Privacy Policy

This Privacy Policy ("Privacy Policy") applies to the tools, features, and services (collectively, the "Services") created and/or offered by EZLeads Management, Corp. ("EZLeads") including each and every of its owners, agents, officers, directors, shareholders, employees, contractors, sub-contractors, independent contractors, partners, members, managers, parents, subsidiaries and affiliates (together, "the EZLeads Representatives", "we" or "our"), through any EZLeads application, including, without limitation all web-based and mobile applications ("Apps") that reference or link to these Terms. This Privacy Policy is incorporated into EZLeads' Terms of Service. Capitalized terms not defined in the Privacy Policy are defined in the Terms.

1. Scope and Consent

This Privacy Policy covers:

1. Information collected from those who use our Services ("you" or "your"); and
2. Information that our Business Partners (defined below) share with EZLeads or that we share with our Business Partners.

You accept and agree to be bound by this Privacy Policy when you access or use one or all of the Services that link to this Privacy Policy. This Privacy Policy does not cover the information practices of: (i) third-party individuals or entities who perform tasks on our behalf ("Service Providers"); (ii) our third-party business partners who provide websites, applications or other products or services that you may encounter or access through the Services ("Business Partners"); or (iii) any other third parties (collectively with Service Providers and Business Partners, "Third Parties"), even if you access, encounter or interact with such Third Parties through the Services. While we attempt to facilitate access only to those Third Parties that share our respect for your privacy, we are not responsible for the privacy policies or practices of Third Parties, and you are responsible for reading and understanding those Third Parties' privacy policies.

2. Information Collected or Received

When you use the Services, EZLeads may collect "Non-Personal Information" and "Personally Identifiable Information" (defined below) (collectively, "Information") about you, your use of the Services, or the device you use to access the Services.

A. Non-Personal Information

"Non-Personal Information" is any information that does not enable identification of an individual, such as, without limitation, technical information, behavioral information, and aggregated information, including service usage information, web traffic information, content viewed on the Services, your preferences, and information about your operating system, browser, device, keyboard language and hardware.

B. Personally Identifiable Information

"Personally Identifiable Information" (or "PII") is information that identifies an individual. Because of EZLeads' B2B structure, PII falls into two distinct buckets:

B.i — PII we collect from Dealers (EZLeads is the Controller)

When a dealership signs up for the Services and its personnel use them, we collect the following PII directly from those individuals to operate the Services and run our business:

• Full name and job title
• Dealership name and DBA
• Business email address
• Business mailing address
• Business telephone number(s)
• Login credentials and multi-factor authentication factors
• Profile photo (optional)
• Billing contact and payment method information (handled by our payment processor)
• Account preferences and configuration choices
• Audit logs of platform usage
• Customer-support communications you send to us
• Marketing preferences

For this bucket, EZLeads is the Controller. The contact details and rights described in this Privacy Policy apply directly.

B.ii — End-customer PII Dealers process through EZLeads (the Dealer is the Controller; EZLeads is a Processor)

When a Dealer uses the Services to capture, manage and follow up with vehicle prospects, the personal data of those prospects passes through our infrastructure. The Dealer is the Controller of this data; EZLeads acts as a Processor under our Data Processing Agreement and only processes it on the Dealer's documented instructions. This bucket may include, without limitation:

• Name, email, mailing address and phone of vehicle prospects
• Vehicle interest, shopping history and preferences
• Conversation history (chat, SMS, calls, voicemails) between the Dealer and the prospect
• Lead Ad form responses captured from Meta, Google, TikTok, Microsoft and similar platforms
• Date of birth
• Social Security number (when included in a finance application)
• Driver's license state and number
• Financial information
• Employment information
• Income information
• Residency or credit-proof information (e.g., utility bill, copy of paystub, references)
• Insurance information
• Photos (e.g., trade-in valuations)
• Carfax history pulls associated with the prospect's vehicle of interest

For this bucket, end customers' privacy rights run primarily against the Dealer that captured their data. End customers may use our Data Deletion Request form as a fallback, and we will route the request to the relevant Dealer and assist them in honoring it within the timelines required by law.

The specific Information actually collected through the Services will depend on the portion of the Services accessed and the configuration chosen by each Dealer. If Non-Personal Information is connected or linked to PII, we treat the Non-Personal Information as PII.

