Privacy Notice

1. Who we are

DealSafe Corporation ("DealSafe," "we") provides a compliance platform to automobile dealerships. This notice explains what personal information we handle, why, and how to reach us about it.

DealSafe handles personal information in two distinct roles:

• For our own business (this website, sales and marketing, customer accounts), DealSafe is the controller/business deciding how that information is used.
• Inside the platform, DealSafe processes consumer information on behalf of dealerships as their service provider. The dealership you are buying from is the business responsible for that information; this notice describes DealSafe's handling of it, but requests about it generally go to your dealership (see Section 7).

2. What we collect

A. Website and business contacts. When you request a gap assessment, book a call, or contact us: your name, dealership, role, work email, phone number, and the answers you choose to give us in our questionnaires. We use HubSpot to operate our website forms and email.

B. Platform consumer data (on behalf of dealerships). When a dealership uses DealSafe for a vehicle purchase, the consumer enters on their own device: name, date of birth, address, phone, email, Social Security number, driver's license number and photo, income and employment information, and credit application data. The platform also records consents (each separately time-stamped), identity-verification and screening results, and access logs showing which dealership personnel viewed which records.

C. What we do not collect. We do not collect advertising profiles, behavioral tracking data, or information about children. Our services are not directed to anyone under 18.

3. How we use it

• Website/business information: to respond to you, deliver assessments and reports, operate customer accounts, and send service communications. We do not sell your information.
• Platform consumer data: only to provide the contracted service to the dealership: intake, identity verification, consent capture, routing applications at the dealership's direction, and maintaining the compliance evidence record. We never use it for our own purposes, never sell it, and never share it for cross-context behavioral advertising.

4. Who receives it

• Service providers acting for us: Amazon Web Services (hosting, us-west-1, United States) and 700Credit (credit reporting and screening services, at the dealership's direction on the dealership's own account). Each is bound by written contract to protect the information.
• At the dealership's direction: the dealership's chosen credit networks (DealerTrack, RouteOne, CUDL), lenders, and DMS receive the application the dealership instructs us to route. Once delivered, those recipients' own privacy practices apply.
• Legal process: where we are legally compelled, with notice to the affected dealership unless prohibited.
• We do not sell personal information, and we do not share it for advertising.

5. Where it is and how it is protected

All platform data is stored in the United States (AWS, Northern California). Stored data is encrypted; Social Security numbers, driver's-license images, and credit data receive an additional layer of encryption before storage. Within a dealership, only General Manager and Finance & Insurance roles can view consumer PII, and every access is logged. No DealSafe employee has access to consumer personal information held in the platform. All DealSafe personnel systems require multi-factor authentication.

6. How long we keep it

Deal records (including consents, screening results, and access logs) are retained for seven years, consistent with dealership record-keeping obligations, unless a dealership instructs deletion or a legal hold applies. Website and lead information is kept while the business relationship is active and deleted or anonymized on request.

7. Your choices and rights

About platform data: the dealership you transacted with is responsible for your information and your requests. Contact them first. We support dealerships in fulfilling access, correction, and deletion requests through the platform. If you contact us directly about platform data, we will route your request to the dealership and tell you we have done so.

About website/business data: you may request access, correction, or deletion of the information we hold about you by emailing privacy@dealsafe.com or deanna@dealsafe.com, or by writing to the address above. We will not discriminate against you for exercising these rights.

California residents: where the CCPA/CPRA applies, you have the rights to know, access, correct, and delete personal information, and to opt out of sale or sharing. Because we do not sell or share personal information, there is nothing to opt out of. DealSafe acts as a service provider to dealerships under written contract and honors the obligations that come with that role.

8. Breach notification

DealSafe maintains a documented incident response and breach management procedure. If a breach of unencrypted personal information occurs, notifications are made within the timeframes required by law, including 30-day notification for California residents and submission to the California Attorney General where required.

9. Changes

If we change this notice, we will post the updated version with a new effective date. Material changes to how we handle platform data are notified to dealership customers in advance.

10. Contact our Privacy Officer

Questions, requests, or complaints about privacy at DealSafe:

Deanna Crossman, Privacy & Security Officer
DealSafe Corporation, 211 W 19th St Ste 300, Cheyenne, WY 82001
deanna@dealsafe.com · support@dealsafe.com

---

This privacy notice describes DealSafe Corporation's practices as of the effective date. Dealerships using the DealSafe platform maintain their own privacy notices and programs.