Technology & Acceptable Use Policy

This policy explains how Drive Dash AI works and what we expect from you when you use it. It applies to your driving school as our customer, and to every person you let into your account — owners, managers, instructors, marketing staff, and any agency working on your behalf. You are responsible for what they do in the account.

It sits alongside three other documents: the Terms of Service (the commercial agreement, including plans, locations, and credits), the Privacy Policy (what personal data we handle and why), and the Data Processing Addendum (our formal processor commitments, including the subprocessor list and international transfers). Where one of those is the formal instrument on a point, it governs and this page simply explains it in plain English.

Creating an account and using the service means you accept this policy. If you cannot follow it, do not use the platform.

Drive Dash AI runs a set of tools — we call them agents — against each of your locations. Most of them run on their own on a schedule: daily, weekly, biweekly, monthly, or quarterly, depending on the tool. Those scheduled runs are included in your subscription. You can also start any tool yourself when you want an answer now; those on-demand runs spend credits.

Every run does three kinds of work. It retrieves data — from your connected accounts, from your website, or from measurement providers. It applies fixed rules and arithmetic to that data. And where prose is useful, it asks an AI model to draft wording. Results, findings, and the raw evidence behind them are stored against your account, so change over time is measured rather than guessed.

What the tools do

• Local rankings and grid scans: where your school shows up in Google's local results for the searches that matter, and how that position changes across a grid of points around each location.
• AI assistant visibility: whether AI assistants name your school when someone asks them for driving lessons in your area, tested with a fixed set of prompts across several engines.
• Website audit and crawling: a crawl of your site that checks a defined rule set — indexation, business information a machine can read, service and area coverage, page speed field data, and conversion basics — and returns an ordered list of findings with fixes.
• Google Business Profile management: reading and updating your profile — categories, hours, attributes, posts — and flagging gaps and drift.
• Reviews: collecting review activity, tracking velocity and sentiment, and drafting replies for you to approve.
• Content generation: briefs, topics, calendars, and draft posts based on the gaps the measurement tools actually found.
• Social scheduling and publishing: planning a calendar and, once you approve a post, publishing it to the channels you have connected and reading back how it performed.

Runs are rate-limited and quota-managed per organization. That keeps one account from exhausting a provider's capacity for everyone else, and keeps provider spend predictable.

We do not invent data. Everything the platform reports comes from your own connected accounts, from your website, or from one of the providers below. The complete processor list, with data categories and processing regions, is on the Subprocessors page.

Each source is optional in one important sense: when a key or a connection is missing, the affected tool reports the gap instead of guessing. But the platform does depend on these providers. They can change their terms, pricing, rate limits, or access, or go down, and when they do a tool can lose accuracy or stop reporting until it is adapted. We work around such changes as quickly as we reasonably can; we cannot guarantee continued availability of a third party's data.

This is the line that matters most, so we state it precisely: a number in this platform is either measured or it does not exist. AI models write prose. They do not decide whether a rule passed, and they never produce a score.

Measured deterministically

• Site audit rule outcomes and their severity, calculated from the crawl by fixed rules.
• Crawl facts: titles, meta tags, headings, status codes, canonicals, internal links, and structured data, captured as evidence you can check.
• Core Web Vitals field data, taken from real-user measurement rather than a simulated test.
• Local pack and geo-grid positions, review counts and review velocity, and business-information consistency across sources.
• Credit and run accounting, and every trend and comparison, which is arithmetic over stored measurements.

Generated by AI

• Draft social posts, Google posts, content briefs, and calendars.
• Draft review replies.
• Suggested topics, keywords, and customer questions.
• The plain-language wording that explains what a finding means and how to fix it.

AI visibility sits in between, and honestly so: the prompt we send and the answer an engine returns are real observations, and deciding whether your school was named in that answer is deterministic text and entity matching over the returned words.

Drafts need a human

Everything an AI model writes here is a draft. It can be inaccurate, out of date, off-brand, or against a platform's rules. You review and approve content before it is published, and you are the publisher of anything that reaches your profiles and channels. Scheduled runs produce analysis and drafts; they never publish content you have not approved.