3. How Information is Collected

A. PII Provided Directly by You

Dealers (the direct users of the Services) may voluntarily provide us with PII when using the Services, including, without limitation, when they perform the following activities:

• Sign up for an Account or invite teammates
• Configure their dealership, pipelines, numbers, integrations and inventory feeds
• Submit online forms or make requests for communication or support
• Make payment for a subscription or other Service
• Send or receive Texts via the Services
• Electronically sign agreements (e.g., the DPA)

PII of end customers reaches EZLeads when Dealers and their advertising partners (e.g., Meta, Google, TikTok) submit it through the Services — for example, when an end customer fills out a Lead Ad form, sends a chat message to a Dealer, or completes a finance application. EZLeads processes this PII as a Processor on behalf of the Dealer, as described in Section 2.B.ii.

Please note that content posted to Interactive Areas may be publicly viewable. Therefore, if you upload or share any Information to Interactive Areas, unless otherwise expressly stated by EZLeads, such Information may be non-confidential and may become publicly available. This means the Information may be collected, used, or redistributed by others, so please proceed with caution before posting anything sensitive or confidential.

B. Information Collected Automatically

We and certain Third Parties may also automatically collect Non-Personal Information about you and your devices when you interact with the Services, including:

• Computer or device operating system information
• IP address
• Network information
• Browser type and language
• Connection speed
• Mobile device ID
• Device hardware type
• Referring website or application
• Parts of the Services accessed
• Access times and length of time on a page or feature
• Content viewed
• Geographic location

C. Information Collected Through Tracking Tools

When you access our Services, we or Third Parties may use technologies such as "cookies", local storage capabilities, or other similar technologies to monitor usage of the Services ("Tracking Tools"). For full details, see our Cookie Policy.

Cookies

Cookies are small data files stored on your hard drive by a website, and may include session cookies (which expire once you close the browser) and/or persistent cookies (which stay on your browser and may be used by the browser on subsequent visits to the Services, unless deleted by you). Among other things, cookies help us see which parts and features of our Services are popular, count visits, and improve or tailor the Services to make them more relevant to you. You can turn off your web browser's ability to accept cookies, but certain parts of the Services may not work for you.

Unique Identifiers

We may use unique identifiers to collect information about your use of the Services on an individual basis, such as length of time spent on a particular page and pages viewed during a particular log-in period. We use this information to evaluate and improve the Services.

Web Beacons

Web beacons (clear GIFs / pixel tags) are small graphic image files that can be embedded in web pages or emails to collect information about your use of our Services or the correspondences that we send.

Analytics

We use Google Analytics and similar services to help analyze how you use the Services. These services may use cookies, including first- and third-party cookies, as well as other Tracking Tools. Google's ability to use and share information collected by Google Analytics about your visits is subject to the Google Analytics Terms of Use and Google's Privacy Policy. You may opt out using the Google Analytics Opt-out Browser Add-on.

Mobile Device Identifiers

Mobile device identifiers are stored on your mobile device and track how you use the Services through your mobile device. They enable collection of Non-Personal Information (such as usage and traffic data) and help EZLeads learn more about your preferences and internet behaviors in order to operate and improve the Services.

4. Use and Sharing of Information

Important: the uses described in this Section apply primarily to Dealer data (Section 2.B.i), which we control. End-customer data (Section 2.B.ii) is processed strictly on the Dealer's documented instructions under our DPA and is not used for any of the marketing, profiling or commercial purposes described below unless the Dealer has independently authorized such use to its data subjects.

A. To Provide the Services

We use Dealer data, and may share such data with Third Parties, to provide, operate, and maintain our Services, including for the following purposes:

• Personalizing, improving, and operating our business and the Services
• Better understanding the needs and interests of you and others who may use the Services
• Fulfilling requests you make related to the Services, including responding to support requests or processing and facilitating transactions
• Processing and facilitating payments
• Providing Service announcements or further information, recommendations, and offers
• Complying with applicable law, regulation, legal process, subpoena, or governmental requests
• Resolving disputes or security or technical issues
• Enforcing our agreements or investigating potential violations
• Protecting against fraudulent, harmful, unauthorized or illegal activity
• Performing statistical analysis and research activities
• Processing or storing Information through EZLeads' affiliated companies and authorized Third Parties
• Other commercial purposes (including, without limitation, offering you insurance, financing, service contracts, or other products in connection with the purchase or sale of a vehicle)

If we share your PII for a purpose not mentioned in this Privacy Policy, we will receive your express approval prior to the disclosure.

