a. Information Provided By Your Dealer/Referring Business: When you express interest in a vehicle on your dealer’s website, your dealer may provide us with certain information that you provided to them, which may include, without limitation, your name, email address, mailing address, telephone number, vehicle of interest, past and present vehicle ownership, financial information, including without limitation, vehicle financing, and payoff information, birthdate, and employment information so that we can contact you directly with a personalized link to our Site. Your dealer’s sharing of that information will be subject to its own privacy policy, so we encourage you to review the privacy policy posted on your dealer’s website.

b. Information You Provide to Us: When you provide information in order to be contacted about a vehicle or otherwise engage with the Service, you may be asked to provide certain personally identifiable information, such as your name, email address, mailing address, and telephone number. You may also provide us with information about your automotive preferences.

You may also choose to create a profile of the vehicle(s) you currently own. Each profile that you create will contain whatever information you elect to include.

c. Information Automatically Collected Through Technology: Information regarding your use of the Service may be collected and/or aggregated through the use of automated methods, which may mean that it will not be obvious to you that information is being collected. This automatically collected information may include information such as: your computer’s or mobile device’s IP address or other unique identifier, your domain server, your type of computer or mobile device, your type of web browser, your type of operating system, your Internet Service Provider or mobile carrier, emails you open and links you click on within those emails, and statistical information regarding the pages on the Site that you visit, and the items that you view and interact with within the Service.

d. Information Collected Using Cookies and Other Technologies: Various technologies are used to automatically collect information, such as cookies, local shared objects, web beacons and short URLs (generally referred to as Tracking Technologies). Cookies are small identifiers sent from a web server that are stored on your device for the purpose of identifying your browser or storing information or settings in your browser. Local storage and similar browser storage may be used to remember your preferences and keep features such as chat and forms working as you move between pages. A web beacon, also known as an Internet tag, pixel tag or clear GIF, links web pages to web servers and their cookies. A short URL can track the clicks a link receives. When we refer to Tracking Technologies, we are including all current and similar future technologies. Our website also uses session replay technology to record how pages are used, for fraud prevention, quality assurance purposes and to make the site easier to use. Form inputs are masked in these recordings. Our Website Chat and Session Recording section explains how it works.

We may use one or more Tracking Technologies on our Site, and other websites and mobile applications that may not be ours. Tracking Technologies may be used by us and others, on our behalf and on their own behalf, to transmit information to you or about you and connect information about you from different sources, websites, devices, and mobile applications. On our website, analytics, session replay and advertising technologies load when you visit. We honor Global Privacy Control signals as a request to opt out of the sale and sharing of personal information and of targeted advertising, and we confirm on screen when we have honored one. Browser Do Not Track signals have no common industry standard, so Global Privacy Control and Your Privacy Choices are how we honor your choices. Our Cookies and Trackers We Use section names every tool and cookie.

You can change your privacy preferences at any time through Your Privacy Choices, and you can control cookies and certain other technologies through your browser, including blocking all cookies; however blocking all cookies may affect your use of our Service and other websites and services online, and may prevent you from using all the features and elements of our Service and other websites and services.

e. Combined Information: We may combine information that you provide to us with information we receive from our affiliates and other sources, as well as with other information that is automatically collected. The combined information may include information about your use of the Site and Service, your use of other websites, devices and mobile applications, and information from our affiliates and other sources. We will use this combined information in order to personalize and enhance your experience on the Site.

f. Website Chat and Forms: When you chat with us or fill out a form on our website, we collect what you type, such as your name, phone number, email address, business details and message. Chat conversations are saved and can become part of a lead record, and forms that ask for your phone number explain how we may call and text you. See Website Chat and Session Recording and What the consent moment looks like.

We may use the information we collect for the following purposes:

a. for everyday business purposes, such as providing products and services you request, and providing customer support;

b. to contact you via email, SMS, and/or telephone;

c. to personalize the types of information presented on the Site, including recommended vehicles and relevant values and/or offers for cars that you would like to research and/or trade in;

d. to communicate about, and administer your participation in, special events, programs, surveys, contests, sweepstakes and other offers or promotions;

e. to evaluate and improve our business, including without limitation, developing new products and services and analyzing the effectiveness of products, services, applications and websites;

f. to perform data analyses, including market and consumer research, trend analysis, demographic analysis and financial analysis;

g. to deliver content correlating to your interests and browsing and usage history, both within our Site and, if you allow advertising technologies, on other websites and applications;

h. to diagnose and address technical and service problems;

i. to honor your privacy choices and keep a record of them, and to protect our Site, Service and users against fraud, spam and abuse; and

j. to comply with applicable legal requirements and our policies.

We share information about you only in the ways described below, and we never sell personal information for money.

a. Affiliates and Manufacturers. Information collected, including personally identifiable information, may be shared with our affiliates, auto dealers and/or auto manufacturers, who will use that information in accordance with their own privacy policies. For example, if you are interested in a particular listing of a car presented on the Site, information about you may be shared with our affiliates.

b. Our Service Providers. We may engage third parties to provide part or all of the Services offered through or in connection with the Site on our behalf. We require such providers to maintain your information in confidence and to use the information only to perform the services specified by us in a manner consistent with this Privacy Notice.

c. Corporate and Asset Transactions. If we sell all or substantially all of our business or sell or transfer all or a material part of our assets, or are otherwise involved in an acquisition, merger, sale, reorganization or similar event, as part of the transaction, we may transfer all information we have collected and stored, including personal information, related to the portion of the business or assets sold or transferred, to the party or parties involved in the transaction.

d. Other. We may access or disclose information, including personal information, to: (i) protect or defend our interests and the legal rights or property of LeadLocate (DotNet Holdings LLC) and our affiliates; (ii) protect the rights, interests, safety and security of users of the Service or members of the public; (iii) protect against fraud, for risk management purposes or otherwise to maintain the integrity and safety of the Service; and/or (iv) comply with applicable law or legal process.

e. Analytics and Advertising Partners. Our website uses Google Analytics, Lucky Orange and Tawk.to visitor analytics to understand how the site is used. Unless you opt out, it also loads the Meta Pixel and TikTok Pixel to measure and improve our advertising, Leadfeeder to show us which companies visit, and Google signals and ad personalization. These partners receive information such as your IP address, browser details, cookie identifiers and the pages you visit, and the advertising partners may collect information about your online activities over time and across different websites. Under California law, letting Meta and TikTok use that information for cross context behavioral advertising is “sharing,” and some state laws treat similar disclosures as a “sale” or as targeted advertising. One click on Turn off sale and sharing, under Your Privacy Choices in the footer of every page, turns all of these advertising and visitor insight tools off. Our Cookies and Trackers We Use section lists each one.

f. Messaging Data. Mobile phone numbers, text messaging opt-in data and consent records are never shared with third parties or affiliates for their marketing or promotional purposes, as described in our Mobile Messaging Privacy Notice.

We want every visit to be easy and every question answered quickly. Here is how our website chat and session recording work.

Website chat

When you chat with us on our website, we save the conversation, including the messages you type, the page you started on and the time of each message. Replies may be prepared with automated assistance, and our team reviews conversations so we can follow up, answer your questions fully and improve our service. If you share your name, phone number or email address, or ask us to follow up, the conversation becomes part of a lead record in our CRM so our team can keep helping you.

