Privacy Policy

3.1 Data We Collect Directly from You as a Controller

We collect Personal Information that you voluntarily provide when you use CarEdge websites, applications or Services in our capacity as a Controller, including when you:

• Create an account, subscribe to Services or otherwise register to use CarEdge tools
• Request vehicle information, pricing insights, negotiation support, concierge services or other assistance, or communicate with a Customer to request such from them using CarEdge Services
• Request information, download materials or communicate with us or via our forums and platforms
• Submit inquiries, request quotes or ask to be connected with dealers, lenders or other partners
• Provide vehicle preferences, purchase criteria or other inputs through forms, tools, questionnaires or free-form submissions
• Set up business accounts as or on behalf of dealer groups, OEMs and related industry partners to use CarEdge dealer or OEM or industry facing products and services
• Send communications to our support or product teams
• Engage with any online chat, SMS or support features
• Submit a job application to us
• Affirmatively communicate with us in any other way

We also collect information about your interactions with CarEdge Services, including content you submit, communications you initiate and actions you take within our platforms.

We use this information in our capacity as a Controller to:

• Provide, operate and improve CarEdge Services, including vehicle research, pricing, negotiation and concierge offerings
• Respond to requests, support the services we offer and provide customer support
• Facilitate connections with dealers, lenders or partners in connection with your request or interaction with CarEdge Services
• Communicate about updates, transactions, services and promotional opportunities
• Manage business relationships
• Analyze usage, personalize user experiences and enhance platform performance
• Enhance algorithmic performance
• Enhance proprietary datasets

3.1.2 AI Chat and CoPilot Features

Additionally, CarEdge may provide AI-enabled conversational features, including CoPilot and related chat-based tools, designed to help Consumers research vehicles, identify vehicle availability, obtain pricing insights, evaluate options and facilitate use of CarEdge products and services such as CarEdge Pro, Concierge and related offerings.

When you use CoPilot or similar conversational features, CarEdge may collect and process:

• Chat prompts and messages you submit
• Vehicle preferences and shopping criteria
• Information regarding your interactions with recommendations generated through the feature
• Technical and interaction information associated with use of the feature

Because these features accept free-form natural language inputs, you may submit information beyond what CarEdge requests. CarEdge requests that you do not submit Sensitive Personal Information through CoPilot or other conversational tools, including Social Security numbers, bank account information, payment credentials, government-issued identifiers or similar information not necessary to provide the requested services.

Where technically feasible, CarEdge maintains controls intended to identify and reduce the retention of certain categories of potentially sensitive information submitted through these tools. Such controls may include automated suppression, deletion, hashing or similar measures designed to minimize retention and use of information not required to provide the requested services. CarEdge does not intentionally request Social Security numbers, bank account information, payment credentials or similar Sensitive Personal Information through CoPilot or other conversational features. Note that no automated system can guarantee complete detection of all information submitted through a conversational interface.

Consumers may also delete chat sessions or request deletion of Personal Information as described in Section 6, subject to applicable legal exceptions and operational requirements.

CarEdge acts as a Controller for information submitted directly through CoPilot and similar conversational features.

3.2 Data We Collect Indirectly from You as a Controller

We collect certain information automatically when you visit CarEdge websites or interact with CarEdge-managed pages, applications, tools or online services. This includes interactions with CarEdge content, digital experiences and click-through activity to third-party websites or partners. This Section 3.2 outlines the information that we collect indirectly from you as a Controller.

3.2.1 Cookies and Similar Technologies

As a Controller, we use cookies, pixels, tags and similar technologies to understand how our websites, applications, tools and digital campaigns perform. These technologies may be deployed on CarEdge Services and, in certain cases, in connection with advertising or referral activities involving third-party partners.

These technologies help us measure traffic, personalize experiences, facilitate referrals and click-through activity, and improve our Services, content and marketing effectiveness, including supporting the development and performance of automated tools and AI-enabled features using Aggregated or De-identified Data.

3.2.2 Interaction Data

When you interact with CarEdge websites, CarEdge-owned or managed social channels, CarEdge-managed landing pages, applications, tools, communications or digital advertisements, we may collect certain Interaction Data, such as:

• Page views and browsing paths;
• Clicks on ads, links or navigational elements, including clicks that direct you to third-party websites or partners;
• Referral sources showing how you arrived at our site;
• Time spent on site, scroll behavior, dwell time and engagement patterns;
• Device type, browser information and IP address; and,
• Hashed identifiers used for analytics or attribution.

