All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

To restate the same commitment in plain language: we do not share, sell, rent, lease, or otherwise distribute mobile phone numbers, opt-in data, or message content collected for the LeadLocate messaging program to third parties or affiliates for marketing or promotional purposes. Phone numbers and consent information collected for this program are used only to deliver the messages described in our Opt-In Policy and to fulfill our obligations to the consumer as their service provider.

We share the minimum necessary data with the following categories of service providers, all of whom are contractually bound to use the data only to provide the messaging service to LeadLocate:

To restate the carrier-required commitment more narrowly: all of the categories of data we collect for this program exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services (Twilio, Google, and the mobile carriers above) that are needed to actually deliver the message.

We do not provide phone numbers, opt-in lists, or message content to any other third party for marketing, advertising, retargeting, audience-building, list-rental, or data-broker purposes. We will disclose data only when required by valid legal process (for example, a subpoena or court order), or when reasonably necessary to investigate fraud, protect rights, or prevent serious imminent harm.

Opt-in records, opt-out records, and message delivery logs are retained for the longer of (a) four (4) years from the date of the event or (b) the period required by applicable law and CTIA or carrier audit requirements. Message bodies may be purged earlier where retention is not required for support, billing, or audit purposes.

We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Mobile phone numbers and opt-in records are stored in encrypted databases hosted in our US data center, accessible only to authorized LeadLocate personnel.

The LeadLocate messaging program is not directed to children under 18. We do not knowingly collect personal data from any individual under 18. If you believe a minor has provided us with their phone number, contact us at help@leadlocate.com and we will delete the record.

LeadLocate may update this Messaging Privacy Notice from time to time. The effective date at the top of this page reflects the most recent update. Material adverse changes will be notified to enrolled consumers at the mobile number on file.

LeadLocate operates from the United States of America. This Messaging Privacy Notice applies to the LeadLocate sender +1 (844) 376-2274 and the LeadLocate RCS Business Messaging agent associated with that number. It does not govern messaging traffic that LeadLocate subscribers send to their own customers from their own LeadLocate-provisioned phone numbers. Those programs are governed by each subscriber own privacy notice.

© 2026 LeadLocate®.

LeadLocate is a US business-to-business sales-prospecting platform and CRM used by automotive dealerships and independent automotive sales professionals. Our subscribers use LeadLocate to manage their own customer relationships. The LeadLocate messaging program described on this page is the company-to-customer program operated by LeadLocate itself for its own subscribers and prospective subscribers. This program is separate from any messaging traffic our subscribers send to their own customers through the platform.

leadlocate.com/sales-leads/new_account

Step 4 of 4: Confirm and submit

Mobile phone (US only, must receive text messages) *

Business email *

By checking this box and submitting, I agree to receive automated and conversational SMS and RCS text messages from LeadLocate at the mobile number I provided above,

including account activation, billing, support, and service notices. Message frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

See the Opt-In Policy, Messaging Terms, and Messaging Privacy Notice. Consent to receive messages is not required as a condition of any purchase.

Submit Application

Illustration of the SMS and RCS consent moment on the live sign-up form at leadlocate.com/sales-leads/new_account. The checkbox is unchecked by default and is separate from the general User Agreement checkbox.

We do not send sweepstakes, lottery, age-gated, adult, cannabis, firearms, hate speech, or other CTIA SHAFT category content from this sender.

Message frequency varies based on the consumer relationship with us. A typical onboarding flow is 3 to 5 messages in the first week, then occasional account and support messages thereafter. Msg & data rates may apply per the consumer mobile carrier plan. LeadLocate does not impose any additional charge on the recipient for messages we send.

This program is operated using Twilio Programmable Messaging and Twilio RCS Business Messaging. RCS messages are delivered through carrier RCS Business Messaging where the recipient device and network support it. On devices or networks without RCS support, messages automatically fall back to SMS or MMS. Carriers are not liable for any delayed or undelivered messages.

The consumer can opt out at any time by replying any of the following keywords (case-insensitive) to +1 (844) 376-2274:

STOP  STOPALL  UNSUBSCRIBE  CANCEL  END  QUIT

The consumer will receive one final confirmation message:

All further messages from this sender are then suppressed for that mobile number, including SMS and MMS fallback messages from this Messaging Service. Twilio Advanced Opt-Out is enabled on the assigned Messaging Service, so the suppression applies across the entire sender pool, not just the RCS sender.

