Dealers — Privacy Policy

Vintrak, Inc. (“Vintrak,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Vintrak for Dealers website at vintrak.io and related subdomains, pages, forms, waitlist sign-ups, early-access programs, communications, and materials we make available (collectively, the “Site”). By using the Site, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is incorporated into our Terms of Use. Capitalized terms not defined here have the meanings given in the Terms of Use.

1. Scope

This Privacy Policy applies to personal information we collect through the Site, including when you join the waitlist, request early access, fill out contact or interest forms, communicate with us, or otherwise interact with the Site. It does not apply to information collected by third parties through their own websites, services, or platforms, even if linked from the Site.

Business context. The Site is intended primarily for businesses — automotive dealers, dealer groups, brokerages, auctions, storage operators, and similar entities. When you provide information on behalf of a business, that business is responsible for ensuring that any personal information provided about its personnel has been collected and shared with us in accordance with applicable law.

2. Information We Collect

2.1 Information You Provide to Us

We collect information you provide directly when you interact with the Site, including:

• Identity and contact information — your name, title or role, business name, business address, work email, work phone number, and similar identifiers;
• Business and dealer information — dealer or dealership license details (if provided), business type, inventory size or focus, years in business, geographic markets served, and other operational information you share;
• Waitlist and early-access information — your interest in Vintrak, current tools you use, problems you are trying to solve, and any other information you submit through waitlist or early-access forms;
• Communications — the content of messages you send to us through forms, email, chat, or other channels, and our responses;
• Marketing preferences — your subscription status for emails, newsletters, and other communications;
• Payment information — if and when Vintrak begins accepting payments, billing name, business name, billing address, and limited payment-card metadata. Full payment-card numbers are handled directly by our payment processor and are not stored on Vintrak systems.

2.2 Information Collected Automatically

When you access the Site, we and our service providers automatically collect certain information through cookies, pixels, SDKs, and similar technologies, including:

• Device and browser information — device type, operating system, browser type and version, language, screen resolution, and time zone;
• Usage information — pages viewed, links clicked, forms interacted with, time spent on pages, scroll depth, referring URL, and exit pages;
• Network information — IP address, internet service provider, and approximate location derived from IP address (typically city- or region-level);
• Session-replay data — anonymized recordings of your interactions with the Site (mouse movement, clicks, scrolling, and form-field activity), captured by our product-analytics provider. Sensitive form fields (such as password fields) are masked by default;
• Diagnostic information — error logs, crash reports, performance metrics, and stack traces;
• Cookies and identifiers — first-party and third-party cookies, local-storage values, and similar identifiers used to remember preferences and measure usage.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Service providers — analytics, error-monitoring, and infrastructure providers that supply us with information about how you use the Site;
• Business sources — publicly available business directories, dealer associations, professional networks (such as LinkedIn), and similar sources, used to verify or supplement information you provide;
• Referrals — if another person refers you to Vintrak, we may receive your name, business affiliation, and contact details from that person.

2.4 Information We Do Not Knowingly Collect

We do not knowingly collect sensitive personal information through the Site, including government identification numbers, financial-account numbers, precise geolocation, biometric or health information, or information about children under 16. Please do not submit such information through the Site.

3. How We Use Information

We use the information described above for the following purposes:

• To operate, maintain, and improve the Site;
• To evaluate waitlist and early-access requests, decide whom to onboard, and contact you about your request;
• To respond to inquiries, provide support, and communicate with you about Vintrak;
• To send you product updates, early-access invitations, newsletters, and other marketing communications (where permitted by law and subject to your preferences);
• To personalize and improve your experience on the Site;
• To measure and analyze usage, traffic, and engagement, and to develop new features and offerings;
• To detect, investigate, and prevent fraud, security incidents, abuse, and other harmful activity, and to enforce our Terms of Use;
• To comply with legal obligations, respond to lawful requests, and protect our rights, our users, and the public;
• To conduct business planning, financial analysis, and corporate-development activities, including in connection with potential financings, partnerships, or transactions;
• For other purposes disclosed to you at the time of collection or with your consent.