Service providers that help us operate the chat, including providers of automated assistance tools, process conversations only to help us respond. Conversations are kept with their lead record, and deleting a lead record deletes its conversation. By using the chat, you agree that we may save, review and use your conversation as described here. Please leave payment card numbers and other sensitive details out of the chat.

Session recording

Our website uses Lucky Orange to record how pages are used: mouse movements, clicks, taps, scrolling, the pages you visit and how they appear on your screen. We review these recordings to find and fix problems, learn what visitors look for and make the site easier to use. Recordings mask what you type into form fields, so the contents of your form entries are not captured in them.

Lucky Orange processes recordings on our behalf, and recordings are kept for the storage period of our plan, typically 30 to 60 days and never longer than 12 months. If you prefer that your visits not be recorded or measured at all, you can block or delete cookies in your browser settings or use the Google Analytics opt out browser add-on, and our team is always glad to help by phone at 844-376-2274.

LeadLocate has and will maintain security measures we deem reasonable and appropriate to secure your personally identifiable information against inadvertent, unauthorized or illegal loss, destruction, disclosure, access or use. Although LeadLocate will use various technologies and tools to protect your PERSONALLY IDENTIFIABLE INFORMATION, no method of securing data is foolproof or completely effective, and data transmissions, communications or stored data MAY BE LOST, DESTROYED OR IMPROPERLY OR UNLAWFULLY DISCLOSED, ACCESSED OR USED. Thus, although LeadLocate takes COMMERCIALLY reasonable measures to protect your PERSONALLY IDENTIFIABLE INFORMATION, WE DO not and cannot guarantee that your PERSONALLY IDENTIFIABLE INFORMATION will remain private or secure.

We provide a reporting channel at leadlocate.com/sales-leads/contact-us#report-scam for suspected impersonation of LeadLocate, false claims of affiliation with us, and attempts to access or copy our systems. This section explains how we handle information submitted through that channel and serves as our notice at or before the point of collection.

What we collect. Your name and contact details, such as your email address and phone number; your company or employment information if you choose to include it; the contents of your report, which may include information about the people or companies you are reporting; any evidence you later provide, such as screenshots, documents, emails, or recordings; and technical records created when you submit, such as the page address, IP address, browser information, and the date and time of submission. We collect only what is reasonably necessary for the purposes described here.

How we use it. We use report information to investigate the conduct described, to protect our customers, prospects, systems, and intellectual property, to prevent fraud and abuse, to establish, exercise, or defend legal claims, and to refer suspected criminal activity to law enforcement or regulatory authorities. We do not use report information for marketing, we do not sell it or share it for cross context behavioral advertising, and we do not use it to train artificial intelligence models.

Who may receive it. Access is limited to personnel working on the matter. Where reasonably necessary, report information may be shared with our attorneys and professional advisers, with service providers that host our systems under confidentiality obligations, with law enforcement or regulatory authorities, and with courts or arbitrators in connection with legal proceedings.

How we protect it. Report information is stored on systems we operate and is protected by reasonable administrative and technical safeguards, with access limited to personnel who need it for the purposes above.

How long we keep it. We keep report information for as long as reasonably necessary to complete the investigation and any resulting enforcement or legal action, and to satisfy legal, audit, and record keeping obligations. When it is no longer needed for these purposes, it is deleted or de-identified.

Discretion. We handle reports discreetly, but we cannot guarantee confidentiality or anonymity where disclosure is reasonably necessary to investigate or pursue a claim or is required by law.

Your rights. Depending on where you live, including under California law, you may have the right to know, access, correct, or delete personal information we hold about you, subject to exceptions, for example where the information must be retained to investigate, to establish or defend legal claims, or to comply with law. To exercise these rights, use the contact information in the Contact Us section of this Privacy Policy.

You are entitled to make choices about how we use information and how we communicate with you.

a. You may choose not to provide personal information, though that will inhibit our ability to personalize the Site for you and send you certain information or alerts that may be of interest to you.

b. If you do not want to receive marketing emails from us, you can follow the “unsubscribe” link provided at the bottom of those emails or change your communication preferences on the Site under “Manage Account”.

c. As mentioned above, there are ways to limit the information collected through technology by blocking cookies, though some of the features of the Service may not work if you decide to do so.

d. You can opt out of the sale and sharing of your personal information and of targeted advertising, and opt back in, at any time through Your Privacy Choices, a link in the footer of every page. A Global Privacy Control signal from your browser is honored automatically.

e. You can stop text messages from LeadLocate at any time by replying STOP, and ask for help by replying HELP.

LeadLocate is made for businesses and the professionals who work in them. Our Site and Service are not directed to children under 13, and we do not knowingly collect personal information from children under 13, in keeping with the Children’s Online Privacy Protection Act (COPPA). You must be 18 or older to use the Site and the Service.

We do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us personal information, please tell us through our secure contact form or call us toll free at 844-376-2274, and we will delete it promptly.

Under California law, if you are a resident of California, you are entitled to ask us for a notice describing what categories of personal information we share with third parties or corporate affiliates for their direct marketing purposes. In response to your written request, we will identify the categories of information shared, if any, and will include a list of the third parties and affiliates with which it was shared, as well as their addresses. If you want to submit such a written request, please submit it through our secure contact form or by U.S. mail at the address set forth below.

This right comes from California’s “Shine the Light” law (Civil Code section 1798.83). It is separate from your rights under the California Consumer Privacy Act, which are described in our California Privacy Notice.

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have privacy rights under their state’s consumer privacy law, and we honor the rights below for residents of each of these states. California residents will find their rights in our California Privacy Notice. Wherever you live, you are welcome to ask us about your information.

Your rights

Depending on your state, you have the right to:

• Confirm and access. Confirm whether we process your personal data and get a copy of it.
• Take your data with you. Receive the personal data you gave us in a portable, readily usable format.
• Correct. Ask us to correct inaccurate personal data.
• Delete. Ask us to delete personal data about you.
• Opt out. Opt out of targeted advertising, the sale of your personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use personal data for that kind of profiling.
• Know who receives it. Where your state provides this right, get a list of the third parties, or categories of third parties, to which we have disclosed personal data.
• Be treated fairly. Exercise any of these rights without being denied service or charged a different price.

Where your state requires consent before sensitive data is processed, we collect sensitive data only with your consent.

How to make a request

Send a request through our secure contact form or call us toll free at 844-376-2274. To opt out of targeted advertising and the sale of your personal data, use Your Privacy Choices in the footer of any page, or turn on Global Privacy Control in your browser, which we honor for every visitor. Requests are free of charge.

We respond within 45 days. When we reasonably need more time, we may extend that once by up to 45 more days and will tell you why within the first 45 days. To protect your information, we verify your identity before acting on a request to access, correct or delete, as described in the California Privacy Notice. Where your state allows it, an authorized agent may make a request for you.

When a dealership or other subscriber stores its own customers’ information in LeadLocate, we process it on the subscriber’s behalf, and the subscriber decides how it is used. If you are a customer of one of our subscribers, please contact that business directly. If you contact us instead, we will pass your request to the business and help it respond.