Replying HELP or INFO returns:

Replying START, UNSTOP, or YES resubscribes the user and returns:

We do not share, sell, rent, or otherwise distribute mobile phone numbers, opt-in data, or message content to third parties or affiliates for marketing or promotional purposes.

Phone numbers collected through the opt-in described here are used only to deliver the message types listed above and to fulfill our obligations to the consumer as their service provider. See the full Messaging Privacy Notice for details, including our exact no-sharing language for messaging originator opt-in data.

Questions about this Opt-In Policy or the LeadLocate messaging program can be sent to:

LeadLocate operates from the United States of America. This Opt-In Policy applies to the LeadLocate sender +1 (844) 376-2274 and the LeadLocate RCS Business Messaging agent associated with that number. It does not govern messaging traffic that our subscribers (dealerships and salespeople) send to their own customers from their own LeadLocate-provisioned phone numbers. Those programs are governed by each subscriber own opt-in policies.

© 2026 LeadLocate®.

LeadLocate is a customer relationship management, lead management, communications, reporting, and dealer workflow platform operated by DotNet Holdings LLC DBA: LeadLocate. The platform handles business customer information, end-user contact information, lead details, communication metadata, and, where enabled by a customer and consented to by the consumer, financial account, identity, income, statement, enrichment, and verification data retrieved through authorized financial data providers.

This Information Security Policy establishes the administrative, technical, and operational controls used to preserve the confidentiality, integrity, availability, and privacy of data processed by LeadLocate. The policy is written for diligence review by banks, lenders, financial technology partners, data providers, security reviewers, customers, and auditors. It intentionally avoids publishing sensitive implementation details, secrets, IP addresses, credentials, and architecture diagrams that could weaken security.

Organization

DotNet Holdings LLC DBA: LeadLocate

Primary Security Contact

compliance@dotnetholdings.com

Effective Date

April 24, 2026

Review Cadence

At least annually and upon material system, vendor, or regulatory change

TLS 1.2+

Encryption at Rest

MFA for Critical Systems

Least Privilege

Vulnerability Remediation SLA

Data Retention Controls

Security notices, diligence requests, vulnerability reports, privacy requests, and incident communications should be sent to the monitored compliance mailbox below. The mailbox is reviewed by General Counsel and authorized operations resources responsible for security, privacy, and platform reliability.

Name

Title

Email

Responsibility

General Counsel

General Counsel

compliance@dotnetholdings.com

Primary resource for information security, privacy, compliance diligence, vendor risk, and security exceptions.

The table below maps common bank, lender, fintech, and data-provider security diligence questions to LeadLocate's current security practice and supporting documentation location in this policy packet.

Area

Question

LeadLocate Response

Supporting Detail

Governance

Security contact information

Provided

General Counsel, compliance@dotnetholdings.com. See Section 2.

Governance

Documented and operationalized information security policy

Yes

This document is LeadLocate's Information Security Policy and describes operational controls for identifying, mitigating, and monitoring risks.

Identity and Access

Access controls limiting access to production assets and sensitive data

Centralized identity and least privilege

Production access is restricted to authorized personnel, managed through named accounts, role-based access, least privilege, logging, and review.

Identity and Access

MFA for consumers before financial data connection or identity verification

Yes

Consumer financial data and identity verification workflows require an authenticated, MFA-verified session before a consumer can connect financial accounts or complete sensitive verification steps. Screenshot evidence can be attached separately when a reviewer requests visual evidence.

Identity and Access

MFA for critical systems that store or process consumer financial data

Yes

Critical administrative, hosting, source control, and production access paths require MFA and are limited to authorized personnel.

Infrastructure

TLS 1.2 or better between clients and servers

Yes

LeadLocate uses HTTPS with valid certificates and requires TLS 1.2 or better for client-server communications involving sensitive data.

Infrastructure

Encryption of consumer financial data at rest

Yes

Consumer financial, identity, income, statement, and verification data is encrypted at rest. Tokens, secrets, and sensitive financial values are not stored in plaintext.

Vulnerability Management

Vulnerability scans and patching for employee/contractor machines and production assets

Yes

LeadLocate performs vulnerability monitoring and applies remediation based on severity-defined SLAs.

