Xelshard LLC ("DSD," "we," "us") operates the Driving School Desk platform. This Privacy Policy explains how we collect, use, share, and protect personal information for Subscribers (driving school owners), Authorized Users (staff and instructors), End-Customers (students booking through the platform), and visitors to our marketing site.
1. Information We Collect
From Subscribers at Sign-Up
- Business name, address, owner name, email, and phone
- EIN / Business Tax ID (optional at sign-up)
- Selected subscription plan and time zone
- IP address and device info (for security audit logging)
From Authorized Users (Staff & Instructors)
- Name, email address, role, login timestamps
- Schedule preferences and time-off requests
From End-Customers (via Booking Widget)
- First name, last name, email address, phone number
- Service, date/time, instructor preference, booking notes
- SMS consent status (opt-in and opt-out timestamps)
What We Do NOT Collect
- Full payment card numbers (handled by Stripe — we store only last 4 digits)
- Government-issued ID numbers
- Biometric data or sensitive health information
2. How We Use Information
- Provide, operate, and improve the Service
- Process payments and manage subscriptions
- Send booking confirmations and appointment reminders
- Send onboarding emails and product tips (opt-out available)
- Security — fraud prevention, CAPTCHA, rate limiting
- Tax compliance and invoicing
- Respond to support requests
We do not sell personal information to third parties for advertising.
3. SMS & Text Messaging Program
Driving School Desk (operated by Xelshard LLC) provides the SMS messaging service used by driving schools on our platform. When you book a driving lesson through a school that uses Driving School Desk, you may receive automated SMS text messages sent through Driving School Desk on that school's behalf — including booking confirmations, lesson reminders, schedule changes, and post-lesson feedback requests. Message frequency varies based on your booking activity. Message and data rates may apply. You can reply STOP at any time to cancel, or HELP for assistance.
How you opt in: You provide your mobile number and affirmatively agree to a consent disclosure on the school's online booking page before your booking is completed. Consent is not pre-checked and is required only to enable lesson-related text messages. You can opt out at any time by replying STOP.
We do not sell or share your mobile phone number or your SMS opt-in consent with any third parties or affiliates for their own marketing or promotional purposes. Mobile information (including your phone number and opt-in status) is shared only with our messaging sub-processor, Twilio, for the sole purpose of delivering the booking-related messages you have opted into. SMS opt-in consent is never shared with third parties for marketing purposes.
Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates for any reason.
4. How We Share Information
Sub-Processors
| Sub-Processor | Purpose | Location |
|---|---|---|
| Google Firebase Authentication | User identity & login | United States |
| Google Cloud SQL | Data storage | United States |
| Google Cloud Run | Application hosting | United States |
| Twilio | SMS notifications | United States |
| Resend | Transactional email | United States |
| Stripe | Payment processing | United States |
| Cloudflare | CDN, DDoS protection, CAPTCHA | United States / Global |
We may disclose data as required by law or to protect the safety of DSD, Subscribers, or others.
5. Subscriber Responsibilities
Subscribers are the Data Controllers for their end-customers' personal information. Subscribers are responsible for providing a privacy notice to their own customers, obtaining TCPA-compliant SMS consent, and responding to their customers' data requests. DSD processes end-customer data only as directed by the Subscriber to provide the booking service.
6. Data Retention
| Data Type | Retention |
|---|---|
| Subscriber account and booking data | Active subscription + 60 days post-termination |
| Security audit logs | 2 years |
| Payment records (Stripe) | 7 years (tax/legal) |
| Email delivery logs | 90 days rolling |
| Server access logs | 1 year rolling |
7. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your personal information. California residents have additional rights under CCPA/CPRA. Texas residents have rights under the Texas Data Privacy and Security Act (TDPSA effective July 1, 2024).
To exercise any right, email privacy@xelshard.com. We respond within 30 days.
8. Security
We implement TLS 1.2+ encryption in transit, AES-256 encryption at rest, Firebase Authentication, input sanitization, CAPTCHA on public forms, and rate limiting on all endpoints. In the event of a data breach affecting personal information, we will notify affected Subscribers within 72 hours.
9. Children's Privacy
The Service is a B2B platform. We do not knowingly collect personal information from individuals under 13. Subscribers who schedule driving lessons for minors are responsible for obtaining appropriate parental consent.
10. Changes to This Policy
Material changes are communicated by email at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.
11. Contact
Xelshard LLC — Privacy
2435 N Central Expy, 12th Floor, Richardson, TX 75080
Email: privacy@xelshard.com
Support: support@drivingschooldesk.com