Appeals

If we decline to take action on your request, you can appeal. Reply to our decision, or send a message through our secure contact form that begins with the word “Appeal,” or call us at 844-376-2274. We decide every appeal within 45 days of receiving it. In states that allow more time for complex appeals, we may extend that by up to 60 more days and will tell you why within the first 45 days. We explain our decision and the reasons for it in writing.

If we deny your appeal, you can contact the attorney general of your state:

Nevada residents

Nevada residents may ask us not to sell their covered personal information. Nevada law defines a sale as an exchange for money, and we never sell personal information for money. You can still send us a request through our secure contact form or by calling 844-376-2274, and we will honor it within 60 days.

You can contact us by sending a request through our secure contact form explaining how you would like to modify your personal information and/or preferences, or by calling us toll free at 844-376-2274. You agree to promptly notify us if your information changes or is inaccurate.

If you reach the Site using a link or from another web site or search engine, or go to another site from the Site, information about your visit to the Site may be collected by the other website or search engine, and will be subject to the privacy policy of that site. You are encouraged to review the privacy policy of each of those sites or search engines.

IN NO EVENT WILL LEADLOCATE (DOTNET HOLDINGS LLC) BE LIABLE, DIRECTLY OR INDIRECTLY, TO ANYONE FOR ANY DAMAGE OR LOSS ARISING FROM OR RELATING TO ANY USE, CONTINUED USE, OR RELIANCE ON ANY LINKED THIRD PARTY SITE, OR ANY LINK CONTAINED IN A LINKED SITE, OR THE PRIVACY PRACTICES OF ANY LINKED SITE.

You should be aware that the United States and other countries have not harmonized their privacy laws and regulations. This Privacy Notice is intended only for residents of the United States and individuals who agree to be subject to U.S. law. If you are accessing the Site or using the Service outside of the United States, you agree to the privacy protections set forth in this Privacy Notice and agree to be subject to U.S. law.

As part of the consideration that the LeadLocate requires of the Visitor to view, use, or interact with this site, Visitor agrees to use binding arbitration for any claim, dispute, or controversy (CLAIM) of any kind (whether in contract, tort or otherwise) arising out of or relating to this purchase, this product, including solicitation issues, privacy issues, and terms of use issues.

Arbitration shall be conducted pursuant to the rules of the American Arbitration Association, which are in effect on the date a dispute is submitted to the American Arbitration Association. Information about the American Arbitration Association, its rules, and its forms are available from the American Arbitration Association, 335 Madison Avenue, Floor 10, New York, New York, 10017-4605. Hearing will take place in the city or county of the Seller.

In no case shall the Visitor have the right to go to court or have a jury trial. Visitor will not have the right to engage in pre-trial discovery except as provided in the rules; you will not have the right to participate as a representative or member of any class of claimants pertaining to any claim subject to arbitration; the arbitrator’s decision will final and binding with limited rights of appeal.

We want everyone to be able to learn about LeadLocate and use our website with ease. We design and test our website against the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA, published by the World Wide Web Consortium, and we keep improving it as we add pages and features.

Accessibility tools on every page

Open the accessibility button on any page, or press Alt+0, to adjust the page to suit you:

• Larger or smaller text
• Higher contrast
• A dyslexia friendly font
• A reading guide that follows your pointer
• Stop animations
• Read aloud, which reads page text to you

Third party content

A few parts of our website come from other providers, including the embedded video player and the scheduling calendar, and they may not meet every guideline. If any of them gets in your way, tell us and we will give you the information or help you complete the task another way.

Help and feedback

Call us toll free at 844-376-2274 or send a message through our secure contact form. We reply within 2 business days, and we are happy to provide information in an alternative format.

We may update the Site, the Service and this Privacy Notice from time to time. When we do, we post the updated Privacy Notice on this Site and change the “Last updated” date at the top of this page. If a change is material, we give you additional notice, such as a notice on our website, and where the law requires, we ask for your consent before applying the change to information we already hold. By continuing to access the Site or use the Service after an update takes effect, you accept the updated Privacy Notice. Please review this Privacy Notice from time to time so that you are aware of any changes.

If you have questions about the Service or need further assistance, please reach us through our secure contact form, call us toll free at 844-376-2274, or send written notice to:

DotNet Holdings LLC

Attn: LeadLocate

1401 21st St Ste 14270

Sacramento, CA 95811

Fax: 866-429-5707

A signed in LeadLocate user can connect an AI assistant, such as ChatGPT from OpenAI, Claude from Anthropic, Canva or Muse from Meta, to their LeadLocate account through our API and our Model Context Protocol server at https://leadlocate.com/api/mcp. A connection can read the user's dealership inventory and save new creative work into the user's account. This notice explains what a connection can access, what it can create, and how to end it. It supplements the Privacy Notice above.

• your name and email address, and an opaque identifier for your LeadLocate profile;
• your dealership's name, city, state and ZIP code;
• your dealership's current vehicle inventory, including year, make, model, trim, price, MSRP, mileage, colors, engine, transmission, drivetrain, fuel type, VIN, stock number, photos and listing links;
• Facebook Marketplace listing text prepared from that inventory, which is signed with your first name; and
• the names of your dealership's File Library folders.

A connection cannot read leads, contacts, customers, messages, calls, deals, credit applications, billing, settings or the files already stored in your File Library.

When you ask your assistant to, a connection can add new items to your account: files in your File Library (images, videos and PDFs), designs and images in Design Studio, text message and email templates, notes on your My Office desk, and To Dos for yourself. Each new item is created as you, is recorded with the time it was created, and stays in your account until you remove it in LeadLocate. Like every File Library file, a file saved this way can be viewed by anyone who has its share link.

A connection can never delete or change anything that already exists in your account, and it cannot send a text message, email or anything else to anyone. Any action that reaches a customer happens only inside LeadLocate, by you.

You connect by signing in to LeadLocate and approving access on our consent screen, or by creating a personal API key in the API Keys section of your LeadLocate profile. We store only a one way hash of each key and access token. Access tokens expire after one hour and are renewed until you disconnect.

When you ask an AI assistant a question that uses LeadLocate, the information listed above that answers your question is sent to that assistant's provider. When you ask it to save something, the content you asked it to save is sent from the provider to LeadLocate. The provider's handling of your conversation is governed by its own terms and privacy policy. LeadLocate does not receive your conversation with the assistant. We receive only the requests the assistant makes to LeadLocate, and we record the time, IP address and the type, size and source of each item created, for security, abuse prevention, daily limits and rate limiting. We do not use these requests or the content you save to train artificial intelligence models, and we do not sell them.

You can disconnect any assistant or revoke any key at any time from API Keys on your LeadLocate profile, which ends its access immediately. Items it already created stay in your account until you remove them. Users who manage your dealership's LeadLocate account can also revoke connections for people at the dealership. If a user is disabled or the dealership account is paused, every connection for that user or account stops working. Connection records are kept while a connection is active and afterward only as long as needed for security, audit and legal purposes. Questions or requests can be sent through our secure contact form.

We group the cookies and similar technologies on our website into three categories.

Strictly necessary. These make the site work and keep it secure. They remember your privacy choice (the ll_consent cookie on .leadlocate.com, kept for 12 months), keep your chat conversation and form entries in place as you move between pages (stored in your browser), protect our forms from spam with Google reCAPTCHA Enterprise, and keep you signed in to our CRM and apps. They run without a choice because the site cannot work properly without them.