B. Marketing and Advertisements

We may use your Information to send you information about our Services or the services of our Business Partners. Some advertisements may come from Third Parties called "ad networks". We do not provide PII to any ad networks for use not related to the Services. By using the Services, you consent to us providing you with marketing materials, including:

• Direct Marketing: Communications or advertisements sent directly to you via telephone, mail, email, text, or other methods.
• Advertisements: Advertisements and commercials from us or Third Parties.
• Interest-Based Advertisements: Content and advertisements personalized to your interests, inferred from activity on our Services and based on information gathered using Tracking Tools.

You may withdraw your consent through the Contact Us portal of the Website. Even if you opt out, you will still see advertisements while browsing online; they may simply be less relevant.

C. Uses and Disclosure of Non-Personal Information

EZLeads may transfer and disclose Non-Personal Information to Third Parties at its own discretion for industry analysis, marketing and advertising, facilitating data collection, fighting spam/malware and other business purposes.

5. Third Parties

You consent to our sharing of Information, which may include PII, with Third Parties such as:

• Social media networks (Facebook, Instagram, WhatsApp, TikTok, X/Twitter, LinkedIn)
• Payment processors (e.g., Stripe)
• Credit check and financing Service Providers (e.g., Capital One)
• Vehicle inspectors
• Vehicle history providers (e.g., Carfax, Inc.)
• Shipping providers
• Web hosting services (Microsoft Azure)
• Analytics and advertising Service Providers (Google Analytics, Meta, Google Ads, TikTok)
• Sales management tools
• Marketing and promotion partners
• Law enforcement or other legal authorities pursuant to a subpoena or court order

For our complete list of sub-processors, see our Sub-processors page.

6. Ad-Platform Data (Meta / Google / TikTok / Microsoft)

EZLeads operates an ad-platform connector that allows our dealership customers ("Dealers") to authorize EZLeads to retrieve lead-form submissions and related advertising data from their advertising accounts on Meta (Facebook & Instagram), Google, TikTok, Microsoft Advertising and similar platforms.

A. Data we receive from these platforms

With the Dealer's authorization (granted via OAuth), we may receive: lead form responses (e.g., name, email, phone, vehicle interest, free-text answers); page and form metadata; campaign, ad set and creative identifiers; ad-account information; conversation messages from Click-to-WhatsApp, Messenger and Instagram Direct (when the Dealer enables this scope); and aggregate ad-performance metrics.

B. How we use platform data

Solely to (i) deliver leads to the Dealer's CRM, (ii) attribute leads to source campaigns, (iii) sync inbox conversations, (iv) generate reporting for the Dealer and (v) maintain the Services. We do not sell platform data, do not use it to build or augment user profiles for advertising, and do not retain it after the Dealer disconnects unless retention is required by law.

C. Your rights as an end user

If you submitted a lead via a Dealer's Lead Ad, Lead Form Extension, Click-to-WhatsApp campaign or similar, you may request access to or deletion of that data at any time at /legal/data-deletion. The Dealer is the data controller of that lead; EZLeads acts as a data processor.

7. Financial Information

Financial information appears in both data buckets, but with very different roles. Subscription billing for Dealers (Section 7.A) is Dealer data — we are the Controller. End-customer credit applications (Section 7.B) are end-customer data — the Dealer is the Controller and EZLeads is a Processor.

A. Dealer subscription billing (Dealer data — EZLeads is Controller)

To process subscription payments for the Services, we may collect from a Dealer: credit card information; billing contact and address; tax identifiers; bank account routing and account numbers (where ACH is offered).

This information is collected and stored by our third-party payment processing company, Stripe, Inc. (the "Payment Processor"), and use and storage of that information is governed by the Payment Processor's applicable terms of service and privacy policy.

B. End-customer credit applications (end-customer data — Dealer is Controller)

When a Dealer enables the credit application feature, end customers may submit a credit application through the Services. The resulting application data is end-customer data under Section 2.B.ii — the Dealer is the Controller and EZLeads acts as a Processor under the DPA. The Dealer may forward the credit application to its own financing Business Partners or Service Providers (such as Capital One). The application may contain some or all of the following information:

• Name
• Email address
• Mailing address
• Phone number
• Date of birth
• Driver's license number
• Employment information
• Income information

By submitting their Information through a Dealer's credit application form, end customers acknowledge that (i) the Dealer (not EZLeads) is the Controller of that Information and is responsible for forwarding it to its financing partners; (ii) EZLeads only transmits the Information at the Dealer's direction; and (iii) the Dealer's chosen financing partners may use the Information in accordance with their own privacy policies, which the Dealer is responsible for surfacing.

