Privacy Policy

Effective August 19, 2026

1. Scope

This Privacy Policy explains how Sammons Consulting LLC, doing business as Crash Science (“Crash Science,” “we,” “us,” or “our”), handles information through the Crash Science website, member application, 3D vehicle database, case workspace, Team administration, support communications, and related services (the “Service”). It does not apply to third-party sites or services that publish their own privacy notices.

2. Information we collect

Account and organization information

We collect information you provide, such as your name, email address, company or agency, password-verification status, membership plan, Team role, invitation status, and account preferences. Our authentication provider processes passwords; Crash Science does not receive your plain-text password.

Customer content

When you use the professional workspace, we process the case titles, case numbers, client references, loss dates, notes, selected vehicles, measurements, marked areas, report settings, issued reports, and related records that you choose to store. Please do not place regulated health information, payment-card data, or information unrelated to your professional use in the Service.

Billing and transaction information

Stripe processes payment methods and payment-card details. Crash Science receives limited billing records such as your Stripe customer status, subscription plan, seat quantity, billing interval, invoice state, renewal or cancellation state, and transaction totals. We do not store full card numbers.

Usage, device, and security information

We may collect sign-in and session events, browser and device information, IP-derived security information, page and feature activity, model-stream ticket activity, error logs, and audit events. This information helps operate the Service, investigate abuse, protect licensed model access, and diagnose problems.

Inquiries and communications

Product and vehicle-coverage inquiries may include your name, organization, work email, phone number, membership interest, requested vehicle, and message. We also process limited device and IP-derived anti-abuse data to rate-limit repeated submissions; the public inquiry workflow stores a one-way security hash rather than the submitted IP address. Do not send claim files, confidential evidence, or sensitive client information through ordinary email or a public form.

3. How we use information

We use information to provide and secure accounts; operate case, measurement, report, catalog, billing, and Team features; authenticate authorized users; process subscriptions; provide support; send service and security notices; prevent fraud, abuse, and unauthorized model extraction; maintain audit and integrity records; improve reliability; comply with law; and enforce our Terms of Service.

4. Legal bases and professional use

Depending on where you are located, we process information to perform our contract with you, pursue legitimate interests such as security and product operation, comply with legal obligations, and act with your consent where required. Customers are responsible for having an appropriate basis to place personal or case-related information in the Service.

5. How information is shared

We do not sell personal information. We may share information:

• With your Team. Workspace owners and authorized Team administrators can manage membership, roles, seats, and billing. Case content remains limited to the case owner and people explicitly assigned access.
• With service providers. We use providers for hosting, authentication, databases, storage, email delivery, payments, security, and operational support. Current core providers include Supabase, Stripe, Resend, and OpenAI or Cloudflare-backed hosting services. They may process information only to provide services to Crash Science under their applicable agreements.
• For legal and safety reasons. We may disclose information when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate fraud or abuse, or enforce agreements.
• In a business transaction. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required.

6. Team workspaces

The organization that provides your Team access may control your membership and certain account-level records. Team owners and administrators can invite, suspend, remove, or reassign users according to their permissions. Contact your Team owner first for workspace-access requests. Crash Science does not give a Team administrator blanket access to privately owned case content unless the Service expressly shows that access has been assigned.

7. Retention and deletion

We retain account and customer content while needed to provide the Service and for legitimate backup, security, legal, and dispute-resolution purposes. Subscription cancellation stops future renewal but does not itself delete the account or saved work. When an account or Team member is removed, we may retain limited membership, billing, audit, legal-acceptance, report-integrity, and chain-of-custody records when necessary to protect customers, document professional work, comply with law, or resolve disputes. Backup copies may persist for a limited period before cycling out.

Public product inquiries and vehicle-coverage requests are retained for up to 12 months from submission for follow-up, prioritization, and recordkeeping, then automatically removed. Short-term anti-abuse counters are removed after their rate-limit window is no longer operationally useful.

To request access, correction, export, or deletion, email privacy@crash-science.com. We may verify your identity and may decline or limit a request where retention is required by law, contract, security, professional-record integrity, or another lawful exception. Team-managed information may require coordination with the workspace owner.

8. Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of the Service, including authenticated access, database access rules, private model storage, short-lived stream authorization, encryption in transit, and audit records. No system is completely secure. You are responsible for protecting credentials, using a unique password, maintaining secure devices, and promptly reporting suspected unauthorized access.

9. International processing

Crash Science and its providers may process information in the United States and other locations where they operate. Those locations may have different privacy laws. Where required, we use contractual and other safeguards for cross-border transfers.

10. Children

The Service is designed for collision, forensic, insurance, legal, and related professionals and is not directed to children under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy as the Service or law changes. We will post the updated version and effective date and, when a material change requires renewed agreement, ask account holders to acknowledge the new version before continuing.

12. Contact

Privacy questions and requests: privacy@crash-science.com
General support: help@crash-science.com