Analytics and session replay. Google Analytics 4, Lucky Orange session replay and Tawk.to visitor analytics show us how visitors use the site so we can fix problems and make it faster and easier to use. They load when you visit our website. Google signals and ad personalization turn off when you opt out of sale and sharing, and Lucky Orange masks form inputs in its recordings.

Advertising, sharing and visitor insights. The Meta Pixel and TikTok Pixel measure our ads and help us show relevant ads on Facebook, Instagram and TikTok, Leadfeeder shows us which companies visit our site, and Google signals and ad personalization let Google connect our analytics to signed in Google accounts for advertising. These run unless you opt out. They never run after you choose Turn off sale and sharing under Your Privacy Choices or when your browser sends Global Privacy Control.

Some browsers offer a “Do Not Track” setting. Because there is no common standard for how websites should respond to it, we honor your choices through Global Privacy Control and Your Privacy Choices instead. Opting out does not remove ads from other websites: you may still see ads, but they will not be based on information from your visits to our site.

Every tool, with its cookie names and lifetimes, is listed in Cookies and Trackers We Use. For how we process personal information and how to exercise your rights, see our California Privacy Notice and State Privacy Rights.

Here is every tool on our website, what it does, the cookies or browser storage it uses, and when it runs. Lifetimes come from each provider’s public documentation and can change when a provider updates its tools. A cookie marked “renewed” restarts its clock each time you return.

Strictly necessary: always on

Analytics and session replay

Advertising, sharing and visitor insights: off when you opt out

None of the tools in the last table run after you choose Turn off sale and sharing or when your browser sends Global Privacy Control. Each provider’s privacy policy, on its own website, explains how it handles information.

Content we embed

Videos on our pages are hosted by Adilo. When a page with a video loads, the Adilo player connects to Adilo’s servers and may use cookies or browser storage to play the video and count views, as described in Adilo’s privacy policy.

You decide how your information is used on our website, and changing your mind takes one click.

Opt out of sale, sharing and targeted advertising

Open Your Privacy Choices from the footer of any page and choose Turn off sale and sharing. Your opt out takes effect on that browser right away: the Meta Pixel, TikTok Pixel and Leadfeeder stay off, and Google signals and ad personalization are turned off. You will see “Opt out request honored” on screen, and the Your Privacy Choices link in the footer shows that your opt out is honored.

Site analytics and session recording (Google Analytics with Google signals off, Lucky Orange and Tawk.to visitor analytics) keep running after an opt out. They are used only to measure and improve our own website, with their advertising features turned off.

Global Privacy Control

If your browser or a browser extension sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale and sharing of your personal information and of targeted advertising, wherever you live. We apply it automatically before any advertising technology loads, and Your Privacy Choices confirms it on screen: “Global Privacy Control detected. Opt out request honored.” While GPC is on, your opt out stays in place.

Opt back in

Open Your Privacy Choices at any time and choose Allow sale and sharing. If your browser sends GPC, turn GPC off first.

Where your choice applies

Your choice is saved in the ll_consent cookie on leadlocate.com and its subdomains, including our signup pages and chat.leadlocate.com, for 12 months, with a copy in your browser’s storage. It applies to the browser you use, so please make your choice on each browser and device you use. If you clear your cookies, your saved choice is cleared too, so please choose again under Your Privacy Choices.

Do Not Track

Some browsers offer a “Do Not Track” setting. There is no common industry standard for how websites should respond to it, so our website does not change its behavior when it receives one. Global Privacy Control and Your Privacy Choices give you a clear, reliable way to opt out instead. When you allow advertising technologies, Meta, TikTok, Google and Leadfeeder may collect information about your online activities over time and across different websites.

Proof of your choice

So that we can show we honored your choice, we keep a record of each one: a random identifier, the choice you made, whether GPC was on, the version of the notice, the page, the date and time, your IP address and your browser type. We keep these records for 24 months and use them only to honor and demonstrate your choices and to meet our legal obligations.

Other ways to make a request

You can also opt out, or ask to access, correct or delete your information, through our secure contact form or by calling us toll free at 844-376-2274. Our California Privacy Notice and State Privacy Rights sections explain your rights in detail.

Session cookies are used for your current browser session and will expire after you close your browser. Persistent cookies are used to enhance your experience between website visits and will remain on your computer until you delete them or until they reach their set expiry date. You always have the ability to manually delete cookies.

If you are viewing our content in a web browser, you can change your choice about the sale and sharing of your information at any time using Your Privacy Choices. To stop analytics and session recording cookies as well, block or delete cookies in your browser settings. If you are using our mobile apps, you can change your preferences in the analytics settings in the app.

You may also set your browser to block all cookies or to indicate when a cookie is being set, although our services may not function properly if your cookies are disabled. To find out how to control or disable cookies within most browsers, consult the "Help" section of your browser or device or visit www.allaboutcookies.org.

This table shows the categories of Personal Information we have collected in the past 12 months and collect today, where each comes from, why we use it, whether it is sold or shared, and how long we keep it. We do not sell Personal Information for money. “Shared” means disclosed for cross context behavioral advertising, which you can turn off at any time through Your Privacy Choices or Global Privacy Control.

We do not collect protected classification characteristics or biometric information for our own purposes.

To provide the products or features offered by LeadLocate (“Products”), we must process information about you, including Personal Information, whether or not you are registered or logged in. Subject to the limitations we describe in our Privacy Policy, we may share your Personal Information for business purposes with strict restrictions on how our partners can use and disclose the data we provide, at your direction, or in ways otherwise in accordance with the CCPA.

The Notice at Collection lists each category of Personal Information we collect, where it comes from, why we use it, whether it is sold or shared, and how long we keep it.

Who receives Personal Information

We disclose Personal Information for business purposes to:

• Service providers and contractors that host our systems, deliver calls, texts and email, process payments, verify phone numbers, provide analytics and session recording, protect our forms, help us answer chats and support our customers. Our contracts require them to use the information only to provide services to us.
• People and accounts you share and communicate with, and apps, websites and integrations you connect to our Products.
• Dealerships, affiliates and partners, as described in With Whom Do We Share Information?
• New owners in the event of a change of ownership or control of all or part of our Products or their assets.
• Law enforcement or other third parties in connection with legal requests.

Sale and sharing

We do not sell Personal Information for money. Unless you opt out on our website, we share identifiers, such as cookie identifiers and IP address, and your activity on our site with Meta Platforms and TikTok for cross context behavioral advertising, and we treat the use of Leadfeeder and of Google signals and ad personalization as a possible sale or sharing. You can opt out at any time through Your Privacy Choices or Global Privacy Control. We have no actual knowledge of selling or sharing the Personal Information of consumers under 16.

Sensitive Personal Information

We use and disclose sensitive Personal Information only for the purposes the CCPA permits without offering a right to limit, such as providing the services you request, signing you in securely, verifying your identity, preventing fraud and keeping our systems secure. We do not use it to infer characteristics about you.

De-identified information

When we use de-identified information, we keep it in de-identified form and do not attempt to re-identify it, except as the law permits.

