Privacy Policy

How CarPay handles your personal information

Effective as of February 27, 2026

Introduction

This Privacy Policy describes how CarPay, Inc. (“CarPay”) handles information about your personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined by applicable privacy laws (“Personal Information”) in connection with the software services it provides to automobile dealers (“Dealers”) and to individuals who are borrowers, payers, or account holders of those Dealers (“Consumers”) and our website (the “Site”).

CarPay processes multiple categories of Personal Information for different purposes:

Controller Data: Personal Information that we collect or process for our own business (“Controller Data”). Controller Data includes contact information provided on the Site, in business interactions for our services, or through other direct marketing activities.

Processor Data: Personal Information that our Dealers ask us to process on their behalf (“Processor Data”). Under applicable law, in certain contexts CarPay is considered the “processor” or “service provider” of Personal Information we receive through our business operations, and our Dealer customer is (or acts on behalf of) the “controller” of the data (i.e., the company with the right to decide how the data is used). Questions about Processor Data practices should be directed to your applicable Dealer.

1 Personal Information We Collect

Information you provide to us

Controller Data

The personal information processed by CarPay may include:

• Account information, such as first and last name, email address, mailing address, billing address, and phone number.
• Payment and account information (such as card or bank account numbers) are provided directly by Dealers and securely stored by independent third-party payment processors or vaulting providers. CarPay does not store raw payment card numbers or bank account credentials.
• Customer Records, including name, postal address, transaction history, telephone number.

Automatic data collection

We, our service providers, and business partners may automatically collect information about your device and interactions with the services, including:

• Device information, such as IP address, browser type, operating system, device identifiers, language settings, and approximate location information (such as city or state) derived from IP address.
• Usage and activity information, such as pages viewed, features used, timestamps, navigation paths, and interactions with messages or notifications.
• Mobile application data, where applicable, including device settings and permissions. Precise geolocation information is collected only where a user has affirmatively enabled location services through a mobile device, and such permissions may be disabled at any time through device settings.

Processor Data

CarPay collects and processes personal information on behalf of Dealers in connection with the services it provides.

• Contact information, such as first and last name, email address, mailing address, billing address, and phone number.
• Identification information, such as date of birth, Social Security number, driver’s license number, or other government-issued identification, which may be used for account identification, authentication, and servicing purposes, but not for credit evaluation or creditworthiness determinations.
• Payment and account information, such as payment history, transaction details, account balances, payment schedules, and related account servicing information. Payment credentials (such as card or bank account numbers) are provided directly by Consumers or Dealers and are tokenized and securely stored by independent third-party payment processors or vaulting providers. CarPay does not store raw payment card numbers or bank account credentials.
• Vehicle-related information, such as vehicle identification number (VIN), make, model, mileage, vehicle value, and related account information associated with a Dealer’s customer account.
• Communications data, including the content of emails, text messages (SMS), in-application messages, IVR interactions, and customer service communications sent or received through the services. Calls made or received through IVR features may be transcribed for operational, quality assurance, and compliance purposes. CarPay does not provide call recording services and does not collect biometric information.
• Information about other individuals associated with a customer account (such as co-buyers or authorized payers), such as name and contact information, where such information is provided by a Dealer or Consumer. Dealers and Consumers are responsible for ensuring they have appropriate authorization to provide such information.

2 How We Use Your Personal Information

We use personal information for the following purposes, primarily on behalf of Dealers and at their direction, in order to provide, operate, and support the services:

Providing and operating the services

We use personal information to provide, administer, and support the services requested by Dealers, including to:

• administer and service Dealer customer accounts;
• facilitate, route, and confirm payments through independent third-party payment processors;
• configure, schedule, initiate, and manage automatic or recurring payments (including retrying failed payments and sending related notifications);
• send transactional, operational, and account-related communications to Consumers and Dealer personnel via email, SMS/text message, IVR, in-application messaging, or other supported channels;
• provide customer support, respond to inquiries, and troubleshoot issues; and
• maintain records relating to payment history, account activity, and communications.

