Privacy Policy

Effective Date: July 6, 2026
Version: 2.0

1. Introduction

This Privacy Policy describes how VaultMotive, LLC ("VaultMotive", "we", "us", or "our") collects, uses, shares, and protects personal information when you use our vehicle documentation and business management platform, our mobile applications, and our websites (together, the "Service"). It also describes the choices and rights available to you.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. This Policy is incorporated into our Terms of Service.

2. Our Roles: Controller and Processor

VaultMotive is used by businesses (such as restoration shops and brokers) and by individual enthusiasts. Depending on the data, we act in one of two roles:

• VaultMotive as controller. For your account registration data, billing records, marketing preferences, support communications, and usage analytics, we decide how and why the data is processed.
• VaultMotive as processor.For personal information contained in the content our customers upload or enter — for example, a shop's records about its own clients, vehicle owners, consignors, or vendors — we process that data on the customer's behalf and under their instructions. The customer organization is the controller of that data.

3. Information We Collect

3.1 Information You Provide

• Account information: name, email address, password, phone number (optional, for SMS features and multi-factor authentication), and profile details.
• Organization information: business name, address, team member names and email addresses, roles, and permissions.
• Content you upload: vehicle photos and videos, documents (titles, registrations, receipts, invoices, service records), voice notes, and notes. Uploaded documents and images may themselves contain personal information (for example, a name and address on an invoice) and photos may include embedded metadata such as GPS coordinates.
• Business records you enter: customer, vendor, and supplier contact details, work orders, estimates, invoices, and payment records for your own business operations (processed by us as a processor — see Section 2).
• Location-based content: if you use drive-logging features, the route stops and locations you record.
• Communications: messages you send to our support, sales, and security teams.

3.2 Information from Third Parties

• Sign-in providers: if you sign in with Google or Apple, we receive your name and email address (and, for Google, your profile picture) from that provider.
• Payment processor: Stripe provides us with subscription and payment status, card type, and the last four digits of your card. Full card numbers never touch our servers.
• Vehicle data services: vehicle specifications and market data associated with VINs you look up. This is vehicle data, not personal data, but it becomes associated with your account.

3.3 Information Collected Automatically

• Device and log data: IP address, browser and device type, operating system, pages viewed, and timestamps. Security and audit logs record account activity such as sign-ins and administrative actions.
• Cookies and similar technologies: as described in our Cookie Policy.
• Usage analytics: product usage events (features used, actions taken), collected only if you consent to analytics at registration or in your cookie preferences.

4. How We Use Information

• Provide, operate, maintain, and secure the Service
• Create and manage your account and organization
• Process subscriptions and payments
• Deliver features you request, including document OCR, AI-assisted extraction and classification, voice transcription, VIN decoding, and valuation estimates
• Send transactional communications (verification codes, security alerts, service notifications, invoices)
• Send marketing communications, only with your consent, which you can withdraw at any time
• Respond to support requests and communicate with you
• Monitor, debug, and improve the Service, including through error monitoring and (with your consent) usage analytics
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of a contract (providing the Service you signed up for), legitimate interests (securing and improving the Service, preventing fraud), consent (marketing, analytics, personalization — withdrawable at any time), and compliance with legal obligations.

5. AI and Automated Processing

Certain features — document OCR and extraction, document classification, parts identification, and voice transcription — are powered by third-party AI service providers. When you use these features, the relevant content (such as a document image or voice recording) is transmitted to those providers for processing and the results are returned to your account.

• We do not use your content to train our own AI models.
• We engage AI providers under terms that do not permit them to use your content to train their models.
• AI outputs can be inaccurate and should be reviewed before you rely on them (see our Terms of Service, Section 16).

The current AI providers are listed on our subprocessors page.

6. SMS Communications

When you provide your mobile phone number and consent to SMS communications:

• We use your phone number to send account verification codes, security alerts, and service notifications
• Message frequency varies based on your account activity
• Message and data rates may apply
• You can opt out at any time by replying STOP to any message
• For help, reply HELP or contact support@vaultmotive.app

Mobile Information Sharing

We do not sell, rent, or share your mobile phone number or any mobile opt-in data with third parties or affiliates for their marketing or promotional purposes.

Your mobile information is used solely to provide the VaultMotive service and will not be shared with any third party without your explicit consent, except for the SMS delivery provider acting on our behalf and as required by law.

