Privacy Policy of DealerDesker

DealerDesker is operated by Syncorise LLC dba DealerDesker ("we," "us," or "our"). We provide software that independent and small auto dealers use to build deal jackets, complete and electronically sign sales paperwork, collect payments, and run the day-to-day of their dealership.

Because of what our software does, we handle two very different kinds of information: information about you — the dealer and the people on your team who use DealerDesker — and the sensitive information about your customers that you enter to put a deal together. We treat each differently, and the next section explains how.

By using our website or the DealerDesker application, you agree to the practices described in this policy.

It matters who is responsible for which data, so we want to be clear:

• Your account and your use of DealerDesker. For information about you, your dealership, your team, and how you use the service, we act as the business responsible for that data (the "controller"), and this policy governs how we handle it.
• Your customers' deal information. For the buyer and deal information you enter, you are responsible for that data and you decide how it is used. We act as your service provider (or "processor") and handle that information only to provide the service to you, following your instructions and our agreement — not for our own purposes.

If one of your customers wants to access, correct, or delete the information in a deal, that request should go to the dealership that collected it. We will help you respond as your service provider.

Separately, you enter sensitive information about your customers to build a deal. We process this on your behalf:

• buyer & co-buyer name
• home address
• date of birth
• Social Security number
• driver's license
• contact details
• vehicle & VIN
• lienholder details
• financing & deal terms
• electronic signatures

Information you provide

This includes your account and dealership details (such as your name, dealership name and license number, business address, email, and phone), the login credentials you create, the buyer and deal information you enter, and the messages you send us for support.

Information collected automatically

When you use our website or app, we and our providers automatically collect technical and usage information — such as your IP address, device and browser type, pages and features you use, approximate location derived from your IP, and information stored through cookies and similar technologies (see Cookies & tracking).

Information from third parties

We receive limited information from the partners that power certain features — for example confirmation of a completed payment from our payment processor, vehicle history results from a reporting provider when you request one.

Running a vehicle deal involves some of the most sensitive information there is — Social Security numbers, driver's-license details, dates of birth, and financing terms. We take this seriously and handle it only to provide the service.

• Driver's Privacy Protection Act (DPPA). Information drawn from motor-vehicle records is handled consistent with the DPPA. You are responsible for having a permissible purpose to collect and use it, and we process it only as needed to deliver the service to you.
• Gramm-Leach-Bliley Act (GLBA). Where your dealership acts as a financial institution — for example when arranging financing — the nonpublic personal information involved is handled with appropriate safeguards, and we act as your service provider under the GLBA Safeguards Rule.
• No advertising use. We never use your customers' Social Security numbers, driver's-license data, financial details, or other deal information for advertising, and we do not sell it.

We use the information described above to:

• Provide, operate, and maintain DealerDesker and its features
• Create and manage your account and your team's access
• Generate deal jackets, contracts, disclosures, and other paperwork
• Process payments and charge the per-deal fee
• Provide customer support and respond to your requests
• Keep the service secure, prevent fraud and abuse, and troubleshoot problems
• Understand how the service is used so we can improve it
• Send you service and account messages, and — where permitted — news about our own products (you can opt out anytime)
• Comply with our legal obligations and enforce our terms

We share information only as needed to run the service and as described here. We do not sell your information or your customers' personal information for money.

• Service providers. Trusted vendors that host our systems and power specific features, listed below, acting on our instructions.
• At your direction. When you send a contract for electronic signature, request a vehicle history report, share a deal with a lienholder, the relevant information goes where you direct it.
• Legal and safety. When required by law, subpoena, or government request, or to protect the rights, property, and safety of our users, the public, or us.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your consent. For any other purpose you approve.

Our public marketing website uses analytics and advertising tools that may involve "sharing" limited identifiers for cross-context advertising under some state laws. You can opt out using the controls described in Your choices and rights. These tools are not used inside the DealerDesker application with your deal data.

We work with a small set of established providers to deliver the service:

• Stripe, Inc. — payment processing. Card details are handled by Stripe under PCI-DSS; we do not store full card numbers. Privacy policy.
• DocuSign, Inc. — electronic signatures on contracts and disclosures.
• ClearVIN (American Auto Solutions LLC) — vehicle history reports, when you request one.
• Cloudflare, Inc. — hosting, content delivery, and protection against malicious traffic.
• Google LLC and Meta Platforms, Inc. — analytics and advertising measurement on our marketing website.
• HubSpot, Inc. — managing sales and support conversations.

On our website we use cookies and similar technologies to keep the site working, remember your preferences, measure traffic, and — on the marketing site only — support advertising. In the application, we use only the cookies needed to keep you signed in and the service running.

You can control cookies through your browser settings, and you can opt out of interest-based advertising through your device or the relevant provider's settings. We honor recognized opt-out signals, such as Global Privacy Control (GPC), where required by law.

We keep information for as long as needed to provide the service, and longer where the law requires it. Deal records — which dealers are typically required to retain for several years — are kept according to your instructions and applicable recordkeeping rules. When information is no longer needed, we delete or de-identify it. We may retain limited information to meet legal, tax, accounting, or security obligations even after you close your account.

We use industry-standard safeguards to protect the information we hold, including:

• Encryption of data in transit and at rest
• Strict, role-based access on a need-to-know basis
• Optional two-factor authentication for accounts
• Payment data handled by a PCI-DSS-certified processor
• Continuous monitoring and regular security review

No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we work hard to protect your data and to limit who can see it to you and the people you choose.

Depending on where you are, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your information, subject to our legal obligations
• Receive a copy of your information in a portable format
• Opt out of marketing emails and of targeted advertising
• Withdraw consent where processing is based on consent

To exercise any of these rights regarding your own account, email us at legal@dealerdesker.com. We will not discriminate against you for exercising a right. For information about a customer's deal, please contact the dealership that collected it — we will assist them as their service provider.

Residents of California and other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and Texas, among others) have additional rights, including the rights to know, access, correct, delete, and obtain a portable copy of their personal information, and to opt out of its sale or of targeted advertising.

We collect the categories of information described in What we collect from the sources and for the purposes described in this policy. We do not sell personal information for money, and we do not use sensitive information for advertising. To exercise a request or to appeal a decision, email legal@dealerdesker.com; you may use an authorized agent where the law allows.

DealerDesker is operated from the United States and intended for U.S. dealers. If you access it from the European Economic Area or the United Kingdom, you have rights under the GDPR and UK GDPR, including access, correction, erasure, restriction, portability, and the right to lodge a complaint with your supervisory authority. Where we transfer data internationally, we use appropriate safeguards such as Standard Contractual Clauses.

DealerDesker is a business tool intended for licensed dealers and is not directed to children. We do not knowingly collect personal information directly from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Please check back periodically.

If you have any questions about this policy or how we handle information, we're happy to help.