Welcome to GoodCar.com, provided by InfoPay ("we," "us," or "InfoPay"). InfoPay, together with its affiliates and subsidiaries, has created this Policy to apply to all users and clients of our website (https://goodcar.com) and the associated products, services, data, information, and materials offered therein (collectively, the "Services").

This Privacy Policy ("Policy") applies to your use of the Services and is part of and supplements the GoodCar Terms of Service (the "Terms"), available here: http://goodcar.com/terms-of-service.

PLEASE CAREFULLY READ THIS POLICY. YOUR USE OF THE SERVICES CONSTITUTES YOUR CONSENT TO THIS POLICY. DO NOT USE THE SERVICES IF YOU ARE UNWILLING OR UNABLE TO CONSENT TO THIS POLICY.

We may revise this Policy at any time and such revision shall be posted here and accessible via this link: http://goodcar.com/privacy-policy. Any revision and/or addition to this Policy shall become effective and binding on you when you continue to use the Services on or after the effective date of such revision and/or addition.

If you are a California resident, please click here for your California privacy rights, which supplements this Policy as to California Residents only.

1. Information We Collect

When you use the Services, we may collect the following types of personal information about you, which are described in more detail below: (A) personal information we request from you; (B) personal information we automatically collect; and (C) personal information we may receive from third parties. All of the information listed in (A)-(C) above, are detailed below, and hereinafter referred to as "Information."

A. Information You Provide

In using our Services, you may provide us with Information, including, without limitation:

• Contact and account registration information such as name, email address physical billing address, phone number, business name
• Financial information such as credit card number, name, CVV code, date of expiration
• Demographic information you choose to provide such as age or date of birth
• Information about your vehicle, including your Vehicle Identification Number (VIN)
• Information you provide such as feedback or comments

B. Information We May Automatically Collect About You

Our Services may automatically collect certain personal information about you. We use this personal information to help us design our Services to better suit our users' needs. This personal information may include:

• IP address, which is the number associated with the service through which you access the Internet, like your ISP (Internet service provider);
• Date and time of your visit or use of our Services;
• Domain server from which you are using our Services;
• Type of computer, web browsers, search engine used, operating system, or platform you use;
• Data identifying the web pages you visited prior to and after visiting our website or use of our Services;
• Your movement and activity within the website, which is aggregated with other information;
• Geographic data such as country or region; and
• Mobile device information, including the type of device you use, operating system version, and the device identifier (or "UDID").

1. Usage of Cookies and Other Network Technologies

We collect the above Information directly and through the use of third parties. We collect this Information by using certain technologies, such as cookies, web beacons, and other technologies. Third-party service providers, advertisers, and/or partners may also view, edit, or set their own cookies or place web beacons.

1. Cookies. Cookies are small digital files that are transferred to your computer or smartphone's hard drive when you visit a website or click on a URL. Most web browsers automatically accept cookies. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Services.
2. Flash Cookies. We may use local shared objects, also known as Flash cookies, to store your preferences such as volume control or display content based upon what you view on our site to personalize your visit. Third parties, with whom we partner to provide certain features or to display advertising based upon your browsing activity, use Flash cookies to collect and store information. Flash cookies are different from browser cookies because of the amount of, type of, and how data is stored. Cookie management tools provided by your browser will not remove Flash cookies.
3. Web Beacons. Website pages may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity). We also use these technical methods to analyze the traffic patterns, such as the frequency with which our users visit various parts of the Services. These technical methods may involve the transmission of Information either directly to us or to a third party authorized by us to collect Information on our behalf. Our Services may use retargeting pixels from Google, Facebook, and other ad networks. We may also use web beacons in HTML emails that we send to determine whether the recipients have opened those emails and/or clicked on links in those emails.
4. Analytics. Analytics are tools we use, such as Google Analytics, to help provide us with information about traffic to our website and use of our Services, which Google may share with other services and websites who use the collected data to contextualize and personalize the ads of its own advertising network. Learn more about Google's Privacy Policy here: https://policies.google.com/privacy?hl=en-US. You can opt-out of having your activity on our Services made available to Google Analytics by installing the Google Analytics opt-out add-on for your web browser by visiting: https://tools.google.com/dlpage/gaoptout for your web browser.
5. Mobile Application Technologies. If you access our website and Services through a mobile device, we may automatically collect Information about your device, your phone number, and your physical location.

2. Do Not Track Notice

Many modern web browsers give you the option to send a "Do Not Track" signal to the websites you visit, indicating that you do not wish to be tracked. At this time, the Services do not specifically respond to "Do Not Track" signals.

We encourage you to review the privacy policies of our third-party advertisers and analytics service providers to learn about your choices about information they collect from you. In addition, the Network Advertising Initiative offers information about some of the Internet advertising companies we may use, including how to opt-out of interest based advertising they deliver. For all the details, including how to turn on Do Not Track, visit www.donottrack.us.