Privacy

Privacy policy for applications where financial data connections are deployed

Yes

Published at https://leadlocate.com/sales-leads/privacy-policy.

Privacy

Consumer consent for collection, processing, and storage

Yes

Financial data connections are presented only in consent-based workflows, and consumers authorize the specific institution connection, data sharing, and use case before data is accessed.

Privacy

Defined and enforced data deletion and retention policy

Yes

See Section 11, Data Retention and Disposal Policy.

LeadLocate maintains an operational information security program appropriate to the size, complexity, and risk profile of the business. The program is overseen by company leadership and implemented through policies, procedures, technical controls, vendor management, access governance, vulnerability management, incident response, and periodic review.

Security Objectives

Risk Identification and Review

Security and privacy risks are identified through architecture review, code review, production monitoring, vulnerability scans, dependency updates, vendor diligence, customer feedback, incident review, and legal or regulatory changes. Risks are evaluated based on likelihood, potential business impact, sensitivity of data involved, exploitability, compensating controls, and remediation complexity.

Material risks are assigned to a responsible party and tracked to remediation, acceptance, transfer, or mitigation. High-impact risks involving consumer financial data, authentication, encryption, tenant isolation, production access, or external integrations receive priority review.

Policy Review and Exceptions

This policy is reviewed at least annually and when there are material changes to LeadLocate products, financial data integration scope, hosting environment, authentication model, vendor relationships, data processing activities, or applicable legal requirements. Exceptions must be documented, time-bound, risk accepted by General Counsel, and remediated or renewed before expiration.

LeadLocate's security and privacy program is designed to support common U.S. requirements and diligence expectations for organizations handling consumer financial data, personal information, identity verification information, income information, statements, and related enrichment or fraud-prevention signals. Applicability depends on the customer, product configuration, data source, contract, and the role LeadLocate plays in the workflow.

Requirement or Framework

LeadLocate Alignment

Policy Coverage

GLBA Safeguards Rule

Maintains administrative, technical, and operational safeguards for customer information, including access controls, encryption, risk review, vulnerability management, incident response, and vendor oversight.

Sections 4 through 12

GLBA Privacy Rule and customer notice obligations

Uses consumer notice, consent, purpose limitation, privacy-policy publication, and data-retention controls for financial data workflows.

Sections 10 and 11

FTC Act, unfair or deceptive acts or practices

Requires accurate public security statements, appropriate safeguards, limited use of data, and incident response for suspected unauthorized access.

Sections 1, 4, 8, 10, and 12

FCRA, where applicable

Where data is used for eligibility, underwriting, employment, tenant screening, or another regulated consumer-report purpose, LeadLocate supports customer-required permissible purpose, use limitation, access restriction, retention, and deletion controls. Customers remain responsible for their own adverse action and end-user legal obligations unless contractually assigned otherwise.

Sections 6, 8, 10, and 11

State privacy laws, including CCPA/CPRA where applicable

Supports notice, consent, data minimization, deletion, access restriction, purpose limitation, and service-provider style processing obligations when required by contract.

Sections 10 and 11

State data breach notification laws

Maintains incident triage, containment, investigation, documentation, and notification procedures for suspected unauthorized access to protected personal information.

Section 12

Bank, lender, and fintech vendor-risk expectations

Provides documented governance, MFA, least privilege, TLS, encryption at rest, vulnerability management, secure development, data retention, vendor oversight, and evidence checklist controls.

Sections 2 through 13

Scope note: This policy is a security and privacy control document. It is intended for partner diligence and operational compliance support. Workflow-specific legal requirements are reviewed with counsel and addressed in the applicable customer agreement, data processing terms, consent language, and workflow configuration.

LeadLocate applies least privilege, role-based access, named user accountability, and MFA to limit access to production assets and sensitive data. Shared production access is avoided wherever practical. Access is granted based on job responsibility, reviewed periodically, and removed when no longer needed.

Least Privilege

Users receive only the access required for their role and assigned work.

Named Accounts

Production and administrative actions are attributable to authorized users.

MFA

Critical systems and financial data workflows require MFA controls.

Access Review

Privileged access is periodically reviewed and removed when no longer justified.

Session Protection

Authenticated areas use session controls to reduce unauthorized access risk.