We use this information to understand how visitors use our pages, measure performance, analyze referral and engagement activity, and improve the relevance and effectiveness of our content and Services. For this data, CarEdge acts as a Controller.

3.2.3 Log and Device Data

Log and device data is technical information automatically generated when you access CarEdge websites or Services, such as IP address, browser type, device identifiers, operating system details, error logs, performance metrics and similar system-level information.

We use this information to maintain security, troubleshoot issues, monitor system performance, and improve reliability. CarEdge collects only approximate location information based on IP address to support fraud detection, security, analytics and performance measurement. We do not collect or use precise geolocation in our capacity as a Controller. Any collection of precise geolocation occurs only where CarEdge acts as a Service Provider at the direction of a Customer and as permitted under applicable law.

3.3 Data We Collect Through Customer-Authorized Integrations as a Service Provider

CarEdge processes Customer Data that is provided directly by Customers or collected on their behalf through authorized integrations as a Service Provider. This may include inventory feeds, CRM Data, DMS Data, DMP segments, Interaction Data, sales and attribution records and data supplied through Customer-approved third-party integrations.

In this role, CarEdge uses Customer Data to operate and support the services contracted by each Customer. CarEdge may also generate Aggregated or De-identified Data derived from Customer Data and Customer-authorized measurement signals. These non-identifiable outputs may be used solely in Aggregated or De-identified form to maintain and improve CarEdge’s proprietary datasets, analytics models and platform features, which may include market insights, market-level performance insights and dealer ratings or rankings derived from Aggregated or De-identified Data, ranking methodologies and pricing intelligence (including estimated out-the-door pricing), and do not identify any individual consumer or Customer.

For clarity, pricing, offer or transaction-related information obtained through Consumer interactions with dealers using CarEdge Services is not considered Customer Data, CRM Data or DMS Data, and is not sourced from Customer systems, but is instead treated as Consumer Transaction Data collected through Consumer-directed interactions.

This Section 3.3 provides further detail about specific processing activities—including CRM enrichment, machine-learning uses, Interaction Data collection and the handling of third-party data.

3.3.1 Use of CRM Enrichment Data

CarEdge may perform limited validation of Consumer-provided information to support data accuracy and attribution. This may include appending missing data, correcting inaccurate information or determining whether a Consumer transaction has occurred (such as a vehicle purchase) for attribution purposes. CarEdge may use third-party data sources and limited identifiers to support these activities, subject to contractual and technical safeguards. CarEdge does not disclose enriched Consumer data for third-party independent use and does not use such data to build cross-Customer consumer profiles.

3.3.2 AI and Machine-Learning Use

CarEdge uses machine learning to improve recommendations and platform performance. CarEdge uses only Aggregated or De-identified Data and Customer-authorized AI Inputs to train and improve machine-learning systems. These models help generate recommendations about marketing performance, inventory demand, audience targeting, ad spend, dealer performance insights and pricing accuracy, and to support the development and improvement of consumer-facing features, including pricing tools, negotiation support, vehicle insights and related Services.

CarEdge may use CoPilot Interaction Data to improve conversational experiences and model performance only after application of processes designed to anonymize, aggregate, de-identify, suppress or remove information reasonably believed to contain directly identifiable information. CarEdge does not intentionally use identifiable Social Security numbers, bank account information, payment credentials or similar sensitive information to train machine-learning systems.

Only after such data has been Aggregated or De-identified such that it cannot reasonably identify a Consumer or Customer may CarEdge use that non-identifiable information to inform model accuracy, benchmarking, ranking, pricing insights or overall platform performance, including enhancing the accuracy, relevance and effectiveness of consumer-facing products and Services, in which case CarEdge acts as a Controller of that Aggregated or De-identified Data, consistent with Sections 4.2 and 4.3.