Observations, not promises

Ranking and AI-visibility results describe what a search engine or an assistant returned for a specific prompt, at a specific time, for a specific location. Engines are non-deterministic and personalized, so the same prompt can return something different an hour later. These are observations.

Nothing in the platform is a guarantee of rankings, AI mentions, traffic, calls, leads, enrollments, or revenue. We will not promise a position, and you should be skeptical of anyone who does.

And when a measurement cannot be taken — a provider is unavailable, a connection is missing, an API returns nothing usable — we mark it unknown and say why. We do not fill the gap with an estimate dressed up as data.

Connected account credentials

We connect to Google Business Profile and to social platforms using OAuth. You approve a specific set of permissions on the platform's own consent screen, and we never ask for and never store your password for Google, Meta, TikTok, X, LinkedIn, Pinterest, or YouTube. If anything claiming to be Drive Dash AI asks you for a platform password, it is not us.

What OAuth gives us instead is a token: a revocable credential standing in for the permissions you granted. Tokens are the sensitive material, so they are handled like this:

• Tokens are encrypted by our application before they are written to the database, using AES-256-GCM authenticated encryption with a unique initialization vector for each value. The encryption key is held as a server-side secret and is never stored in the database. Decryption happens only in server-side code, never in the browser.
• Google: no access token is stored at all. Only a refresh token is retained, and short-lived access tokens are requested as needed and held in memory for the duration of the request.
• Social platforms (Facebook, Instagram, TikTok, X, LinkedIn, Pinterest, YouTube): both access and refresh tokens are encrypted the same way before storage.
• The tables holding these encrypted values are reachable only by the privileged server-side role. No signed-in user role and no anonymous role holds any privilege on them, so they cannot be read through the public API even with a valid session.
• This application-layer encryption sits on top of, and is separate from, the provider-managed encryption at rest that our managed infrastructure applies to the whole database and to stored files.

What we never do with your credentials

• We never share or sell your tokens.
• We never use a connection for anything beyond the features you use.
• We never post, change, or delete anything outside the permissions you granted.
• We never expose tokens to the browser, and we never include them in logs, exports, reports, or support tickets.

Revoking access

You can revoke a connection at any time, in the app or in the platform's own security settings. Revocation stops all future actions immediately. We delete the stored token — and for Google we revoke it with Google first — but it does not retract content that has already been published.

Tenant isolation and access control

• Row-level security scoped to your organization on every application table, so one account's data is not reachable from another account's session.
• Role-based access inside the app, so team members only reach the surfaces their role allows.
• Internal support access is gated separately from ordinary customer accounts.
• Least-privilege database grants, with schema changes shipped as reviewed migrations and automated scanning of schema, grants, and policies.

Your data and AI providers

We do not train models on your data and we do not license it to anyone for training. Content sent to a model provider travels over that provider's standard commercial API and is governed by its API terms and retention practices; we do not control those terms, and if a provider's position changes we will update the Subprocessors page. Which providers receive what is set out above and in the Data Processing Addendum.

Limits, honestly stated

No system is perfectly secure, and we would rather describe our measures accurately than aspirationally: what is written above is what the software does today, and we claim nothing beyond it. Measures may change as the platform changes, but not in a way that reduces the overall level of protection, and we will notify customers of material changes. The Privacy Policy and the Data Processing Addendum carry the formal commitments.

You keep control of what goes out under your name, so a few things stay with you.

Never put student data into the platform

Driving schools teach minors, so we are blunt about this: do not upload, paste, or store the personal data of students or minors anywhere in Drive Dash AI. That means no student rosters or lesson lists, no student or parent names, phone numbers, emails, or addresses, no permit or license numbers, and no photos or videos in which a student is identifiable — not in content drafts, not in notes, not in uploads, not in support tickets. The platform is built to market your business, not to hold student records, and it is not designed or contracted for that data. If you have sent us student data by mistake, tell us and we will delete it.