Information we process for our subscribers

This Notice covers Personal Information LeadLocate collects for its own purposes. When a dealership or other subscriber stores its own customers’ information in LeadLocate, we process it as the subscriber’s service provider under our agreement with them, and the subscriber’s privacy notice applies. If you are a customer of one of our subscribers, please contact that business directly. If you contact us instead, we will pass your request to the business and help it respond.

We receive Personal Information from the information that you and others provide, your device(s), and from our partners. The categories of sources from which we’ve collected or received Personal Information include:

We collect the content, communications, and other information you provide when you use our Products, including when you sign up for an account, create or share content, and message or communicate with others. We collect information about the people, pages, accounts, data, and 3rd party products or services you are associated with, and how you interact with them across our Products, such as the people you communicate with or the entities you are a part of. We also collect information about how you use our Products, including data we serve on and off LeadLocate, such as the types of data content you engage with, the features you use, the actions you take, the people or accounts you interact with, and the time, frequency, and duration of your activities.

We may also receive content, communications, and information about you that other people provide when they use our Products, such as when they send a message to you or upload, sync, or import your or 3rd party contact information.

We collect information from and about the computers, phones, connected TVs, and other web-connected devices you use that integrate with our Products, and we combine this information across different devices you use.

We may receive information from other LeadLocate companies or affiliates for business purposes that help us provide you with an innovative, relevant, consistent, and safe experience across all LeadLocate Products or Services you use. We also process information about you across LeadLocate for these purposes, as permitted by applicable law, and in accordance with their terms and policies.

Client partners, account holders, advertisers, app developers, and publishers and other partners can send us information for business purposes through a variety of LeadLocate business tools they use, including our plug-ins, data import, form submissions, APIs and SDKs, or tracking codes. These partners can provide information about your activities on and off LeadLocate, including information about your device, websites you visit, things you do on their services, and purchases or transactions you make. We also receive information about your online and offline actions, and data from third-party data providers who have the rights to provide us with your information. Partnering entities receive your data when you visit or use their services or through third parties they work with.

On our own website, information also comes from your browser through the analytics, session recording and advertising tools described in Cookies and Trackers We Use, from Leadfeeder for the company a visit comes from, and from service providers that confirm a phone number you enter is valid.

Under the CCPA, you have the following rights:

• Right to know and access. Ask what Personal Information we have collected about you, the categories of sources, why we use it, the categories of third parties we disclose it to and the categories we have sold or shared, and get a copy of the specific pieces of Personal Information we hold about you in a portable format.
• Right to delete. Ask us to delete Personal Information we collected from you, subject to exceptions the law allows, such as completing a transaction, keeping our systems secure or meeting legal obligations.
• Right to correct. Ask us to correct inaccurate Personal Information.
• Right to opt out of sale and sharing. Tell us not to sell or share your Personal Information, including for cross context behavioral advertising.
• Right to limit use of sensitive Personal Information. Direct us to use your sensitive Personal Information only for the purposes the law permits. We already limit our use to those purposes, as described above.
• Right to no retaliation. We will never deny you goods or services, charge you a different price, provide a different level of quality, or retaliate against an employee, applicant or contractor because of a request to exercise these rights.

How to submit a request

• Send a request through our secure contact form.
• Call us toll free at 844-376-2274.
• To opt out of sale and sharing, use Your Privacy Choices in the footer of any page, or turn on Global Privacy Control in your browser.

We confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days. If we need more time, up to another 45 days, we tell you why. We act on opt out requests as soon as feasibly possible and no later than 15 business days, and choices you make in Your Privacy Choices take effect on that browser right away.

Verifying your identity

To protect your information and the integrity of our Products, we verify requests to know, delete and correct by matching details you give us, such as your name, phone number and email address, with information we already hold, and we may call or text you at a number on file to confirm. For specific pieces of information or sensitive information, we may ask for more, such as a signed declaration, or in some cases a government issued ID, which we use only to verify you and delete as soon as practical. Opt out requests do not require verification.

Authorized agents

You may designate an authorized agent to make requests on your behalf. We will ask the agent for your signed permission, and we may ask you to verify your identity directly with us or confirm that you gave the agent permission, unless the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

Minors

We do not sell or share the Personal Information of consumers we know are under 16. Our website is made for businesses and is not directed to minors; see Children’s Privacy.

Records of requests

We keep a record of each request and how we responded for at least 24 months, as the law requires, and use it only for that purpose.

California residents may also ask about our disclosures for direct marketing under California’s Shine the Light law; see California Privacy Rights. If you have additional questions about this Notice or how to exercise your rights under the CCPA, please contact us through our secure contact form or call us toll free at 844-376-2274.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

To restate the same commitment in plain language: we do not share, sell, rent, lease, or otherwise distribute mobile phone numbers, opt-in data, or message content collected for the LeadLocate messaging program to third parties or affiliates for marketing or promotional purposes. Phone numbers and consent information collected for this program are used only to deliver the messages described in our Opt-In Policy and to fulfill our obligations to the consumer as their service provider.

• Mobile phone number. Provided by the consumer through our public sign-up application, a signed written agreement, or a recorded verbal opt-in.
• Opt-in record. The date, time, IP address, and a copy of the consent language the consumer ticked or agreed to.
• Message content and metadata. The body of each message sent or received, the Twilio Message SID, sender and recipient address, delivery status (queued, sent, delivered, read, failed), and any error codes returned by the carrier.
• Opt-out events. The date and time the consumer replied STOP or any equivalent keyword, and the resulting suppression record.

• To deliver the messages the consumer consented to (see our Opt-In Policy for the message-type list).
• To honor opt-out requests across the entire Messaging Service sender pool, so opt-out on the RCS sender also suppresses SMS and MMS fallback messages.
• To respond to support inquiries, fraud reports, or carrier audits.
• To meet legal, regulatory, audit, and dispute-resolution obligations, including CTIA and FCC requirements.
• For internal analytics on aggregate delivery quality (for example, delivery rates and error code distributions). This data is never combined with marketing profiles or shared externally.

We share the minimum necessary data with the following categories of service providers, all of whom are contractually bound to use the data only to provide the messaging service to LeadLocate:

• Twilio, Inc. Our SMS, MMS, and RCS Business Messaging carrier of record and a sub-processor of Google for RCS.
• Google LLC. As the operator of RCS Business Messaging infrastructure, when the recipient message is delivered over RCS.
• Mobile carriers. AT&T, Verizon Wireless, T-Mobile®, Sprint, U.S. Cellular®, Cricket, Boost Mobile, MetroPCS, Google Fi, and other US wireless carriers, only as required to deliver the message to the consumer handset.

To restate the carrier-required commitment more narrowly: all of the categories of data we collect for this program exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services (Twilio, Google, and the mobile carriers above) that are needed to actually deliver the message.

We do not provide phone numbers, opt-in lists, or message content to any other third party for marketing, advertising, retargeting, audience-building, list-rental, or data-broker purposes. We will disclose data only when required by valid legal process (for example, a subpoena or court order), or when reasonably necessary to investigate fraud, protect rights, or prevent serious imminent harm.

Opt-in records, opt-out records, and message delivery logs are retained for the longer of (a) four (4) years from the date of the event or (b) the period required by applicable law and CTIA or carrier audit requirements. Message bodies may be purged earlier where retention is not required for support, billing, or audit purposes.