3.3.3 Interaction Data Collected Through Customer Websites

If and when a Customer installs Tags or Pixels, including CarEdge-issued Google tags, on their website, CarEdge may collect Interaction Data under that Customer’s instructions. This Interaction Data may include:

• Page views and browsing paths
• Clicks on inventory units, ads or referral links
• VIN-level activity and vehicle detail page interactions
• Scroll behavior, dwell time and engagement patterns on inventory units, ads or Customer websites
• Device type, browser information and IP address
• Hashed identifiers used for analytics or attribution

When Tags or Pixels are installed on a Customer’s website, we collect behavioral data such as pages viewed, referral paths and VIN-level engagement to measure performance and support the Customer’s marketing activities. We do not use this data to build cross-Customer consumer profiles or to track individuals across unrelated websites for CarEdge’s own independent marketing purposes. Rather, we use this Interaction Data to measure performance, improve relevance, understand shopper behavior and support features to the benefit of an individual Customer under contract. In this context, CarEdge acts solely as a Service Provider and does not use this data to identify individuals across Customers.

Interaction Data from Customer websites may also contribute to Aggregated or De-identified Data used to strengthen CarEdge’s proprietary datasets, analytics models and platform performance, consistent with Section 4.2, and subject to safeguards preventing re-identification.

3.4 Data We Receive from Third Parties

This Section 3.4 outlines how we use data received from third parties. We may receive information about vehicles, audiences, transactions or campaign performance from authorized third-party sources. These sources may include:

• Identity and data enrichment partners that help match or supplement Consumer Data to better support matching and fulfillment of Consumer-initiated requests within CarEdge Services or under Customer instructions
• Analytics or measurement providers that support campaign reporting and attribution
• OEM program partners that supply inventory, performance or attribution data
• Marketplace or inventory platforms that provide vehicle data or activity signals
• Ad networks or media partners that deliver impression, click or placement information
• Retail delivery record (RDR) data providers, OEMs or affiliated partners that provide transaction-level or aggregated sales outcome data used to measure close rates, lead performance and referral quality
• Automotive data providers (such as DataOne, J.D. Power or similar partners) that provide vehicle specifications, pricing data, configuration details and market insights
• Affiliate and marketplace partners that provide data necessary to deliver consumer-requested services, such as insurance quotes, financing options or instant cash offers for vehicle trade-ins or sales

We use this information to:

• Improve the accuracy of lead/referral performance measurement in accordance as a Service Provider
• Enhance reporting, campaign measurement and close rate analysis
• Provide and enhance consumer-facing Services, including vehicle pricing, specifications, valuation tools, insurance quote experiences and instant cash offer functionality
• Contribute to Aggregated or De-identified Data that strengthens our proprietary datasets, analytics models, pricing intelligence and platform performance

Any information we receive from third parties is used only in the manner allowed by our agreements with each Customer or as permitted under our agreements with such third-party data providers and applicable law. When the information includes Personal Information supplied by or on behalf of a Customer, CarEdge processes it as a Service Provider.

When information is received directly from third-party providers and is used to support CarEdge’s consumer-facing products, analytics, pricing insights or marketplace features, CarEdge may act as a Controller with respect to such data where it determines the purposes and means of processing, subject to applicable law and contractual obligations.

3.5 How We Use the Data We Collect

This Section 3.5 provides additional detail about how we use the information collected across our products and services.

3.5.1 To Provide and Improve CarEdge Products and Services

We use Personal Information provided by Consumers, Customer Data, Interaction Data and Aggregated or De-identified Data to deliver and improve our products and Services. This includes using information to:

• Provide consumer-facing tools and Services, including vehicle research, pricing insights, negotiation support, concierge services, insurance quotes, instant cash offers and other marketplace features
• Run campaigns and deliver VIN-level advertising recommendations
• Optimize performance using behavioral signals collected through CarEdge Services or, where applicable, Customer-authorized integrations
• Provide reporting, attribution and inventory insights
• Generate pricing intelligence, dealer performance insights, ranking methodologies and close rate analytics
• Generate dealer ratings, rankings and transparency indicators, including Dealer Transparency Index scores and similar marketplace transparency tools, using only Aggregated or De-identified Data
• Maintain, secure and improve our websites, tools and platform features
• Detect, prevent and investigate fraud or misuse

Additionally, CarEdge may also use Consumer Transaction Data and Mystery Shop Interaction Data, after transformation into Aggregated or De-identified Data, to generate marketplace insights, pricing intelligence, dealer ratings, rankings, Dealer Transparency Index scores and other transparency products intended to improve Consumer decision-making and marketplace transparency.