8. Ways to Limit our Information Collection and/or Use

If you want to limit our collection and/or use of your Information, you have several choices:

• Limiting Information provided to EZLeads: You can opt not to disclose certain Information; however, certain features may not be accessible without it.
• Terminating your Account(s): You may limit our collection and use of some Information by terminating your Account(s).
• Tracking Tool choices: Most browsers will let you erase cookies, block their acceptance or warn you before storage. See our Cookie Policy for granular categories.
• Do Not Track: We do not currently respond to Do Not Track signals because no industry standard has emerged.

9. Your Privacy Rights (GDPR / CCPA)

Depending on your location, you may have the following rights:

• Access the personal data we hold about you;
• Correct inaccurate personal data;
• Delete personal data ("right to be forgotten");
• Restrict certain processing;
• Port your data in a structured, machine-readable format;
• Object to processing for direct marketing or based on legitimate interests;
• Withdraw consent where we rely on consent;
• Lodge a complaint with your local data-protection authority;
• Opt out of "sale" or "sharing" of personal information (CCPA / CPRA);
• Limit use of sensitive personal information (CCPA / CPRA).

If you are a Dealer (Section 2.B.i), exercise these rights directly with EZLeads by emailing privacy@ezleads.io or using the Data Deletion Request form.

If you are an end customer of a Dealer (Section 2.B.ii) — for example, a vehicle prospect who filled out a Lead Ad, sent a chat message to a dealership, or submitted a finance application — your Controller is the Dealer that captured your data. Please contact that Dealer first. As a Processor, EZLeads will assist any Dealer in honoring your request within the timelines required by law. You may also use our Data Deletion Request form as a fallback; we will route the request to the relevant Dealer and follow up on your behalf.

We respond within 30 days as required by law.

10. Deletion of Information

If for any reason you wish to close your Account or delete or modify your PII, you can use our self-service Data Deletion Request form, contact us through the Contact Us portal, or email privacy@ezleads.io. We will make reasonable efforts to action your request within 30 days, subject to applicable laws, rules, regulations or court orders.

Public activity on your Account prior to deletion may remain stored on our servers and may remain accessible to the public. Aggregate and/or anonymous information derived from your Account and/or use of the Services may remain on our servers indefinitely.

11. Retention

We retain personal information only for as long as necessary to provide the Services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law (e.g., tax, financial, fraud-prevention or audit obligations). When we no longer need it, we delete or anonymize it using a documented destruction procedure.

12. Security

EZLeads maintains commercially reasonable administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2+), encryption at rest (AES-256), least-privilege access controls, formal change management, vulnerability scanning, and 24/7 monitoring. Despite these safeguards, no method of transmission or storage is 100% secure. See our Security page for the complete program description.

13. Children's Privacy

We do not intend to and do not knowingly collect PII from children under the age of seventeen (17). We reserve the right to request proof of age at any stage so that we can verify that children under seventeen are not using the Services.

14. International Transfers & Business Transfers

Our infrastructure is located in the United States. By using the Services from outside the United States, you consent to the transfer, storage and processing of your information in the United States.

In the event of a business transfer, your Information is typically one of the transferred business assets. If we, or substantially all of our assets, are acquired, or if we go out of business or enter bankruptcy, your Information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer may continue to use your Information as set forth in this policy.

15. Changes to the Privacy Policy

EZLeads reserves the right to make changes to its Privacy Policy at any time and for any reason without prior or subsequent notification. All changes are effective as of the date modified and your continued use of the Services after the indicated date will constitute acceptance to be bound by those changes. EZLeads reserves the right to stop, temporarily or permanently, the operation of any and all Services without notice, at any time.

16. Contact Us

EZLeads is a fully online service. To contact us about this Privacy Policy, exercise privacy rights, or report concerns, email our Privacy Office at privacy@ezleads.io. EZLeads Management, Corp. is incorporated under the laws of the State of Florida, United States.

Interpretation

The section and paragraph headings in this Privacy Policy, as well as all summaries included, are for convenience only and shall not affect the Privacy Policy's interpretation. Any use of "including", "for example" or "such as" shall be read as being followed by "without limitation" where appropriate.