• Opt out at any time by replying any of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to +1 (844) 376-2274.
• Help. Reply HELP or INFO for support contact information.
• Access and deletion. Consumers may request a copy of, correction of, or deletion of their personal data on file with us through our secure contact form. We honor verified requests under applicable US state privacy laws, including CCPA, CPRA, VCDPA, CPA, CTDPA, and UCPA. The full list of states we honor requests for, and the rights available, is in State Privacy Rights.

We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Mobile phone numbers and opt-in records are stored in encrypted databases hosted in our US data center, accessible only to authorized LeadLocate personnel.

The LeadLocate messaging program is not directed to children under 18. We do not knowingly collect personal data from any individual under 18. If you believe a minor has provided us with their phone number, contact us through our secure contact form and we will delete the record.

LeadLocate may update this Messaging Privacy Notice from time to time. The effective date at the top of this page reflects the most recent update. Material adverse changes will be notified to enrolled consumers at the mobile number on file.

• Contact form: leadlocate.com/sales-leads/contact-us
• Phone: +1 (844) 376-2274
• Web: https://leadlocate.com

LeadLocate operates from the United States of America. This Messaging Privacy Notice applies to the LeadLocate sender +1 (844) 376-2274 and the LeadLocate RCS Business Messaging agent associated with that number. It does not govern messaging traffic that LeadLocate subscribers send to their own customers from their own LeadLocate-provisioned phone numbers. Those programs are governed by each subscriber own privacy notice.

© 2026 LeadLocate™.

LeadLocate is a US business-to-business sales lead generation platform and CRM used by automotive dealerships and independent automotive sales professionals. Our subscribers use LeadLocate to manage their own customer relationships. The LeadLocate messaging program described on this page is the company-to-customer program operated by LeadLocate itself for its own subscribers and prospective subscribers. This program is separate from any messaging traffic our subscribers send to their own customers through the platform.

1. The consumer visits our public website at https://leadlocate.com and clicks Sign Up or Start Free Account, which loads our sign-up application at /sales-leads/new_account.
2. The consumer enters their business name, full name, US business address, email address, and a US mobile phone number capable of receiving text messages. Phone numbers are server-side validated to confirm they are US mobile lines. Landline numbers and non-US numbers are rejected.
3. Directly above the Submit button, the consumer ticks a separate, clearly labeled SMS and RCS consent checkbox that is unchecked by default. The checkbox label names LeadLocate by brand, identifies the message types the consumer will receive, states that message frequency varies, states that message and data rates may apply, instructs the consumer to reply HELP for help and STOP to cancel, and links to this Opt-In Policy, the Messaging Terms, and the Messaging Privacy Notice.
4. After the consumer ticks the SMS consent checkbox, completes Google reCAPTCHA, and clicks the Submit button, LeadLocate records the consent but does not send a text message at that moment. When LeadLocate begins onboarding the application, it sends an automated welcome and account activation message from +1 (844) 376-2274 to the mobile number the consumer provided. This is the first SMS or RCS message that consumer will receive from the program. The consumer may also receive follow-up onboarding messages, billing and account notices, and support replies.
5. No phone number is messaged unless the owner of that number personally submitted it through the form, or, where applicable, through a recorded verbal opt-in during a live sales conversation with our team or through a written agreement signed by the consumer. Consent to receive messages is not required as a condition of any purchase.

Consumers can also opt in through a form on our website, such as a demo, callback or contact request. Every form that asks for a phone number shows the calling and texting consent line described in What the consent moment looks like.

Consent is always clear, specific to LeadLocate, and given by the person who owns the phone number. Here is what it looks like in the two places people opt in.

The sign up application

On step 4 of 4 of our sign up application at leadlocate.com/sales-leads/new_account, the applicant enters a US mobile phone number that can receive text messages. Directly above the Submit Application button is a separate SMS and RCS consent checkbox. It is unchecked by default and is separate from the general User Agreement checkbox. Its label reads:

By checking this box, I agree to receive automated and conversational SMS and RCS text messages from LeadLocate at the mobile number I provided above, including account activation, billing, customer support, and service notices. Message frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

The label links to this Opt-In Policy, the Messaging Terms and the Mobile Messaging Privacy Notice. Consent to receive messages is not required as a condition of any purchase.

Website forms

Every form on our website that asks for a phone number, such as a demo, callback or contact request, shows this line before you submit:

By submitting, you agree LeadLocate may call and text you at this number about your request and our services, including by automated means. Consent is not a condition of purchase. Msg and data rates may apply. Reply STOP to opt out.

Submitting the form with your phone number gives that consent, and we keep a record of when and where it was given. You can withdraw it at any time by replying STOP to any text or by telling us on a call. You are always welcome to reach us without giving consent by calling 844-376-2274. Phone numbers and consent records from these forms are handled under our Mobile Messaging Privacy Notice and are never shared with third parties for their marketing.

• Account notifications. Welcome and activation messages, password resets, billing receipts, payment failures, subscription changes, and scheduled maintenance notices.
• Customer support. Conversational replies to questions the consumer texts in to the LeadLocate sender, scheduling a support callback, or follow-up after a support ticket.
• Service notices. Product changes, security advisories, training reminders, and notices required by law or by our terms.
• Conversational sales. When a prospect requests a demo through our website or by calling our number, our sales representatives reply by text and continue the conversation by text when the consumer responds.

We do not send sweepstakes, lottery, age-gated, adult, cannabis, firearms, hate speech, or other CTIA SHAFT category content from this sender.

Message frequency varies based on the consumer relationship with us. A typical onboarding flow is 3 to 5 messages in the first week, then occasional account and support messages thereafter. Msg & data rates may apply per the consumer mobile carrier plan. LeadLocate does not impose any additional charge on the recipient for messages we send.

This program is operated using Twilio Programmable Messaging and Twilio RCS Business Messaging. RCS messages are delivered through carrier RCS Business Messaging where the recipient device and network support it. On devices or networks without RCS support, messages automatically fall back to SMS or MMS. Carriers are not liable for any delayed or undelivered messages.

The consumer can opt out at any time by replying any of the following keywords (case-insensitive) to +1 (844) 376-2274:

STOP  STOPALL  UNSUBSCRIBE  CANCEL  END  QUIT

The consumer will receive one final confirmation message:

All further messages from this sender are then suppressed for that mobile number, including SMS and MMS fallback messages from this Messaging Service. Twilio Advanced Opt-Out is enabled on the assigned Messaging Service, so the suppression applies across the entire sender pool, not just the RCS sender.

Replying HELP or INFO returns:

Replying START, UNSTOP, or YES resubscribes the user and returns:

We do not share, sell, rent, or otherwise distribute mobile phone numbers, opt-in data, or message content to third parties or affiliates for marketing or promotional purposes.

Phone numbers collected through the opt-in described here are used only to deliver the message types listed above and to fulfill our obligations to the consumer as their service provider. See the full Messaging Privacy Notice for details, including our exact no-sharing language for messaging originator opt-in data.