Communications and messaging

Our platform is used to generate, send, receive, log, and manage communications on behalf of Dealers, including payment reminders, alerts, confirmations, delinquency and collections-related messages, account notices, and other communications configured by Dealers. Communications may include language provided or selected by Dealers and may relate to the administration or protection of a Dealer’s collateral or account interests, as permitted by applicable law. If you have any questions regarding these communications, please contact your applicable Dealer.

Research, analytics, and service improvement

We may use personal information to monitor, analyze, and improve the performance, functionality, security, and reliability of the services. Where practicable, we use aggregated or de-identified data for these purposes.

Marketing and Advertising

We may send limited marketing or promotional communications, including emails, on behalf of Dealers or in connection with CarPay’s services. Consumers and Dealers may opt out of marketing communications as described below.

We also use cookies and similar technologies on our Site to assist with marketing and targeted advertising campaigns. Please see Your Choices below for more information.

Compliance, safety, and legal obligations

We use personal information to:

• comply with applicable laws, regulations, and lawful requests;
• enforce the terms and conditions that govern the services;
• protect the rights, safety, and property of CarPay, Dealers, Consumers, and others; and
• prevent, detect, investigate, and respond to fraud, security incidents, and misuse of the services.

CarPay does not use personal information to make creditworthiness determinations, obtain consumer credit reports, or make lending or underwriting decisions. All such decisions, if any, are made solely by Dealers or their independent third-party providers.

4 Your Choices

You have certain choices regarding how personal information is used and communicated in connection with the services, subject to applicable law and the nature of CarPay’s role as a service provider to Dealers.

• Marketing communications. You may opt out of receiving marketing-related emails from CarPay by following the unsubscribe instructions included in those emails or by contacting us using the information provided below.
• Dealer-directed communications. Many communications sent through the services are sent on behalf of Dealers and relate to the administration or servicing of Dealer customer accounts. Requests to modify, limit, or stop such communications may need to be directed to the applicable Dealer, and CarPay may not be able to independently honor all such requests.
• Cookies and similar technologies. Most web browsers allow you to control cookies and similar technologies through browser settings. If you choose to disable cookies, some features of the services may not function properly. For more information about cookies and how to manage them, please visit www.allaboutcookies.org.
• Mobile device settings. Users of CarPay’s mobile applications may control certain data collection practices, such as location permissions or notification settings, through their mobile device settings.
• Third-party platforms and integrations. If you connect or interact with third-party platforms or services in connection with the services, such as payment methods or Dealer systems, you may be able to limit or revoke CarPay’s access to information from those platforms through their settings. Revoking access does not affect information already received, processed, or retained as required by applicable law or contractual obligations.
• Do Not Track. Some internet browsers may be configured to send “Do Not Track” signals. The services do not currently respond to Do Not Track or similar signals.

5 Other Sites and Services

The services may contain links to, or integrations with, websites, mobile applications, or online services operated by third parties. These links and integrations are provided for convenience only and do not constitute an endorsement of, or representation that CarPay is affiliated with, any third party. CarPay does not control, and is not responsible for, the privacy practices, content, or operations of third-party websites or services. Your interactions with third-party websites or services are governed by their own privacy policies and terms.

6 Security

We employ reasonable administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security of personal information.

7 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date at the top of this Privacy Policy and post the revised version through the services. Any changes will be effective upon posting unless otherwise indicated. Your continued use of the services after the effective date of a revised Privacy Policy constitutes your acceptance of the updated Privacy Policy. Where appropriate, we may require you to affirmatively acknowledge updated terms through the services.

8 How to Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, you may contact us using the information below:

Email: support@carpay.com

Mail: 2219 Main Street, Suite 763, Santa Monica, CA 90405, United States

Phone: 1-877-388-4265

Questions about this policy? Contact us at support@carpay.com.