7. How We Share Information

We do not sell personal information, and we do not share personal information with third parties for their own marketing purposes. We share information only in the following circumstances:

• Service providers (subprocessors): vendors that perform services on our behalf — cloud hosting and storage, payment processing, email and SMS delivery, AI document and voice processing, error monitoring, and (with your consent) product analytics. Each is bound by contractual obligations to protect your data and use it only to provide services to us. The complete, current list is published on our subprocessors page.
• Within your organization: content and records you create in an organization are visible to other members of that organization according to the roles and permissions its administrators configure.
• Content you choose to publish: if you use showroom, public profile, sharing, or marketplace features, the content you publish is visible to the public or to the people you share it with.
• Legal and safety: when required by law, subpoena, or legal process, or when necessary to protect the rights, property, or safety of VaultMotive, our users, or others.
• Business transfers:in connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy's commitments.

8. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, then delete it on defined schedules. Key retention windows:

• Account deletion grace period: when you delete your account, it enters a 30-day grace period during which you can cancel the deletion. After that, your data is permanently deleted from active systems.
• Soft-deleted content: content you delete inside the Service is recoverable for 30 days by default, then permanently removed. Deleted documents are retained for 365 days before permanent removal, reflecting their role in tax, insurance, and regulatory records.
• Notifications: read notifications are deleted after 90 days; unread after 180 days.
• Audit and security logs: retained for up to 7 years to support security monitoring, financial dispute resolution, and compliance obligations.
• Financial records: invoices, payments, and related records are retained as required by tax and accounting law, with embedded free-text personal details removed on a bounded schedule.
• Encrypted backups: retained for 30 days. Data removed from active systems by a deletion request may persist in encrypted backups until natural rotation completes within that window. Backups are encrypted, access-controlled, and used only for disaster recovery. This retention relies on the GDPR Article 17(3) exception for backup and disaster-recovery systems.

9. Data Security

We maintain a security program that includes encryption of data at rest (AES-256) and in transit (TLS), multi-factor authentication, role-based access controls, tenant data isolation, tamper-evident audit logging, and continuous automated backups with tested recovery procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have found a security vulnerability, please report it to security@vaultmotive.app.

10. International Data Transfers

VaultMotive is a United States company and the Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. If you have questions about transfers, contact us at privacy@vaultmotive.app.

11. Your Rights and Choices

11.1 Rights Available to Everyone

• Access and portability: export your data at any time from account settings in JSON or CSV format.
• Correction: update your account information in settings, or ask us to correct it.
• Deletion: delete individual content or your entire account from settings (see Section 8 for timelines).
• Marketing opt-out: unsubscribe from marketing email via the link in any message; reply STOP to opt out of SMS; manage all communication preferences in settings.
• Consent withdrawal: withdraw analytics, personalization, and marketing consents at any time in account settings. Withdrawal stops future processing based on that consent.
• Cookie preferences: manage cookies via our consent banner and your browser (see the Cookie Policy).

11.2 European Economic Area and United Kingdom

If you are in the EEA or UK, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under the GDPR, as well as the right to withdraw consent at any time and the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, use the in-app tools described above or contact privacy@vaultmotive.app. We respond to verified requests within one month, extendable as permitted by law. We verify identity before fulfilling requests.

11.3 California Residents

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, the right to access and delete it, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. The categories of personal information we collect are described in Section 3 (identifiers, commercial information, internet activity, geolocation data you record, audio you record, and professional information); the purposes are described in Section 4; and the categories of recipients are described in Section 7. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise your rights, use the in-app tools or contact privacy@vaultmotive.app. You may designate an authorized agent to submit requests on your behalf; we will verify the request as permitted by law.

12. Children's Privacy

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 13 (or the higher age required in your jurisdiction). If you believe a child has provided us personal information, contact privacy@vaultmotive.app and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice — by email, in-app notification, or a prominent notice on the Service — at least 30 days before the changes take effect, and we will update the Effective Date and version above. We track policy versions and may ask you to renew your consent after material changes.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, or want to exercise your rights, contact us:

• Email: privacy@vaultmotive.app
• Mail: VaultMotive, LLC, 42020 Village Center Plaza, Ste 120 #740, Stone Ridge, VA 20105

Last Updated: July 6, 2026
Version: 2.0