Carlay Website Privacy Notice

Overview

At Carlay Inc., we respect your privacy and are committed to protecting information you share with us about you. This Privacy Notice describes the types of information we may collect from you or that you may provide when you visit our website at www.Carlay.today, and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Privacy Notice applies to information we collect: (i) on this Website; (ii) in email, text, and other electronic messages between you and this Website; (iii) through mobile or desktop apps you download from this Website; and (iv) when you interact with Carlay applications or advertising located on third-party websites and services, if those applications or advertising include links to this notice.

This Notice does not apply to information we collect from you offline or through any other means besides those listed above. This Notice also does not apply to information collected by any third party, including through any application or content (including advertising) that may link to or be accessible from or on our Website.

Children Under the Age of 18

Our Website is not intended for children under 18 years of age. No one under age 18 may provide any information on the Website. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on this Website or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use.

If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at support@carlay.today.

California residents under 18 years of age may have additional rights regarding the collection and sale of their personal information. Please see Your California Privacy Rights for more information.

Information We Collect About You and How We Collect It

We collect several types of information from you or about you when you use our Website, such as your name, mailing address, e-mail address, telephone number, or other similar information ("personal information"). Carlay's employees or contracted inspectors may conduct automobile condition reports, take photos of vehicles, and post information about your and others' vehicles on the Website.

We may also collect information about you individually that does not identify you, such as information about your use of the Website, the type of equipment you use to access the website, your internet connection, or parts of the Website you visit most often. We collect information that you provide to us directly through the Website, as well as information we collect automatically about how you use the Website using cookies and other tracking technologies. Under some circumstances, we may collect information from third parties, such as business partners.

Information You Provide to Us

The information we collect on or through our Website may include:

• Information that you provide by filling in forms on our Website or registering for auctions or services; this includes your initial registration, when you register to participate in an auction, when you bid or otherwise participate in the services, submit information for transportation, when you request information or need assistance;
• Information regarding your automobile, including VIN, mileage, condition of vehicle, and other basic information;
• Information about your vehicle's financing, if you choose to provide it, such as financing type, lender, monthly payment, and payoff balance, and a self-reported credit range;
• Documents you choose to upload to analysis tools we offer — for example, a dealer's offer sheet or a repair estimate — and the vehicle, pricing, and contact information contained in them;
• Information we receive from a third-party sign-in service you choose to use — for example, if you sign in with Google, we receive your name and email address from your Google account;
• Records and copies of your correspondence (including email addresses), if you contact us;
• Your responses to surveys or questionnaires we may issue from time to time if you choose to complete them;
• Details about bids, sales, or other transactions you carry out through our Website and fulfillment of your orders or requests, including, possibly providing financial information in conjunction with a transaction;
• Searches our users perform through the Website; and/or
• Other information you may provide to us.

You also may from time to time provide information to be published or displayed ("User Contributions") on public areas of the Website, or transmitted to other users of the Website or third parties. Your User Contributions are posted on and transmitted to others at your own risk. No security measures are perfect or impenetrable, and we cannot control the actions of other users with whom you may choose to share your User Contributions.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Website, including location data, communication data, and the resources that you access and use on the Website.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). Our Website will attempt to respond to Do-Not-Track signals, but it may not be responsive in all cases. For more information on how you can opt out of behavioral tracking and other mechanisms that enable consumers to exercise choice about behavioral tracking, please see the Network Advertising Initiative ("NAI") on the NAI's website.

The information we collect automatically is only statistical data and does not include personal information, although we may maintain it or associate it with personal information we collect in other ways or receive from third parties. This information helps us improve our Website and deliver better and more personalized service.

Technologies We Use

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse cookies via your browser settings, but some parts of the Website may be inaccessible or not function properly.
• Browser Storage. Certain features may use local storage in your browser to remember your preferences and keep you signed in.
• Web Beacons. Pages of the Website and our emails may contain small electronic files (clear gifs, pixel tags, single-pixel gifs) that allow Carlay to count users who have visited a page or opened an email and for other related statistics.

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on the Website are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use tracking technologies to collect information about you when you use our website, which they may associate with personal information or use for interest-based advertising or other targeted content. We do not control these technologies or how they may be used. For questions about an advertisement or targeted content, contact the provider directly.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Website and its contents to you.
• To provide you with information, products, or services that you request from us.
• To fulfill any other purpose for which you provide it.
• To provide you with notices about your account.
• To carry out our obligations and enforce our rights arising from contracts between you and us, including billing and collection.
• To notify you about changes to our Website or any products or services we offer or provide through it.
• To allow you to participate in interactive features on our Website.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

We may also use your information to contact you about our own and third-parties' goods and services that may be of interest to you. If you do not want us to use your information in this way, please email us at support@carlay.today. We may use information we have collected from you to enable displaying advertisements to advertisers' target audiences. We do not disclose personal information for these purposes without your consent; however, if you interact with an advertisement, the advertiser may assume you meet its criteria.