When processing Customer Data or Interaction Data collected through Customer-authorized integrations, CarEdge acts as a Service Provider.

CarEdge may use Consumer Transaction Data solely after such information has been transformed into Aggregated or De-identified Data. CarEdge does not use transaction-level pricing, offer or purchase information in identifiable form for model training, dataset development or analytics. Such transformation includes removing or abstracting direct and indirect identifiers, including combinations of data elements that could reasonably be used to identify a Consumer or a specific transaction.

CarEdge may use Consumer Transaction Data to develop aggregated insights, including dealer-level ratings, rankings or performance indicators. Such insights are derived only from Aggregated or De-identified Data and are designed to reflect general patterns or trends rather than any single transaction.

When using Aggregated or De-identified Data to improve the quality, accuracy or performance of our products, including consumer-facing features and marketplace functionality, CarEdge acts as a Controller of that non-identifiable information.

CarEdge does not use transaction-level information obtained from a specific Consumer to influence outcomes for that Consumer or to make individualized decisions about that Consumer beyond the scope of the requested services.

Dealer Transparency Index scores, dealer ratings and similar marketplace indicators are derived from Aggregated or De-identified information reflecting patterns across multiple Consumer interactions and are not intended to disclose or reproduce any individual Consumer transaction, dealer quote or Customer proprietary business practice.

3.5.2 To Process Customer Data Under Instructions

CarEdge processes Customer Data — including CRM, DMS Data, DMP, attribution and sales records — as a Service Provider and only as permitted under the Customer’s written agreement and documented instructions. We use this information to:

• Activate and manage campaigns
• Support inventory distribution and syndication
• Measure performance, attribution and lead/referral quality, including close rate analysis
• Generate Customer-specific reporting and insights
• Provide customer support and operational services

With the Customer’s permission, CarEdge may use Tags or Pixels on the Customer’s website to collect Interaction Data, support Customer-authorized enrichments of CRM Data and/or help run and measure the Customer’s marketing and advertising efforts.

CarEdge honors each consent, opt-out or preference signals supplied or collected by the Customer, and processes these signals solely as instructed.

For all such activity, CarEdge acts only as a Service Provider, does not determine independent purposes for the data and does not use Customer Data to identify individuals across Customers or for any purpose outside the Customer’s agreement.

3.5.3 To Support CRM Enrichment and Authorized Data Enhancements

CarEdge may perform CRM enrichment either (i) as a Service Provider under Customer instructions, as described in Section 4.1.5, or (ii) in limited circumstances as a Controller to support data quality, attribution, analytics or platform performance. We use this information to:

• Improve the accuracy or completeness of Customer CRM records
• Support attribution, follow-up actions and lead management
• Reintegrate enhanced records into the Customer’s CRM system

CarEdge processes CRM Data and CRM Enrichment Data solely under the Customer’s instructions. We do not use CRM Data to support any cross-Customer insights, marketing or profiling.

3.5.4 To Train and Improve Machine-Learning Models

CarEdge uses Aggregated or De-identified Data, as well as Customer-authorized AI Inputs, to train and improve machine-learning systems. These models help:

• Provide inventory, audience and marketing recommendations
• Support campaign optimization
• Generate performance insights
• Improve the accuracy and relevance of platform features
• Enhance consumer-facing products and Services, including pricing tools, negotiation support, dealer insights and marketplace experiences

CarEdge may use these models to generate predictive insights, including recommended inventory units, buyer–vehicle matching signals and campaign strategies likely to align with a shopper’s demonstrated interests, as well as pricing estimates, dealer rankings or performance indicators presented to Consumers. These automated outputs are designed to support decision-making and do not replace human judgment.

CarEdge maintains internal governance practices to ensure its models operate as intended, are tested for accuracy and are not used in ways that conflict with Customer agreements or applicable law. Customers may then use these model outputs to tailor which inventory units, marketing messages or campaign strategies are presented to particular shoppers or audience segments, consistent with the Customer’s authorized use of CarEdge products and applicable privacy requirements.

CarEdge does not attempt to re-identify Aggregated or De-identified Data.

When using Aggregated or De-identified Data that cannot identify a Consumer or Customer, CarEdge acts as a Controller of that non-identifiable data.