Tenant Isolation

Application authorization checks restrict users to their permitted company data.

Consumer MFA Before Sensitive Financial Workflows

For financial account, income, identity, statement, and verification workflows, LeadLocate requires the consumer to be in an authenticated and MFA-verified flow before sensitive steps are presented. This reduces the risk that a person without appropriate control of the account or session can initiate a financial institution connection or identity verification event. Where supported by the user's device and browser, phishing-resistant factors such as passkeys, biometrics, or platform authenticators are preferred.

Administrative MFA

Access to critical systems that store, process, transmit, deploy, back up, or administer consumer financial data requires MFA. This includes administrative application access, hosting/control panel access, source control, vendor administration consoles, and privileged infrastructure tools. Administrative access is not granted to general users and is limited to authorized personnel.

Account Lifecycle

LeadLocate uses layered controls to protect production systems and sensitive data. Controls include HTTPS, certificate management, managed hosting protections, network restrictions, system hardening, vulnerability monitoring, logging, backups, and administrative access controls.

Encryption in Transit

LeadLocate uses HTTPS with valid certificates for web application traffic and requires TLS 1.2 or better for client-server communications involving sensitive data. Plain HTTP is not used for transmission of consumer financial data. Financial data provider API communications are made over encrypted channels and follow the provider's production security requirements.

Encryption at Rest

Consumer financial, identity, income, statement, enrichment, and verification data is encrypted at rest. Access tokens, secrets, and sensitive financial values are protected using encryption, restricted storage locations, and access controls. Backups containing sensitive data are subject to the same retention, access, and disposal requirements as production data.

Network and Host Protections

and Controls

LeadLocate treats consumer financial, identity, income, statement, enrichment, and verification data as highly sensitive. The platform only requests, processes, and stores data necessary to provide the specific product feature authorized by the consumer and enabled by the customer.

Data Minimization

Financial data workflows are designed to request only the product scopes and data elements needed for the business purpose. LeadLocate does not request consumer financial institution credentials directly from the consumer, does not ask consumers to provide bank passwords directly to LeadLocate, and does not sell consumer financial data.

Consent and Authorization

Consumers authorize financial account connections, identity checks, document parsing, income verification, enrichment, and fraud review through the applicable consent and permission flow. LeadLocate records or relies on the consent event and uses the resulting tokens, account data, documents, verification data, or derived results only for the authorized workflow. If a consumer withdraws consent or requests deletion, LeadLocate follows the retention and deletion procedure in this policy, subject to legal, fraud prevention, dispute, accounting, or security obligations.

Token and Secret Protection

Use Limitation

Financial data is used only to deliver the consumer-permissioned LeadLocate function, support the customer relationship, meet compliance obligations, prevent fraud or abuse, troubleshoot integration issues, and maintain security. It is not used for unrelated advertising, resale, or non-consented secondary purposes.

LeadLocate applies secure development practices to reduce security defects before deployment and to remediate vulnerabilities after discovery. The program covers application code, dependencies, server software, employee and contractor machines, and production assets.

Secure Development Practices

Vulnerability Scanning and Patch SLAs

LeadLocate performs vulnerability monitoring and scanning for production assets and employee or contractor machines. Identified vulnerabilities are evaluated and remediated according to severity, exploitability, exposure, and data sensitivity.

Severity

Target Remediation SLA

Examples

Critical

As soon as practicable, target within 7 calendar days

Known exploited remote code execution, exposed secret, authentication bypass, active compromise indicator.

High

Target within 30 calendar days

Privilege escalation, sensitive data exposure, serious dependency issue, externally reachable high-risk service.

Medium

Target within 60 calendar days

Moderate dependency vulnerability, configuration weakness with compensating controls, limited exploitability issue.

Low

Target within 90 calendar days or scheduled maintenance

Low-risk hardening item, informational finding, defense-in-depth improvement.

Remediation Verification

Remediation may be verified through patch confirmation, configuration review, code review, retesting, vulnerability scan results, log review, or vendor attestation. Exceptions require a documented compensating control and risk acceptance.

LeadLocate publishes a privacy policy for applications where consumer data and financial data workflows are deployed. The policy is available to end users at https://leadlocate.com/sales-leads/privacy-policy.

