google. Magic upload links sent in reminder emails are scoped to a single department for a single meeting, and expire after the meeting starts.

The GM controls who is invited and which department each manager belongs to. Removing a manager immediately revokes their access. Roles are stored server-side, not in the browser, so they can't be tampered with from the client.

You can delete a submission or attachment at any time from the dashboard. Platform data is retained for the duration of your service agreement plus 30 days for export purposes. Upon termination of services, your data is made available for export and subsequently deleted from our systems within 30 days unless otherwise required by law.

We use a small set of trusted vendors to run the service:

• Cloud hosting, database, auth, file storage for running the app.
• Email delivery for meeting reminders and magic upload links.
• AI gateway for features you explicitly trigger (agenda, summaries). Inputs are not used for third-party model training.

If you believe you've found a vulnerability or your account has been compromised, contact your GM right away, and email hello@qoreai.com with details. We take security reports seriously and respond quickly.

This page is a plain-English summary of the security and privacy practices we have in place for QoreWeekly. It is not a legal contract. For the full Privacy Policy, contractual data terms, or our Data Processing Addendum, please contact your QoreAI representative or review the QoreAI Privacy Policy.