3.5.5 To Support Security, Compliance and Safety

We use certain information to protect the integrity of our platform, maintain compliance and ensure the security of Customer Data. This includes:

• Detecting, preventing and investigating fraud, misuse or unauthorized access
• Maintaining system reliability and performance
• Monitoring for security threats or vulnerabilities
• Meeting legal, regulatory or audit requirements

When this information includes Customer Data or Interaction Data collected through Customer-authorized integrations, CarEdge processes it as a Service Provider.

When we use system-level logs or aggregated security data that cannot identify a consumer or Customer, CarEdge acts as a Controller of that non-identifiable information.

3.5.6 To Communicate With You

We may use contact information you provide directly to CarEdge to:

• Respond to questions and support requests
• Send updates about platform features, transactions or changes
• Communicate in connection with your requests for information, quotes, referrals, negotiation or concierge services
• Share information about events, resources or product news

You may opt out of non-essential communications at any time.

For all direct communications, CarEdge acts as a Controller of the information you provide.

3.5.7 How We Do Not Use Data

To provide additional clarity and transparency, we also explain how we do not use information:

• We do not sell or share CRM Data or Customer Data other than as directed by a Consumer when we are acting as a Service Provider or as otherwise permitted under applicable law
• We do not use identifiable Customer Data to build cross-Customer profiles or benchmarks
• We do not use Customer Data or Interaction Data collected through Customer-authorized integrations for CarEdge marketing while acting as a Service Provider. Where CarEdge has obtained contractual rights to use such data for independent purposes, CarEdge will do so only in its capacity as a Controller and in accordance with this Privacy Policy and applicable law
• We do not use identifiable Customer Data to improve consumer-facing products or Services except where such data has been Aggregated or De-identified
• We do not use precise geolocation unless we are acting as a Service Provider
• We do not use data in ways that conflict with applicable Customer agreements
• We do not attempt to re-identify Aggregated or De-identified Data

These commitments help ensure that CarEdge processes information responsibly, maintains Customer trust and remains aligned with applicable privacy laws.

3.5.8 SMS and Text Messaging Communications

CarEdge may communicate with you via text message (SMS or MMS) in connection with your use of CarEdge Services, including responding to inquiries, providing concierge or negotiation support, sending transaction-related updates or facilitating communications with dealers or other partners in connection with your request or interaction with CarEdge Services.

By providing your mobile phone number and opting in, you consent to receive text messages from CarEdge and, where applicable, from dealers, OEMs or other partners in connection with your request. Such messages may be sent using automated technology, where permitted by law, and may include informational, transactional or, where you have consented, promotional content. Message frequency may vary depending on your interactions with CarEdge Services. Message and data rates may apply.

You may opt out of receiving text messages from CarEdge at any time by replying “STOP” to any message or by contacting us as described in Section 12. For assistance, reply “HELP” or contact us at [email protected].

CarEdge does not charge for text messaging services; however, your mobile carrier’s standard messaging and data rates may apply.

Third-party partners that communicate with you directly are responsible for their own messaging practices and must obtain any required consents in accordance with applicable law.

You may revoke consent to receive communications at any time using the methods described above or by contacting us.

3.6 Processing by Partners Acting Under Customer Instructions

CarEdge may engage certain third-party partners to support services such as enrichment, identity resolution or technology integrations requested or authorized by a Customer. These activities occur solely under the Customer’s written agreement and documented instructions, and CarEdge does not determine independent purposes for this processing.

All such partners act as service providers or Sub-Processors, and are bound by written agreements that:

• Limit their use of data to the specific services requested by the Customer
• Prohibit re-identification or combining CarEdge-processed data with unrelated datasets or any attempt to reverse aggregation or de-identification
• Restrict any secondary use, sale or sharing of the information
• Require appropriate security, confidentiality and compliance safeguards in accordance with applicable laws

CarEdge exercises reasonable oversight to ensure that Sub-Processors process information only as permitted under their agreements and the applicable Customer instructions, and maintain safeguards consistent with applicable privacy laws.

In addition, when CarEdge shares Personal Information with third parties at the direction of a Consumer or Customer—such as dealers, lenders, insurance providers, warranty providers or other partners in connection with a request, referral or click-through interaction—those third parties may use such information in accordance with their own privacy policies and applicable law. In these circumstances, CarEdge does not control and is not responsible for the independent use of Personal Information by such third parties after it has been disclosed.

