DLRBoost Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to information processed through:

• The DLRBoost website and application.
• Dealer account creation and onboarding.
• Dealer-user and finance-manager accounts.
• CSV, XLSX, CRM, and scheduled report imports.
• Customer offer and product-selection pages.
• Customer odometer and evidence submissions.
• Email, notification, and support workflows.
• Stripe subscription and payment workflows.
• DLRBoost support and business communications.

This Privacy Policy does not independently govern a dealership’s own privacy practices, product contracts, financing practices, websites, systems, or offline activities.

2. Our Privacy Roles

2.1 Information We Process for Dealerships

For customer information that a dealership uploads, imports, or directs DLRBoost to process, the dealership generally determines the purposes and means of processing.

In that context:

• The dealership generally acts as the controller, business, or entity responsible for the customer relationship.
• DLRBoost generally acts as the dealership’s processor or service provider.

2.2 Information We Process for Our Own Business

DLRBoost may act as the business or controller for information used to:

• Create and administer DLRBoost subscriptions.
• Bill dealerships for DLRBoost services.
• Secure and operate the platform.
• Provide customer support.
• Maintain legal, accounting, security, and business records.
• Communicate with dealership contacts about DLRBoost.

3. Information We Collect or Process

4. Sensitive and Financial Information

DLRBoost is not designed to collect Social Security numbers, driver’s-license numbers, bank credentials, health information, or full payment-card information through ordinary customer offer pages.

Dealerships and users should not upload information that is unnecessary for the DLRBoost workflow.

Payment-card information entered through Stripe-hosted checkout is submitted directly to Stripe. DLRBoost may receive transaction identifiers, payment status, amount, and related metadata, but does not intend to receive or store full payment-card numbers.

5. How We Use Information

DLRBoost may use information to:

• Create and administer dealership accounts.
• Authenticate users and maintain login sessions.
• Complete dealer onboarding and configuration.
• Import and organize dealership customer records.
• Match products and exclude previously purchased products.
• Assign customer records to finance managers.
• Create and display dealership-authorized offer pages.
• Send dealership-authorized customer communications.
• Receive product selections and certifications.
• Store and display private odometer evidence.
• Notify dealership personnel of customer activity.
• Create and administer payment links.
• Record payment and contracting workflow status.
• Provide dashboards, logs, analytics, and reporting.
• Administer subscriptions, launch fees, and billing.
• Provide customer support and troubleshoot problems.
• Detect, investigate, prevent, and respond to fraud, abuse, and security incidents.
• Maintain, test, improve, and secure the Services.
• Enforce contracts and protect legal rights.
• Comply with legal, accounting, tax, audit, and regulatory obligations.

6. Sources of Information

We may receive information from:

• Dealership owners, managers, employees, and contractors.
• Dealership CRM or dealer-management reports.
• CSV and XLSX files.
• Scheduled email reports and inbound email services.
• Customers using dealership offer pages.
• Stripe and Stripe Connect.
• SendGrid and other email providers.
• Render, Supabase, and other infrastructure providers.
• Browsers, devices, cookies, logs, and security tools.
• Customer-support and business communications.

7. Dealership Customer Data

As between DLRBoost and the dealership, the dealership retains its rights in Customer Data submitted or imported through the Services.

DLRBoost processes Customer Data to provide the Services under the dealership’s instructions and the applicable Dealer Agreement.

The dealership is responsible for:

• Having the lawful authority to collect, use, disclose, upload, import, and process Customer Data.
• Providing required privacy notices and obtaining required permissions.
• Determining whether a customer may lawfully be contacted about dealership products.
• Maintaining accurate customer, transaction, vehicle, and product information.
• Responding to customer privacy and communication requests.

8. Legal Bases and Processing Grounds

Depending on the context and applicable law, DLRBoost may process information:

• To perform a contract with a dealership.
• To follow the dealership’s documented instructions.
• With consent or authorization where required.
• For legitimate business interests, such as security, support, administration, and service improvement.
• To comply with legal obligations.
• To establish, exercise, or defend legal claims.
• To protect customers, dealerships, DLRBoost, or others from fraud, misuse, or security threats.