Questions about this Opt-In Policy or the LeadLocate messaging program can be sent to:

• Contact form: leadlocate.com/sales-leads/contact-us
• Phone: +1 (844) 376-2274
• Web: https://leadlocate.com

LeadLocate operates from the United States of America. This Opt-In Policy applies to the LeadLocate sender +1 (844) 376-2274 and the LeadLocate RCS Business Messaging agent associated with that number. It does not govern messaging traffic that our subscribers (dealerships and salespeople) send to their own customers from their own LeadLocate-provisioned phone numbers. Those programs are governed by each subscriber own opt-in policies.

© 2026 LeadLocate™.

LeadLocate is a customer relationship management, lead management, communications, reporting, and dealer workflow platform operated by DotNet Holdings LLC DBA: LeadLocate. The platform handles business customer information, end-user contact information, lead details, communication metadata, and, where enabled by a customer and consented to by the consumer, financial account, identity, income, statement, enrichment, and verification data retrieved through authorized financial data providers.

This Information Security Policy establishes the administrative, technical, and operational controls used to preserve the confidentiality, integrity, availability, and privacy of data processed by LeadLocate. The policy is written for diligence review by banks, lenders, financial technology partners, data providers, security reviewers, customers, and auditors. It intentionally avoids publishing sensitive implementation details, secrets, IP addresses, credentials, and architecture diagrams that could weaken security.

Organization

DotNet Holdings LLC DBA: LeadLocate

Primary Security Contact

leadlocate.com/sales-leads/contact-us

Effective Date

April 24, 2026

Review Cadence

At least annually and upon material system, vendor, or regulatory change

TLS 1.2+

Encryption at Rest

MFA for Critical Systems

Least Privilege

Vulnerability Remediation SLA

Data Retention Controls

Security notices, diligence requests, vulnerability reports, privacy requests, and incident communications should be sent to the monitored compliance mailbox below. The mailbox is reviewed by General Counsel and authorized operations resources responsible for security, privacy, and platform reliability.

The table below maps common bank, lender, fintech, and data-provider security diligence questions to LeadLocate's current security practice and supporting documentation location in this policy packet.

LeadLocate maintains an operational information security program appropriate to the size, complexity, and risk profile of the business. The program is overseen by company leadership and implemented through policies, procedures, technical controls, vendor management, access governance, vulnerability management, incident response, and periodic review.

Security Objectives

• Protect the confidentiality of customer, consumer, financial, and operational data.
• Maintain the integrity of LeadLocate systems, lead records, communications, reports, workflows, and financial data integrations.
• Maintain appropriate availability of production systems through monitoring, backups, operational response, and change controls.
• Limit access to sensitive data to authorized personnel with a documented business need.
• Collect, use, retain, and dispose of personal information in accordance with applicable law, customer instructions, and stated privacy commitments.
• Continuously improve the security program based on incidents, threat intelligence, vendor changes, product changes, and compliance requirements.

Risk Identification and Review

Security and privacy risks are identified through architecture review, code review, production monitoring, vulnerability scans, dependency updates, vendor diligence, customer feedback, incident review, and legal or regulatory changes. Risks are evaluated based on likelihood, potential business impact, sensitivity of data involved, exploitability, compensating controls, and remediation complexity.

Material risks are assigned to a responsible party and tracked to remediation, acceptance, transfer, or mitigation. High-impact risks involving consumer financial data, authentication, encryption, tenant isolation, production access, or external integrations receive priority review.

Policy Review and Exceptions

This policy is reviewed at least annually and when there are material changes to LeadLocate products, financial data integration scope, hosting environment, authentication model, vendor relationships, data processing activities, or applicable legal requirements. Exceptions must be documented, time-bound, risk accepted by General Counsel, and remediated or renewed before expiration.

LeadLocate's security and privacy program is designed to support common U.S. requirements and diligence expectations for organizations handling consumer financial data, personal information, identity verification information, income information, statements, and related enrichment or fraud-prevention signals. Applicability depends on the customer, product configuration, data source, contract, and the role LeadLocate plays in the workflow.

Scope note: This policy is a security and privacy control document. It is intended for partner diligence and operational compliance support. Workflow-specific legal requirements are reviewed with counsel and addressed in the applicable customer agreement, data processing terms, consent language, and workflow configuration.

LeadLocate applies least privilege, role-based access, named user accountability, and MFA to limit access to production assets and sensitive data. Shared production access is avoided wherever practical. Access is granted based on job responsibility, reviewed periodically, and removed when no longer needed.

Least Privilege

Users receive only the access required for their role and assigned work.

Named Accounts

Production and administrative actions are attributable to authorized users.

MFA

Critical systems and financial data workflows require MFA controls.

Access Review

Privileged access is periodically reviewed and removed when no longer justified.

Session Protection

Authenticated areas use session controls to reduce unauthorized access risk.

Tenant Isolation

Application authorization checks restrict users to their permitted company data.

Consumer MFA Before Sensitive Financial Workflows

For financial account, income, identity, statement, and verification workflows, LeadLocate requires the consumer to be in an authenticated and MFA-verified flow before sensitive steps are presented. This reduces the risk that a person without appropriate control of the account or session can initiate a financial institution connection or identity verification event. Where supported by the user's device and browser, phishing-resistant factors such as passkeys, biometrics, or platform authenticators are preferred.

Administrative MFA

Access to critical systems that store, process, transmit, deploy, back up, or administer consumer financial data requires MFA. This includes administrative application access, hosting/control panel access, source control, vendor administration consoles, and privileged infrastructure tools. Administrative access is not granted to general users and is limited to authorized personnel.

Account Lifecycle

• Access requests must have a business justification and role assignment.
• Privileged access is limited to personnel who require it for operations, security, support, or maintenance.
• Access is removed or disabled upon role change, termination, vendor offboarding, or loss of business need.
• Credential sharing is prohibited for production and security-sensitive systems.
• Passwords, API keys, provider credentials, tokens, private keys, and secrets must not be sent through insecure channels or stored in plaintext.

LeadLocate uses layered controls to protect production systems and sensitive data. Controls include HTTPS, certificate management, managed hosting protections, network restrictions, system hardening, vulnerability monitoring, logging, backups, and administrative access controls.

Encryption in Transit

LeadLocate uses HTTPS with valid certificates for web application traffic and requires TLS 1.2 or better for client-server communications involving sensitive data. Plain HTTP is not used for transmission of consumer financial data. Financial data provider API communications are made over encrypted channels and follow the provider's production security requirements.

Encryption at Rest

Consumer financial, identity, income, statement, enrichment, and verification data is encrypted at rest. Access tokens, secrets, and sensitive financial values are protected using encryption, restricted storage locations, and access controls. Backups containing sensitive data are subject to the same retention, access, and disposal requirements as production data.

Network and Host Protections

• Production systems are administered by authorized personnel only.
• Administrative access paths are restricted and protected by MFA where supported.
• Unnecessary services are disabled or removed where practical.
• Security updates are applied based on severity and operational risk.
• Logs are used to support troubleshooting, anomaly review, security investigation, and auditability.
• Backups are maintained to support recovery from accidental deletion, corruption, operational failure, or security incidents.

LeadLocate treats consumer financial, identity, income, statement, enrichment, and verification data as highly sensitive. The platform only requests, processes, and stores data necessary to provide the specific product feature authorized by the consumer and enabled by the customer.