CarEdge may also share limited information with third-party partners that support consumer-facing features (such as insurance quotes, financing options or instant cash offers). These partners may use the information solely to provide the requested service, respond to the Consumer’s inquiry or complete a transaction, and are contractually restricted from using the information for unrelated purposes where required by applicable law.

In certain cases, CarEdge may receive compensation or other consideration in connection with facilitating referrals, introductions or consumer-requested services. Such activities are conducted pursuant to contractual arrangements, at the direction of the Consumer or Customer where applicable, and consistent with the purposes disclosed in this Privacy Policy and applicable law.

4.1 Disclosures When CarEdge Acts as a Controller

CarEdge acts as a Controller only for information we collect directly through CarEdge-owned websites and Services, such as website usage data, Consumer interactions, requests for information, referrals, click-through activity, communications, job applications and platform security data. We may disclose this information to support the functions described below.

4.1.1 Sub-Processors Supporting CarEdge Operations

We may disclose information to sub-processors who are under contract with CarEdge to perform operations including website hosting, analytics, security, customer support, HR systems and cloud infrastructure. These partners are contractually restricted from using the information for their own purposes.

4.1.2 Marketing, Analytics and Measurement Partners

We may disclose Controller-collected data (such as website analytics, Interaction Data or campaign performance signals) to partners that help us:

• Analyze site performance
• Understand marketing effectiveness
• Improve user experience
• Deliver, measure or optimize advertising and referral activity or dealer performance

4.1.3 Legal, Compliance and Security Disclosures

CarEdge may disclose Personal Information in its capacity as a Controller where necessary to comply with legal, regulatory or security obligations. These disclosures are limited to circumstances where CarEdge has a good-faith belief that such action is required or appropriate under applicable law or to protect the integrity of CarEdge Services.

This may include disclosures:

• To comply with applicable laws, regulations, legal process or enforceable governmental requests (such as subpoenas, court orders or regulatory inquiries)
• To establish, exercise or defend legal claims or rights
• To investigate, prevent or take action regarding suspected fraud, misuse, unauthorized access or other illegal activity
• To protect the rights, property or safety of CarEdge, Consumers, Customers or the public
• To enforce CarEdge’s Terms of Use, contractual rights or other applicable agreements
• In connection with corporate transactions, such as a merger, acquisition, financing, reorganization or sale of assets, where Personal Information may be disclosed as part of due diligence or transferred as part of the transaction, subject to appropriate safeguards

CarEdge may also disclose Personal Information to service providers and advisors (such as legal counsel, auditors, security vendors or compliance consultants) that support these activities, provided that such parties are contractually required to maintain the confidentiality and security of the information and to use it only for the purposes described above.

4.1.4 Consumer Requests, Disclosures and Communications

In connection with your use of CarEdge Pro, CarEdge Concierge or other consumer-facing services, CarEdge collects and uses the information that you provide as a Controller to deliver, manage and improve those services. These services are designed to help you research, identify, evaluate and purchase a vehicle with greater transparency and confidence, including understanding your preferences, providing recommendations, supporting negotiation and coordinating transaction-related activities on your behalf. Additionally, CarEdge may collect information through Consumer interactions and mystery shopping activities, including AI-enabled or technology-assisted interactions designed to simulate Consumer requests for pricing or purchasing information. Information obtained through these activities may be used to support pricing transparency, marketplace insights, dealer ratings and similar Consumer-facing tools.

In providing these services, CarEdge may use your information to engage with dealers and other automotive partners, including to obtain pricing, availability or other transaction-related details. CarEdge may also use pricing, offer and transaction-related information received through these interactions in Aggregated or De-identified form to improve its pricing intelligence, analytics and proprietary datasets. CarEdge may disclose, upon receipt of your express consent, your Personal Information to dealers, lenders, insurance providers, warranty providers, shipping brokers, transporters or other partners where necessary to fulfill your request or support or fulfill a transaction. These parties act as independent businesses and may use the information in accordance with their own privacy policies and applicable law. CarEdge does not control, and is not responsible for, their independent use of Personal Information after disclosure.

4.1.5 Limited Data Enrichment

In limited circumstances, CarEdge may perform data enrichment, validation or attribution activities in its capacity as a Controller to support the accuracy, quality and performance of CarEdge Services.