9. How We Disclose Information

DLRBoost may disclose information to the following categories of recipients:

9.1 The Applicable Dealership

Customer submissions, offer activity, payment status, odometer evidence, product selections, and workflow information may be disclosed to the dealership and its Authorized Users.

9.2 Service Providers and Subprocessors

DLRBoost may disclose information to vendors that provide hosting, storage, email delivery, payment, security, support, monitoring, analytics, communications, and business-operation services.

9.3 Professional Advisers

Information may be disclosed to attorneys, accountants, auditors, insurers, consultants, and other professional advisers when reasonably necessary.

9.4 Legal and Safety Disclosures

Information may be disclosed when DLRBoost reasonably believes disclosure is necessary to:

• Comply with law, regulation, subpoena, court order, or lawful process.
• Respond to government or regulatory requests.
• Protect the rights, property, security, or safety of DLRBoost, dealerships, customers, or others.
• Investigate fraud, misuse, security incidents, or unlawful activity.
• Enforce agreements and policies.

9.5 Business Transactions

Information may be disclosed in connection with a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, due diligence review, or similar business transaction, subject to appropriate protections.

10. Service Providers

DLRBoost currently uses or may use providers such as:

• Stripe for subscription billing, invoices, connected accounts, payment processing, hosted checkout, payouts, and transaction records.
• SendGrid for customer emails, account emails, password messages, and workflow notifications.
• Supabase for database services, private object storage, and related infrastructure.
• Render for application hosting and infrastructure.
• Google Workspace for business email and administration.
• Vimeo or similar video providers when a dealership embeds product videos.
• Other vendors used for security, monitoring, communications, analytics, support, legal, accounting, insurance, or business operations.

These providers may process information according to their own agreements and privacy policies.

11. Stripe and Payment Information

DLRBoost uses Stripe for DLRBoost subscription payments, launch and setup fees, invoices, billing portal access, and related billing workflows. DLRBoost may also use Stripe Connect for dealership customer payments.

Stripe may collect:

• Payment-card and billing information.
• Bank-account and payout information.
• Business, ownership, tax, and identity-verification information.
• Transaction, refund, dispute, and chargeback information.
• Device, fraud-prevention, and technical information.

DLRBoost may receive payment status, transaction identifiers, Stripe customer identifiers, Stripe subscription identifiers, Stripe connected-account identifiers, subscription status, invoice status, plan information, setup-fee status, amount, and related metadata.

Payment-card information entered through a Stripe-hosted checkout or billing page is provided directly to Stripe. DLRBoost does not intend to receive or store full payment-card numbers.

Dealership customer payments may be routed to a dealership’s connected Stripe account. The applicable dealership remains responsible for product pricing, contracts, refunds, disputes, chargebacks, taxes, product fulfillment, and customer support.

12. Email Communications

DLRBoost may send emails:

• On behalf of a dealership to dealership customers.
• To dealership administrators and finance managers.
• For account setup and password reset.
• For customer submissions and payment notifications.
• For support, billing, security, and administrative matters.

Emails may be sent from a DLRBoost-controlled address with replies directed to the dealership or assigned finance manager.

Dealerships are responsible for determining whether customers may lawfully be contacted and for honoring applicable unsubscribe and opt-out requests.

A customer receiving dealership marketing or promotional emails may request to stop receiving those messages by using the included opt-out method, replying as instructed, or contacting the dealership.

Account, payment, security, contracting, and other transactional messages may continue when necessary to complete a requested transaction or provide the Services.

13. Cookies and Session Technologies

DLRBoost may use cookies and similar technologies to:

• Keep authorized dealership users signed in.
• Authenticate requests.
• Maintain account security.
• Remember necessary platform state.
• Detect misuse or suspicious activity.
• Understand and improve platform operation.

DLRBoost uses an HTTP-only session cookie for authenticated platform access. Disabling necessary cookies may prevent login or other platform features from working.

14. Product Videos and External Content

A dealership may embed a product video hosted by Vimeo, YouTube, or another provider.

When a user loads or interacts with embedded content, the video provider may receive technical information such as the user’s IP address, device information, browser information, and interaction data according to that provider’s own privacy practices.