Data Minimization

Financial data workflows are designed to request only the product scopes and data elements needed for the business purpose. LeadLocate does not request consumer financial institution credentials directly from the consumer, does not ask consumers to provide bank passwords directly to LeadLocate, and does not sell consumer financial data.

Consent and Authorization

Consumers authorize financial account connections, identity checks, document parsing, income verification, enrichment, and fraud review through the applicable consent and permission flow. LeadLocate records or relies on the consent event and uses the resulting tokens, account data, documents, verification data, or derived results only for the authorized workflow. If a consumer withdraws consent or requests deletion, LeadLocate follows the retention and deletion procedure in this policy, subject to legal, fraud prevention, dispute, accounting, or security obligations.

Token and Secret Protection

• Provider client secrets, API keys, access tokens, and refresh tokens are treated as secrets.
• Secrets are never committed to public source code repositories or shared in plaintext support channels.
• Secrets and tokens are encrypted or stored in restricted secret storage appropriate to the environment.
• Access to financial data provider credentials is limited to authorized personnel with a business need.
• Suspected exposure of a credential or token triggers incident response, rotation, and review.

Use Limitation

Financial data is used only to deliver the consumer-permissioned LeadLocate function, support the customer relationship, meet compliance obligations, prevent fraud or abuse, troubleshoot integration issues, and maintain security. It is not used for unrelated advertising, resale, or non-consented secondary purposes.

LeadLocate applies secure development practices to reduce security defects before deployment and to remediate vulnerabilities after discovery. The program covers application code, dependencies, server software, employee and contractor machines, and production assets.

Secure Development Practices

• Security-sensitive changes receive review for authorization, tenant isolation, input validation, output encoding, access control, logging, error handling, and data exposure.
• Secrets must not be hard-coded into application code or committed to repositories.
• Production changes are scoped, tested, and deployed in a manner designed to minimize service disruption.
• Customer and consumer data is not used in local development unless needed for support or testing and protected appropriately.
• New integrations that handle sensitive data are reviewed for privacy, security, data flow, and vendor risk before production use.

Vulnerability Scanning and Patch SLAs

LeadLocate performs vulnerability monitoring and scanning for production assets and employee or contractor machines. Identified vulnerabilities are evaluated and remediated according to severity, exploitability, exposure, and data sensitivity.

Remediation Verification

Remediation may be verified through patch confirmation, configuration review, code review, retesting, vulnerability scan results, log review, or vendor attestation. Exceptions require a documented compensating control and risk acceptance.

LeadLocate publishes a privacy policy for applications where consumer data and financial data workflows are deployed. The policy is available to end users at https://leadlocate.com/sales-leads/privacy-policy.

LeadLocate obtains consumer consent before collecting, processing, storing, or using consumer data in workflows where consent is required. Financial account, identity, income, statement, enrichment, document parsing, and fraud-review workflows present consumer-facing permission language that identifies the data access and purpose being authorized. LeadLocate relies on the consumer's authorization and uses the data only for the stated purpose.

Privacy Commitments

• Collect only the personal and financial data reasonably necessary for the requested service.
• Use consumer financial data only for the consumer-authorized LeadLocate function.
• Restrict access to personal and financial data based on role and business need.
• Provide a channel for privacy, deletion, and compliance requests through our secure contact form.
• Retain data only as long as needed for business, legal, security, fraud prevention, dispute, accounting, or customer support purposes.
• Delete, de-identify, or securely dispose of data when retention is no longer required.

LeadLocate maintains a defined and enforced data retention and disposal policy for personal information, customer data, lead data, operational records, logs, backups, and consumer financial data. The goal is to retain data only for as long as it is needed to provide services, support customers, comply with legal obligations, resolve disputes, prevent fraud or abuse, maintain security, and operate the business.

Retention Principles

• Data is retained for the shortest practical period consistent with service delivery, customer instructions, legal obligations, security needs, and operational continuity.
• Consumer financial, identity, income, statement, enrichment, and verification data is retained only for the authorized purpose and removed or de-identified when no longer required.
• Deletion requests are evaluated promptly and completed unless retention is required for legal, fraud prevention, dispute, security, billing, accounting, backup integrity, or other legitimate obligations.
• Backups are retained for limited recovery windows and age out through normal backup rotation.
• Data subject to legal hold, investigation, fraud prevention, abuse prevention, or active dispute may be retained until the hold or need is resolved.

Deletion Request Procedure

• Receive deletion request through the application, customer support, or our secure contact form.
• Verify the requester's authority to request deletion for the relevant account, company, or consumer data.
• Identify systems, records, financial data connections, identity verification records, backups, vendors, and logs reasonably in scope.
• Delete, de-identify, restrict, or export and remove the applicable data unless a valid retention exception applies.
• Document completion, exception, or denial reason as appropriate.

Financial data deletion: If a financial data connection or verification workflow is terminated or no longer needed, LeadLocate will stop using the associated data, remove or revoke stored tokens where applicable, and delete or de-identify retained consumer financial data except where legally or operationally required to retain it.

LeadLocate maintains an incident response process for suspected or confirmed security events affecting production systems, customer data, consumer financial data, credentials, vendor integrations, or availability. The process is designed to contain events quickly, preserve evidence, restore service, communicate appropriately, and reduce the likelihood of recurrence.

Incident Response Phases

• Identify: Receive signal from monitoring, alerts, support reports, vulnerability disclosures, logs, vendors, or employees.
• Triage: Assess severity, affected systems, data sensitivity, active exploitation, customer impact, and regulatory or contractual obligations.
• Contain: Disable compromised credentials, isolate affected components, block malicious activity, rotate keys or tokens, and restrict access as needed.
• Eradicate and recover: Patch defects, remove unauthorized access, restore affected services, verify integrity, and monitor for recurrence.
• Notify: Provide required notifications to customers, partners, regulators, financial data providers, or consumers according to applicable law and contract.
• Improve: Document lessons learned, update controls, strengthen monitoring, and track remediation items to closure.

Security Event Monitoring

Logs and operational signals are reviewed to support troubleshooting, anomaly detection, abuse prevention, and incident investigation. Sensitive operational logs are restricted to authorized personnel and retained according to the data retention policy.

This page is intended to be printed or saved as the primary Information Security Policy and Data Retention and Disposal Policy documentation. Banks, lenders, data providers, and financial technology partners may request screenshots or additional records for MFA, encryption, vulnerability management, privacy, or incident response evidence. Screenshots should be attached separately when visual proof of a live control is requested.

DotNet Holdings LLC DBA: LeadLocate attests that it maintains a documented and operational information security program designed to identify, mitigate, and monitor information security risks relevant to its business and to protect consumer data handled through financial account, identity, income, statement, enrichment, document parsing, fraud review, and verification workflows.

LeadLocate further attests that it will review and remediate partner-identified gaps in its security practices as applicable after completion of security diligence.

Policy Contact

General Counsel

DotNet Holdings LLC DBA: LeadLocate

leadlocate.com/sales-leads/contact-us

Version and Approval

Version: 1.0

Effective date: April 24, 2026

Approved by: General Counsel

Next review: April 24, 2027 or earlier upon material change

LeadLocate Information Security Policy | Public diligence copy | Questions: secure contact form