These activities may include:

• Verifying or correcting contact information (such as email addresses, phone numbers or mailing addresses)
• Appending missing or incomplete attributes (such as ZIP code or geographic data)
• Matching or linking records to support attribution, measurement or performance analytics

To support these activities, CarEdge may disclose limited Personal Information to third-party service providers or Sub-Processors that perform enrichment, identity resolution or attribution services on CarEdge’s behalf. These parties are contractually restricted to using such information solely to provide services to CarEdge and are prohibited from using the information for their own independent purposes.

Enriched or validated data may be used by CarEdge to support its Services, analytics and platform functionality, and may be provided to the applicable Customer in connection with the Services. CarEdge does not disclose such enriched data to other Customers or third parties for their independent use.

CarEdge may also use Aggregated or De-identified Data derived from these activities to improve data quality, measurement accuracy, pricing insights, benchmarking and overall platform performance, subject to safeguards designed to prevent re-identification.

4.2 Disclosures When CarEdge Acts as a Service Provider / Processor

This Section 4.2 describes how CarEdge discloses data as a Service Provider. CarEdge acts as a Service Provider or Processor when handling Customer Data, CRM Data, DMS Data, Interaction Data or CRM Enrichment Data under the Customer’s instructions. In these cases, the Customer—not CarEdge—determines the purposes of processing. This section applies only when a Customer directs CarEdge, through a valid agreement and documented instruction, to process or disclose data on its behalf.

4.2.5 Consumer Requests, Disclosures and Communications

When you request information, quotes, offers or assistance through CarEdge Services, or when you click through to or engage with a third-party partner, CarEdge may disclose your Personal Information to dealers, lenders, insurance providers, warranty providers or other partners to facilitate your request or transaction. The receiving parties act as independent businesses and may use the information in accordance with their own privacy policies. CarEdge does not control, and is not responsible for, the independent use of Personal Information by such third parties after it has been disclosed.

In most cases, CarEdge receives compensation or other consideration in connection with facilitating such referrals, introductions, clicks to third-party sites or consumer-requested services.

4.2.6 No Independent Use

When CarEdge acts as a Service Provider, CarEdge does not sell or share Customer Data, use Customer Data for CarEdge marketing, build cross-Customer consumer profiles, use Customer Data for any purpose not authorized by the Customer, disclose precise geolocation without written Customer authorization, or allow re-identification of de-identified data.

6.1.1 Right to Access

You may request access to the Personal Information CarEdge processes as a Controller, including the categories and specific pieces of Personal Information, subject to verification and applicable legal limitations.

6.1.2 Right to Deletion

You may request deletion of Personal Information CarEdge processes as a Controller, subject to legal exceptions, including where retention is required to complete transactions, comply with legal obligations, detect security incidents or otherwise permitted under applicable law.

6.1.3 Right to Correction

You may request correction of inaccurate Personal Information CarEdge maintains as a Controller, taking into account the nature of the Personal Information and the purposes of processing.

6.1.4 Right to Data Portability

You may request a portable copy of certain Personal Information CarEdge processes as a Controller, in a structured, commonly used and reasonably accessible format, to the extent required by applicable law. This right does not apply to Aggregated or De-identified Data.

6.1.5 Right to Opt Out of Certain Processing

You may request that CarEdge not use Controller-collected information for targeted advertising, profiling in furtherance of decisions that produce legal or similarly significant effects (where applicable), or sales or “sharing” as defined by applicable law.

Where CarEdge engages in activities that may constitute “sale” or “sharing” of Personal Information under applicable law (such as certain advertising or referral-related activities), you may exercise your right to opt out as described in this Section.

6.1.6 Right to Limit Use of Sensitive Personal Information

If applicable, you may limit the use of Sensitive Personal Information, subject to applicable legal exceptions and permitted uses. CarEdge does not use Sensitive Personal Information for purposes beyond what is reasonably necessary to provide requested Services, prevent fraud, ensure security or otherwise as permitted by applicable law.

6.2 How to Submit a Privacy Request

You may submit a privacy request by emailing us at [email protected] or by using our online request form at CarEdge.com/privacy-request.

To protect your information, we will verify your identity before completing a request. Verification may include confirming your email address, requesting additional details or matching limited information against what we maintain. We will respond within the timeframes required by applicable privacy laws.

