What we do with your data, in full.

• —Account and business information: name, business email, phone, dealership name and address, role, login credentials, and communications with us (including support chat).
• —Billing information: processed by our payment processor (e.g., Stripe); we receive limited information such as card brand, last four digits, and transaction status. We do not store full card numbers.
• —Usage and device information: log data, IP address, browser and device type, pages viewed, actions taken in the product, and approximate location derived from IP. Collected partly via cookies and similar technologies — see our Cookie Policy.
• —Marketing information: if you engage with our emails or contact us, we collect what you submit (e.g., your website address) and engagement data. If you are a dealer we contact through outbound sales, we may have obtained your business contact details and publicly available information about your dealership and its advertising from public sources (e.g., your website, public ad libraries) or lawfully obtained data providers.
• —Content you provide for the Services: inventory data, images, and branding you connect or upload. This is mostly business data about vehicles, not personal data, but it may incidentally contain personal information (e.g., a license plate in a photo or a salesperson's name in a listing).
• —Connected account credentials: if you connect a social media account or Platform account so we can post or work on your behalf, the connection is made through our publishing provider (see the Data Processing Addendum), which holds the access tokens the Platform issues; we use them only to perform the Services. Disconnecting the account revokes them.

We use the information above to: provide, operate, secure, and improve the Services; create and deliver the videos and other outputs you subscribe to; process payments; provide support; send service communications; send marketing communications you can opt out of at any time; understand product usage; enforce our terms; and comply with law. Where GDPR applies, our legal bases are performance of a contract, our legitimate interests (e.g., B2B marketing, security, product improvement), consent where required (e.g., certain cookies), and legal obligations.

We may create aggregated or de-identified data (which no longer identifies you) and use it for any lawful purpose, including publishing industry benchmarks.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with: service providers who process it for us under contract (hosting and infrastructure, payment processing, communications and chat, email delivery, product analytics such as PostHog); advertising and distribution platforms you direct us to work with on your behalf (e.g., Meta, Google, TikTok) — noting that inventory feeds are business data you ask us to distribute; professional advisors (lawyers, accountants) under confidentiality; authorities where required by law or to protect rights, safety, or the integrity of the Services; and successors in a merger, acquisition, or asset sale (with notice where required).

We are based in the United States and process data there. Where we receive personal data from the EU/EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and UK/Swiss addenda) with our service providers, or other lawful transfer mechanisms.

We keep personal information for as long as needed for the purposes above: account data for the life of the account plus a reasonable period; billing records as required by tax and accounting law; marketing data until you opt out or it becomes stale; logs for a limited operational period. We then delete or de-identify it.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. EU/EEA and UK individuals may also lodge a complaint with their supervisory authority. US state residents (e.g., California) may have rights to know, delete, and correct, and the right not to be discriminated against for exercising them; we do not "sell" or "share" personal information as those terms are defined in the CCPA. To exercise any right, email contact@carloophq.com; we will verify your request and respond as required by law. Marketing emails contain an unsubscribe link.

We use reasonable technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and least-privilege practices. No system is perfectly secure; please use a strong, unique password and protect your credentials.

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children.

Some features involve personal data about our dealers' customers and audiences, which we process only as the dealer's processor/service provider under their instructions:

• —Advertising audience data: pixels, conversion APIs, and Platform audiences configured in the dealer's own Platform accounts belong to the dealer and the Platform; where we assist with configuration, we act on the dealer's behalf.
• —Shared vehicle links: when a dealership shares a Carloop-hosted vehicle page or carousel with a customer, we collect technical interaction data (e.g., whether and when the link was opened, device/browser type, approximate location from IP) and provide it to that dealership.
• —Incidental personal data in inventory content (e.g., a face or plate in a photo) is processed only to provide the Services.

For this data, the dealer is responsible for its own privacy notices and legal bases. If you are a consumer whose data appears in this category, please contact the dealership you interacted with; we will support their response, or you can reach us at contact@carloophq.com and we will refer your request to the responsible dealer. Our Data Processing Addendum governs this processing for dealers subject to the GDPR and similar laws.

We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, provide additional notice (e.g., email or in-product). Continued use after the effective date means the revised Policy applies.