15. Sale, Targeted Advertising, and Profiling

DLRBoost does not sell personal data for money.

DLRBoost does not sell dealership Customer Data and does not use dealership Customer Data for cross-context behavioral advertising or targeted advertising unrelated to the dealership’s requested services.

DLRBoost does not use dealership Customer Data, subscription metadata, setup-fee metadata, billing metadata, or payment-workflow metadata to build advertising profiles for unrelated third-party advertising.

DLRBoost does not use Customer Data to make decisions that produce legal or similarly significant effects concerning employment, housing, credit, insurance, education, or access to essential services.

DLRBoost may perform product matching, exclusion logic, reporting, and workflow automation under the dealership’s instructions. The dealership remains responsible for final product eligibility, approval, pricing, contracting, and customer-facing decisions.

16. Aggregated and De-Identified Information

DLRBoost may create aggregated or de-identified information that does not reasonably identify a dealership or individual.

DLRBoost may use such information for:

• Security and fraud prevention.
• Service performance and reliability.
• Product improvement.
• Business analytics.
• Operational benchmarking.

DLRBoost will not attempt to re-identify information maintained as de-identified except as permitted by law or reasonably necessary to test de-identification controls.

17. Data Security

DLRBoost maintains reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, acquisition, destruction, use, modification, or disclosure.

Safeguards may include:

• Authentication and role-based access controls.
• HTTP-only and secure session cookies.
• Private storage for odometer evidence.
• Temporary signed URLs for private files.
• Encrypted network communications.
• Upload type and size restrictions.
• Rate limiting and request validation.
• Webhook signature verification.
• Logging and security monitoring.
• Environment-secret management.
• Database, storage, and vendor access controls.
• Incident-response and remediation procedures.

No transmission, storage system, website, or service can be guaranteed to be completely secure. DLRBoost does not guarantee absolute security.

18. Dealer and User Security Responsibilities

Dealerships and their users are responsible for:

• Protecting account credentials.
• Using secure devices and networks.
• Limiting access to authorized personnel.
• Removing access when employees change roles or leave.
• Reviewing imported and displayed information for accuracy.
• Not uploading unnecessary sensitive information.
• Promptly notifying DLRBoost of suspected unauthorized access.

19. Security Incidents

If DLRBoost confirms a security incident involving unauthorized access to dealership Customer Data, DLRBoost will notify the affected dealership without undue delay after obtaining sufficient information to determine that notification is appropriate.

DLRBoost may provide available information concerning:

• The nature of the incident.
• The categories of information involved.
• Containment and remediation measures.
• Information reasonably needed by the dealership.

The dealership is generally responsible for determining whether it must notify affected customers, regulators, law enforcement, product providers, insurers, or other parties.

20. Data Retention

DLRBoost retains information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Provide an active dealership subscription.
• Maintain customer and contracting workflows.
• Provide support and troubleshoot problems.
• Maintain payment, accounting, tax, and audit records.
• Detect and prevent fraud, abuse, or security incidents.
• Resolve disputes and enforce agreements.
• Comply with legal and regulatory obligations.

Retention periods may vary depending on:

• The type and sensitivity of information.
• The dealership’s instructions.
• The status of the account or transaction.
• Security and fraud-prevention needs.
• Applicable legal, contractual, tax, or accounting requirements.

21. Specific Retention Practices

Subject to configuration, operational needs, and applicable law:

• Dealership account information may be retained while the account is active and for a reasonable period afterward.
• Customer records may be retained while needed for dealership workflows and offboarding.
• Odometer evidence may be retained while the associated customer record or contracting workflow remains active.
• Import logs may be retained for troubleshooting, security, audit, and operational purposes.
• Billing and transaction records may be retained to satisfy accounting, tax, fraud, dispute, and legal obligations.
• Session and password-reset records may be deleted after expiration or use.
• Security and webhook records may be retained for a reasonable security and audit period.
• Residual information may remain temporarily in backups until replaced through normal backup cycles.

22. Data Export and Deletion

During an active subscription, a dealership may request a reasonable export of available dealership Customer Data, subject to technical limitations.