LeadLocate obtains consumer consent before collecting, processing, storing, or using consumer data in workflows where consent is required. Financial account, identity, income, statement, enrichment, document parsing, and fraud-review workflows present consumer-facing permission language that identifies the data access and purpose being authorized. LeadLocate relies on the consumer's authorization and uses the data only for the stated purpose.

Privacy Commitments

LeadLocate maintains a defined and enforced data retention and disposal policy for personal information, customer data, lead data, operational records, logs, backups, and consumer financial data. The goal is to retain data only for as long as it is needed to provide services, support customers, comply with legal obligations, resolve disputes, prevent fraud or abuse, maintain security, and operate the business.

Retention Principles

Data Category

Typical Retention

Disposal Method

Consumer financial, income, and statement data

Only as long as needed for the consumer-authorized feature, customer support, legal, fraud prevention, or security purpose.

Delete, revoke access where applicable, de-identify, or cryptographically render inaccessible according to system capability.

Provider tokens and secrets

Only while the integration or consumer-authorized connection remains active and needed.

Revoke, rotate, delete encrypted records, and invalidate application references.

CRM lead and customer records

Retained while the customer account is active or as needed for business records, support, legal obligations, and customer instructions.

Delete, archive, anonymize, or export and remove upon verified customer request where permitted.

Application logs and security events

Retained for troubleshooting, monitoring, fraud prevention, incident investigation, and auditability.

Rotate, expire, aggregate, or securely delete according to operational retention windows.

Backups

Retained for disaster recovery and operational resilience according to backup rotation schedules.

Automatic expiration, secure deletion of backup media, or destruction by hosting/vendor process.

Vendor, billing, and compliance records

Retained as required for tax, accounting, legal, contract, audit, and business purposes.

Secure deletion or archival disposal after retention need expires.

Deletion Request Procedure

Financial data deletion: If a financial data connection or verification workflow is terminated or no longer needed, LeadLocate will stop using the associated data, remove or revoke stored tokens where applicable, and delete or de-identify retained consumer financial data except where legally or operationally required to retain it.

and Monitoring

LeadLocate maintains an incident response process for suspected or confirmed security events affecting production systems, customer data, consumer financial data, credentials, vendor integrations, or availability. The process is designed to contain events quickly, preserve evidence, restore service, communicate appropriately, and reduce the likelihood of recurrence.

Incident Response Phases

Security Event Monitoring

Logs and operational signals are reviewed to support troubleshooting, anomaly detection, abuse prevention, and incident investigation. Sensitive operational logs are restricted to authorized personnel and retained according to the data retention policy.

for Partner Diligence

This page is intended to be printed or saved as the primary Information Security Policy and Data Retention and Disposal Policy documentation. Banks, lenders, data providers, and financial technology partners may request screenshots or additional records for MFA, encryption, vulnerability management, privacy, or incident response evidence. Screenshots should be attached separately when visual proof of a live control is requested.

Evidence Item

Status

Recommended Attachment or Link

Information Security Policy

This page

Print or save this document as PDF using the button at the top.

Data Retention and Disposal Policy

Included

Section 11 of this document.

Consumer MFA screenshot before financial data connection

Attach screenshot

Capture the consumer-facing MFA step before a financial account connection, identity verification, income verification, document parsing, or similar sensitive workflow is opened.

Administrative/critical system MFA screenshot

Attach screenshot

Capture the MFA requirement for the administrative or critical system used for sensitive financial data operations.

Privacy Policy URL

Available

https://leadlocate.com/sales-leads/privacy-policy

DotNet Holdings LLC DBA: LeadLocate attests that it maintains a documented and operational information security program designed to identify, mitigate, and monitor information security risks relevant to its business and to protect consumer data handled through financial account, identity, income, statement, enrichment, document parsing, fraud review, and verification workflows.

LeadLocate further attests that it will review and remediate partner-identified gaps in its security practices as applicable after completion of security diligence.

Policy Contact

General Counsel

DotNet Holdings LLC DBA: LeadLocate

compliance@dotnetholdings.com

Version and Approval

Version: 1.0

Effective date: April 24, 2026

Approved by: General Counsel

Next review: April 24, 2027 or earlier upon material change

LeadLocate Information Security Policy | Public diligence copy | Questions: compliance@dotnetholdings.com