Aggregated and de-identified data. We may aggregate, anonymize, or de-identify information so that it no longer reasonably identifies any individual. We may use and disclose such information for any lawful purpose, including research, analytics, benchmarking, and product development. We will not attempt to re-identify de-identified information except as permitted by law.

4. Cookies and Tracking Technologies

4.1 Types of Technologies We Use

We and our service providers use cookies and similar technologies on the Site, including:

• Strictly necessary cookies — required for the Site to function (for example, security and load balancing);
• Functional cookies — remember your preferences and choices (for example, language or display preferences);
• Analytics cookies — measure how the Site is used so we can improve it (for example, page views, time on page, click paths);
• Session-replay technology — captures anonymized recordings of interactions with the Site to help us diagnose usability issues and improve the product. Sensitive fields are masked by default;
• Marketing cookies — measure the effectiveness of marketing campaigns and, where applicable, deliver advertising to you on other sites.

4.2 Your Cookie Choices

Most browsers allow you to control cookies through their settings. You can usually block, delete, or restrict cookies, though doing so may affect the functionality of the Site. Where required by law, we present a cookie banner or preference center that allows you to consent to or reject non-essential cookies.

4.3 Do Not Track and Global Privacy Control

Some browsers transmit a “Do Not Track” signal. We currently do not respond to these signals. However, we honor Global Privacy Control (GPC) signals as an opt-out of the “sale” or “sharing” of personal information where required by applicable law (see Section 9).

5. How We Share Information

We share personal information in the following circumstances:

5.1 Service Providers and Sub-Processors

We share personal information with vendors and service providers that perform services on our behalf, such as hosting, database management, email delivery, analytics, error monitoring, customer support, and payments. These providers are bound by contractual obligations to use personal information only as necessary to provide services to us. The following providers are currently used in connection with the Site:

This list may change as our operations evolve. We will update this Privacy Policy from time to time to reflect material changes.

5.2 Affiliates

We may share information with our affiliates, subsidiaries, and parent companies for the purposes described in this Privacy Policy.

5.3 Business Transfers

If Vintrak is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, we may transfer your information as part of that transaction, subject to confidentiality protections. You will be notified of any change in ownership or material change in the use of your personal information, as required by law.

5.4 Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to (a) comply with a law, regulation, legal process, or governmental request; (b) protect our rights, property, or safety, or the rights, property, or safety of our users, customers, or the public; (c) detect, prevent, or address fraud, security, or technical issues; or (d) enforce our Terms of Use and other agreements.

5.5 With Your Consent

We may share information with third parties when you direct us to do so or when you otherwise consent to the sharing.

5.6 No Sale of Personal Information

We do not sell personal information for money. We may, however, engage in activities that some U.S. state laws define broadly as “sharing” or “selling” — for example, using third-party analytics or advertising cookies that share usage information with vendors. You may opt out of these activities as described in Section 9, including by transmitting a Global Privacy Control signal.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to (a) provide the Site and respond to your requests; (b) maintain business records; (c) resolve disputes, enforce agreements, and protect legal rights; and (d) comply with applicable legal, accounting, or reporting obligations.

Specific retention periods vary depending on the type of information and the context of collection. Waitlist and early-access information is generally retained for the duration of your interest in Vintrak and for a reasonable period thereafter to support follow-up communications and business planning. Server logs and diagnostic data are typically retained for shorter operational periods. When information is no longer required, we will delete, anonymize, or aggregate it.

7. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These safeguards include encryption in transit, access controls, secure development practices, and vendor-management processes. However, no system is completely secure, and we cannot guarantee the security of personal information.

You are responsible for safeguarding any credentials we issue to you. You must promptly notify us of any unauthorized access to or use of your account by contacting support@vintrak.io.

8. International Data Transfers

Vintrak is based in the United States, and our service providers may operate in the United States and other countries. If you access the Site from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries where data-protection laws may differ from those of your country of residence. Where required by applicable law, we implement appropriate safeguards for international transfers, such as Standard Contractual Clauses.

9. Your Rights and Choices

9.1 Access, Correction, Deletion, and Portability

Depending on where you reside and subject to applicable law, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of personal information;
• Request a portable copy of personal information you have provided;
• Restrict or object to certain processing activities;
• Withdraw consent where processing is based on consent;
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising;
• Opt out of certain automated decision-making with significant effects (we do not currently engage in such automated decision-making through the Site).