Following termination, DLRBoost may:

• Disable the dealership’s access.
• Provide a reasonable opportunity to request an export.
• Delete active Customer Data after a reasonable offboarding period.
• Retain legally or operationally necessary records.
• Allow residual backup copies to expire through normal backup cycles.

Deletion requests may be denied, delayed, or limited when retention is reasonably necessary to:

• Complete a transaction requested by the individual.
• Provide the Services during an active subscription.
• Protect security or prevent fraud.
• Maintain payment, tax, accounting, audit, or dispute records.
• Handle refunds, chargebacks, payment disputes, or unpaid amounts.
• Comply with law or legal process.
• Establish, exercise, or defend legal claims.
• Honor a lawful dealership instruction.

23. Privacy Rights

Depending on applicable law and the circumstances, an individual may have rights to:

• Confirm whether personal information is processed.
• Access personal information.
• Correct inaccurate personal information.
• Request deletion of personal information.
• Receive certain information in a portable format.
• Opt out of certain sales, targeted advertising, or profiling.
• Appeal a denied privacy request where applicable.
• Not receive unlawful discriminatory treatment for exercising privacy rights.

These rights are subject to legal exceptions, verification requirements, and whether the applicable privacy law covers the individual, dealership, data, or processing activity.

24. Requests Concerning Dealership Customer Data

If DLRBoost processes information solely for a dealership, the dealership is generally responsible for responding to the individual’s request.

An individual should contact the dealership from which the offer, email, vehicle transaction, or product workflow originated.

When DLRBoost receives a request involving dealership Customer Data, DLRBoost may:

• Direct the individual to the dealership.
• Forward the request to the dealership.
• Assist the dealership in responding.
• Request additional information necessary to locate the record.

25. Requests Concerning DLRBoost Account Data

Dealership representatives may submit a request concerning information DLRBoost controls by emailing:

support@dlrboost.com

The request should include:

• The requester’s name.
• Work email address.
• Dealership name.
• The nature of the request.
• Enough information to locate the relevant account.

26. Verification of Requests

DLRBoost or the applicable dealership may need to verify a requester’s identity and authority before fulfilling a privacy request.

Verification may involve confirming:

• Email ownership.
• Dealership affiliation.
• Account information.
• Vehicle or transaction information.
• Authority to act for another individual or business.

DLRBoost will not request more information than reasonably necessary to verify and respond to the request.

27. Appeals

Where applicable law provides a right to appeal a denied privacy request, the requester may submit an appeal to:

support@dlrboost.com

The subject line should state: Privacy Request Appeal.

28. Authorized Agents

Where permitted by law, an authorized agent may submit a request on an individual’s behalf.

DLRBoost or the dealership may require proof of the agent’s authority and may separately verify the individual’s identity.

29. Children’s Privacy

DLRBoost is intended for dealerships, dealership personnel, and adult vehicle customers.

DLRBoost is not directed to children under 13 and does not knowingly collect personal information directly from children under 13.

If you believe a child has submitted information through DLRBoost, contact: support@dlrboost.com .

30. United States Operations

DLRBoost is operated from the United States. Information may be processed and stored in the United States and other locations where DLRBoost’s service providers operate.

DLRBoost is not currently intended to provide services to dealerships or consumers outside the United States unless expressly agreed in writing.

31. Do Not Track Signals

Some browsers provide “Do Not Track” signals. Because there is not a universally accepted standard governing these signals, DLRBoost does not currently respond to browser Do Not Track signals.

DLRBoost does not use dealership Customer Data for cross-context behavioral advertising.

32. Links to Third-Party Services

The Services may contain links to Stripe checkout, dealership websites, product providers, video providers, DocuSign, or other third-party services.

DLRBoost does not control the privacy or security practices of third-party services. Users should review the applicable third party’s privacy policy and terms.

33. Changes to This Privacy Policy

DLRBoost may update this Privacy Policy to reflect changes in law, technology, vendors, security, business practices, or the Services.

The updated policy will be posted with a revised effective date.

When changes are material, DLRBoost may provide additional notice through email, the Services, or another reasonable method.

34. Contact DLRBoost