Lawful, honest use

• Use the service lawfully, and do not publish or distribute unlawful, defamatory, harassing, hateful, deceptive, or infringing content through it.
• Keep the business information you publish accurate — hours, services, pricing, locations, licensing, certifications, and DMV approvals. We publish what you approve; the accuracy is yours.
• Do not impersonate another business, instructor, reviewer, or person, or misrepresent your credentials or approvals.
• You are responsible for any content you approve for publication, including AI drafts you accept without editing.

Reviews

No review manipulation, in any form: no writing or buying fake reviews, no offering discounts, lessons, gift cards, or any other incentive in exchange for a review, no gating requests so only happy customers are asked, and no bad-faith review disputes. Our review tools request feedback neutrally and flag prohibited incentives, and you may not work around those guardrails.

The platforms you connect

• You are responsible for your own compliance with the policies of Google, Meta, TikTok, X, LinkedIn, Pinterest, YouTube, and any other platform you connect, including their content, advertising, automation, and review rules.
• We act on your behalf strictly within the OAuth permissions you grant, and only for the actions the connected tool describes.
• Do not automate posting or data collection in a way that breaks a connected platform's terms, rate limits, or automation rules.
• If a platform restricts, suspends, or removes your account or content, that is that platform's decision. We will help you understand exactly what we sent, but we cannot reverse it.

Boundaries on the service itself

• Do not scrape, crawl, or harvest third-party sites or platforms through the service beyond the measurement the tools are designed to perform, and do not point the crawler at a site you do not own or have permission to audit.
• Do not resell, sublicense, white-label, or provide the service to third parties without a written reseller or agency agreement with us, and do not share your login with another business or individual.
• Do not circumvent credit accounting, provider quotas, rate limits, plan location caps, or trial limits — including through multiple accounts, shared credentials, or automated signups.
• Do not probe, scan, or test the security of the platform without our written permission, interfere with its operation, or attempt to reach another organization's data. If you find a vulnerability, report it to brad@driveredconsultants.com and we will work with you.
• Do not use the platform to build a competing product, or to benchmark it for publication without our consent.

Automation costs money at the provider end, so the credit system exists to keep the technology sustainable rather than to nickel-and-dime you. The commercial detail is in the Terms of Service; here is how it relates to using the technology:

• Scheduled runs — daily, weekly, biweekly, monthly, and quarterly — are included in your subscription and never consume credits.
• On-demand runs you start yourself consume credits from your pooled monthly allowance, shared across all of your locations.
• Each tool's credit cost is shown before you start the run, so nothing is spent without you seeing the price first.
• Rate limits and per-organization quotas apply to every run. They protect shared third-party capacity so one busy account cannot degrade the service for everyone else.
• Sustained abuse — scripted hammering of run endpoints, automated signups, or running one account for several unrelated businesses — may be throttled, and repeated or deliberate abuse may lead to suspension.

1. Warning: for most first-time issues we contact the account owner and give you the chance to put it right.
2. Throttling: we may slow or pause automated runs on an account that is consuming shared provider capacity unfairly or triggering provider errors.
3. Suspension: we may suspend runs, publishing, or the whole account where a violation is serious, repeated, or unresolved, or where it puts a provider connection, another customer, or the platform's security at risk.
4. Termination: we may terminate the account for material or repeated breach, unlawful activity, or attempts to circumvent limits, as set out in the Terms of Service.

We may also refuse to generate, schedule, or publish content we reasonably believe would violate a platform's policies, applicable law, or this policy, and we may remove such content from the platform. Where an account threatens other customers' access to shared provider quotas, we will act to protect that shared capacity first and talk to you immediately afterwards.

We can act without prior warning where the law, a platform's demand, or the need to prevent imminent harm requires it. Report suspected misuse to brad@driveredconsultants.com.

The technology changes, so this page will too — usually because we added a tool, changed a data source, or a provider changed its rules. Each version carries the effective date shown at the top of this page.

For material changes — new categories of data source, new restrictions on how you may use the service, or a change that reduces what a tool can do — we will notify the account owner by email and in the app before the change takes effect. Minor clarifications and wording fixes take effect when published. Continuing to use the service after a change takes effect means you accept the updated policy; if you do not, you can cancel under the Terms of Service.

Questions about this policy go to brad@driveredconsultants.com.