To exercise any of these rights, email privacy@vintrak.io with your request. We may need to verify your identity before fulfilling your request. We will respond within the time required by applicable law.

9.2 Authorized Agents

You may use an authorized agent to submit requests on your behalf, where permitted by law. We will require written authorization and may take steps to verify the agent’s identity and authority.

9.3 Appeals

If we deny your privacy request, you may appeal that decision by replying to our denial email or by writing to privacy@vintrak.io. We will respond to your appeal within the time required by applicable law.

9.4 Marketing Communications

You may opt out of marketing emails at any time by following the unsubscribe instructions in those messages or by contacting us at support@vintrak.io. We may continue to send you transactional and operational messages (for example, account and security notices) even after you opt out of marketing communications.

10. U.S. State-Specific Privacy Rights

Several U.S. states have enacted privacy laws that provide additional rights to their residents. The following disclosures supplement the rights described above.

10.1 California

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), California residents have the rights described in Section 9, including the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information, and to limit the use of sensitive personal information.

Categories of Personal Information Collected

In the past 12 months, we may have collected the following CCPA categories of personal information: identifiers (such as name, email address, IP address); commercial information (such as inquiries and waitlist submissions); professional or employment-related information (such as job title and employer); internet or other network activity information (such as browsing history on the Site and interaction with content); geolocation data (approximate, derived from IP address); and inferences drawn from the foregoing to create a profile reflecting preferences and characteristics.

Sources, Purposes, and Disclosures

We collect the foregoing categories from the sources described in Section 2 and use them for the purposes described in Section 3. We disclose the foregoing categories to the recipients described in Section 5. We do not sell personal information for money. As described in Section 5.6, certain activities involving third-party analytics or advertising cookies may constitute “sharing” under the CCPA. We do not knowingly sell or share personal information of minors under 16.

Submitting Requests

California residents may submit verifiable requests under the CCPA by emailing privacy@vintrak.io. We will not discriminate against you for exercising your CCPA rights.

10.2 Other U.S. States

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia (and other states with comprehensive privacy laws that may take effect from time to time) generally have rights similar to those described in Section 9, including rights to access, correct, delete, and obtain a copy of personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling activities. You may submit requests by emailing privacy@vintrak.io.

10.3 Nevada

Nevada residents may opt out of the sale of certain personal information by emailing privacy@vintrak.io. We do not currently sell personal information as defined under Nevada law.

11. Users in the European Economic Area, United Kingdom, and Switzerland

The Site is directed to users in the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland and you choose to interact with the Site, the following additional information applies.

11.1 Controller

Vintrak, Inc. is the controller of personal information collected through the Site.

11.2 Legal Bases for Processing

We process personal information on the following legal bases: (a) your consent, where required; (b) the performance of a contract with you or to take pre-contractual steps at your request; (c) our legitimate interests in operating, securing, and improving the Site and in marketing our products, except where overridden by your rights; and (d) compliance with legal obligations.

11.3 Your Rights

In addition to the rights described in Section 9, you may have the right to lodge a complaint with your local supervisory authority if you believe we have not complied with applicable data-protection law.

12. Children’s Privacy

The Site is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete it. If you believe a child has provided us with personal information, please contact privacy@vintrak.io.

13. Third-Party Sites and Services

The Site may link to third-party websites, services, or platforms, including social-media platforms. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices before interacting with them.

14. Communications Consent

By providing your contact information through the Site, you consent to receive communications from Vintrak as described in this Privacy Policy and in our Terms of Use, including transactional, operational, and (subject to your preferences and applicable law) marketing communications. Standard message and data rates may apply for any SMS or phone communications. You may opt out of marketing communications at any time as described in Section 9.4.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date above and, where required by law, provide additional notice (for example, by posting a notice on the Site or sending you an email). Your continued use of the Site after the effective date of the updated Privacy Policy constitutes your acceptance of the updated terms.

16. Contact Us

If you have questions, comments, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Vintrak, Inc. Attn: Privacy Email: privacy@vintrak.io Support: support@vintrak.io Website: https://dealer.vintrak.io