6.3 Requests That Must Be Directed to a Customer or Third-Party Partner

If your information was collected by a dealer, OEM, third party or agency for whom CarEdge acts as a Service Provider—including CRM entries, lead or customer records, Customer Data or Interaction Data processed under Customer instructions—then your rights are governed by that Customer’s privacy policy, and the request must be submitted directly to the Customer.

6.4 De-Identified and Aggregated Data

The rights described in this section do not apply to Aggregated or De-identified Data, aggregated analytics, insights or model outputs derived from Personal Information, or data that cannot reasonably be linked to an identifiable Consumer or household.

6.5 Appeals Process

If your request is denied, you may submit an appeal using the instructions included in our response. CarEdge will review the appeal and respond within the timeframes required by applicable law.

6.6 Authorized Agents

Where permitted by law, you may designate an authorized agent to submit certain requests on your behalf. CarEdge may require verification of both your identity and the agent’s authorization before fulfilling such requests.

8.1 Governance and Risk Management

CarEdge maintains internal policies and procedures that govern how data is accessed, stored, processed and retained, including controls for vendor management, access management, change management, risk assessment and incident response.

8.2 Security Safeguards

CarEdge uses a combination of administrative, technical and physical safeguards appropriate to the nature and sensitivity of the information processed. These include encryption during transmission, access controls based on business need, monitoring for unauthorized activity and secure hosting environments managed by reputable cloud providers. We review and test our systems on a regular basis to help protect information.

8.3 Oversight of Sub-Processors

Partners who process information on CarEdge’s behalf must agree to contractual restrictions requiring them to use information only as instructed, maintain appropriate safeguards and prohibit re-identification or secondary use. CarEdge maintains reasonable oversight of these partners.

8.4 Product and Feature Review

New or materially updated features—including product or service updates, machine-learning engines, CRM Enrichment capabilities, or any feature involving new data flows—undergo documented data-protection and privacy reviews prior to launch.

8.5 Access and Accountability

Access to Personal Information is limited to personnel with a legitimate business need. CarEdge provides internal training on data protection requirements and maintains processes to oversee compliance with its policies and obligations.

8.6 Third Party Systems and Data Sources

CarEdge Services may rely on third-party platforms, data providers and infrastructure. While CarEdge imposes contractual safeguards where appropriate, CarEdge does not control the independent systems or data practices of third parties, and such information is subject to their applicable terms, privacy policies and controls.

9.1 Tracking on CarEdge Websites

When you visit a CarEdge-owned website, we may use cookies and similar tools to maintain site functionality, understand how visitors use our pages, measure traffic and performance, improve the relevance and effectiveness of our content, and analyze referral sources and click-through activity to third-party partners. CarEdge acts as a Controller for these tracking tools.

You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of the site.

9.2 Tracking on Customer Websites Through Customer-Authorized Tags

Customers may authorize CarEdge to deploy, manage or support the installation of Tags or Pixels on their own websites. When this occurs, CarEdge may collect Interaction Data described in Section 3.3 under the Customer’s documented instructions. When Tags or Pixels are used on a Customer’s website, the Customer must disclose this in its own privacy notice or cookie banner. In this context, CarEdge acts solely as a Service Provider.

9.3 Third-Party Cookies and Integrations

CarEdge websites and Customer-authorized integrations may use third-party technologies such as analytics providers, media platforms and content delivery partners. Their collection and use of data are governed by their respective privacy policies. For Google specifically, you may learn more at google.com/policies/privacy/partners/ and manage preferences at adssettings.google.com.

9.4 Choices and Controls

You may manage cookies and tracking technologies through your browser settings, platform-specific opt-outs (Google, Meta, Amazon Ads and others), or device-based privacy controls. Where required by applicable law, CarEdge will honor user-enabled privacy preference signals.

9.5 Do Not Sell or Share My Personal Information (All Users)

CarEdge offers a “Do Not Sell or Share” option to all users. When CarEdge acts as a Controller, you may request that we limit the use of your information for activities that some laws define as selling or sharing, including certain advertising, analytics or referral-related activities.

To submit a “Do Not Sell or Share” request, you may complete our online request form at CarEdge.com/privacy-request or email us at [email protected].

Where required by applicable law, CarEdge will also honor browser-based or device-based opt-out preference signals, including signals indicating a preference to opt out of the sale or sharing of Personal Information, to the extent such signals apply to CarEdge’s processing as a Controller.