How We Share Your Information with Dealers

Carlay is a marketplace: connecting you with participating automobile dealers requires sharing some of your information with them. This is how that works:

• Your listing. When you list a vehicle for auction, participating dealers can see the vehicle's details (such as VIN, build data, mileage, and title status), your photos, your self-reported condition report, your asking-price guidance, and your approximate location (such as the vehicle's distance from the dealer). Dealers bidding on your vehicle do not see your name or contact information by default.
• When you accept an offer. We share your name, email address, and phone number with the winning dealer so that documents can be signed and the appointment, payment, and title transfer can be completed.
• Dealers with enhanced access. Participating dealers who subscribe to enhanced listing access (or are granted it) can also view your contact information, financing details you provided (such as financing type, lender, monthly payment, and payoff balance), your self-reported credit range, and your stated purchase plans in connection with your listing, even if they have not won your auction.
• Analysis leads you choose to share. If you use our offer or repair-order analysis tools and choose to share the result with nearby dealers, we send your name, email address, phone number, ZIP code, your uploaded document, and the analysis to participating dealers in your area, and those dealers may contact you directly.

You can stop sharing an analysis at any time using the "Remove from dealers" option shown with the shared analysis. Removal stops dealer access from that point forward; it cannot retract information a dealer has already viewed or saved. If you share the analysis again, it becomes available to dealers again.

Dealers are independent businesses. Once your information is shared with a dealer, the dealer's use of it is subject to that dealer's own privacy practices.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect or you provide as described in this notice:

• To our subsidiaries and affiliates.
• To participating dealers, as described in How We Share Your Information with Dealers above.
• To contractors, service providers, and other third parties we use to support our business — for example, providers of email delivery, electronic document signing, payment processing, vehicle data and valuation, address autocomplete and mapping, analytics and attribution, and customer support chat.
• To a buyer or other successor in the event of a merger or other sale or transfer of some or all of Carlay's assets.
• To fulfill the purpose for which you provide it, or with your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including responding to government or regulatory requests.
• To enforce or apply our terms of use, terms of sale, and other agreements, including for billing and collection.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our customers, our employees, or others, including for fraud protection and credit risk reduction.

Choices About How We Use and Disclose Your Information

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Website may be inaccessible or not function properly.

• Marketing emails. You can opt out of marketing emails at any time using the unsubscribe link in any marketing email or through your account settings. Service and transactional emails (such as sign-in codes and offer notifications) are sent as needed to operate the Website.
• Text messages. Reply STOP to any text message to opt out. See the SMS Privacy Policy section below.
• Shared analyses. You can stop sharing an offer or repair-order analysis with dealers at any time using the "Remove from dealers" option, as described in How We Share Your Information with Dealers.

We do not control third parties' collection or use of your information for interest-based advertising. However, these third parties may provide ways to opt out. You can opt out of targeted ads from members of the Network Advertising Initiative on the NAI's website.

California residents may have additional personal information rights and choices. Please see Your California Privacy Rights for more information. Nevada residents may submit sale opt-out requests to support@carlay.today.

Accessing, Correcting, and Deleting Your Information

You can request deletion of your account at any time from your Account page on the Website. If you wish to request access to, correct, or delete any personal information that you have provided to us, you can also email us at support@carlay.today. We will try to accommodate your request, but we may need to delete your account to do so, or we may decline your request under certain circumstances (e.g., if the change would violate law or cause information to be incorrect). We may retain certain information as required by law or as needed for legitimate business purposes, such as records of completed vehicle sales.

California residents may have additional personal information rights and choices, as outlined below.

Your California Privacy Rights

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information, including rights to update or delete your information. You can learn more about your California privacy rights at https://oag.ca.gov/privacy/ccpa.

California's "Shine the Light" law (Civil Code § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to support@carlay.today.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Any payment transactions will be conducted via secure third-party payment processors, such as Stripe. For more information about their privacy and data security practices, please visit their website privacy policy at https://stripe.com/privacy.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. Do not share your password with anyone and be cautious using the Website on public networks.

Unfortunately, the transmission of information via the internet is not completely secure. Although we have measures in place to protect your personal information, we cannot guarantee its security in transit. Any transmission is at your own risk. We are not responsible for circumvention of any privacy settings or security measures on the Website.

SMS Privacy Policy

We respect your privacy and are committed to protecting your personal information. This section details how we handle information you provide through our SMS program:

Use of Information

• Purpose: We use your information to send mobile messages and respond to your inquiries as necessary. This may involve sharing your information with platform providers, phone companies, and other vendors who assist in message delivery.
• Transactional first: The text messages we send are about your account and your transactions — for example, verification codes, listing and auction status, offers received, document signing, and appointment reminders. We send marketing text messages only with your separate express consent.
• We do not sell, rent, loan, trade, lease, or otherwise transfer for profit any phone numbers or customer information collected through the SMS program to any third party.
• Disclosure: We may disclose your information if required by law, regulation, or governmental request, to avoid liability, or to protect our rights or property.

Choices and Controls

• Consent: Consent to receive automated marketing text messages is not a condition of any purchase.
• Opt-Out: You can opt out of receiving further text messages by replying to any of our text messages with: STOP, END, CANCEL, UNSUBSCRIBE, or QUIT.
• Help: Reply HELP to any message, or contact us at support@carlay.today, for assistance.
• Frequency and rates: Message frequency varies. Message and data rates may apply; carriers are not liable for delayed or undelivered messages.

Changes to Our Privacy Notice

It is our policy to post any changes we make to our privacy notice on this page. If we make material changes to how we treat users' personal information, we will notify you through a notice on the Website home page. The date the privacy notice was last revised is identified at the top of the page.

You are responsible for periodically visiting our Website and this privacy notice to check for any changes, as well as keeping the email associated with your account up to date.

Contact Information

To ask questions or comment, or to register a complaint, about this Privacy Notice and our privacy practices, contact us at support@carlay.today.