C. Information We Receive from Third Parties.

Third-Party Websites and Social Media Platforms. We may collect additional personal information about you from third-party websites, social media platforms, such as but not limited to, Facebook and Instagram ("Social Media Platforms") to help us provide services to you, help prevent fraud, and for marketing and advertising purposes.

Information we may access about you, with your consent, may include, but is not limited to, your basic Social Media Platform information, your location data, your list of contacts, friends or followers and certain information about your activities on the Social Media Platform. Please keep in mind that when you provide information to us on a third-party website or platform (for example, via our applications), the information you provide may be separately collected by the third-party website or the Social Media Platform.

The information we collect is covered by this Privacy Policy, and the information the third-party website or Social Media Platform collects is subject to the third-party website or platform's privacy practices. We encourage you to be aware when you leave our Services and to read the privacy policies of other sites that may collect your information.

2. How We Use Your Information

A. Use and Purpose of Processing Your Information.

We use and process your Information for things that may include, but are not limited to, the following:

• To operate and improve the Services and products and content therein.
• To create and maintain an account for you to allow you to purchase and use the services we make available on the Services.
• To provide you with information, products, or services that you request from us, or that may be of interest to you.
• To understand and analyze information related to the number and type of visitors that browse and use the Services.
• To respond to your comments, inquiries and questions and provide customer services.
• To deliver a more personalized experience based on your preferences.
• To send administrative information to you, for example, information regarding the Services and changes to our terms, conditions, and policies. Because this information may be important to your use of the Services, you may not opt-out of receiving these communications.
• For general or targeted marketing and advertising purposes, including sending you promotional material or special offers on our behalf or on behalf of our marketing partners and/or their respective affiliates and subsidiaries and other third parties, provided that you have not already opted-out of receiving such communications.
• To manage, improve, and foster relationships with third-party service providers, including vendors, suppliers, and parents, affiliates, subsidiaries, and business partners;
• To maintain, improve, customize, or administer the Services, perform business analyses, or other internal purposes to improve the quality of our business, the Services, resolve technical problems, or improve security or develop other products and services;
• To comply with our Terms & Conditions;
• For analytics for business purposes and business intelligence;
• To comply with any applicable laws and regulations and respond to lawful requests; and/or
• For any other purposes disclosed to you at the time we collect your Information and/or pursuant to your consent.

3. Information Sharing

We may share your personal information as set forth in this Policy in the following circumstances:

• With Your Consent. We may share personal information with your consent.
• For Legal and Administrative Reasons. We may disclose your personal information without notice: (i) as may be required by law (e.g., in response to a court order or subpoena, or in response to a law enforcement agency request); (ii) to protect our organization or others from injury (e.g., when we believe that someone is causing, or is about to cause, injury to or interference with the rights or property of another); (iii) as necessary to comply with applicable law; (iv) to enforce or apply our Terms of Service.
• Third-Party Service Providers. We may share your personal information with persons or organizations with whom we contract to carry out internal and external site operations or as necessary to render the Services. Additionally, we may also exchange personal information with third parties for fraud protection and credit risk reduction.
• Aggregate Sharing. We may share anonymous, deidentified aggregate information with third parties, including affiliated and non-affiliated organizations such as advertisers.
• Business Transfers. Finally, we may transfer your personal information to our successor-in-interest in the event of an acquisition, sale, merger, or bankruptcy. In the event we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, any personal information we have on record will likely be among the assets transferred. The transferred personal information will remain subject to the provisions of this Policy as it is updated from time to time.
• Information Shared with our Subsidiaries and Affiliates. We may share your personal information with our subsidiaries and affiliates. If you do not want us to share your personal information with our subsidiaries and affiliates, please email us at privacy@goodcar.com.

4. Links To Third-Party Sites

Occasionally, at our discretion, we may link to third-party sites or content on third-party sites not owned or controlled by us, including links to Social Media Platforms. We may do this for the convenience of you and other users of the Services, but we do not have control over the operation of these third-party websites. This Policy applies only to personal information collected by our Services. Third-party sites have their own privacy practices and may or may not publish separate and independent Policies. We have no responsibility or liability for the privacy and security practices and activities of these third-party sites, including social media platforms. Links to any of these third-party sites and Social Media Platforms do not constitute or imply an endorsement or recommendation by us of the third-party site, Social Media Platform, and/or content.

If you visit a third-party site that is linked to our Services, you should review the privacy policies posted on these third-party sites before providing any personal information.

5. Information Security and Storage

We use commercially reasonable measures to provide the Services. However, you acknowledge that no security safeguards or method of transmission over the Internet are completely secure, and although we believe the measures implemented by us reduce the likelihood of security problems to a level appropriate to the type of data involved, we cannot guarantee the security of your personal information transmitted to or from our Services. Any transmission of personal information is at your own risk. We do not guarantee that your personal information will not be misused by third parties. We are not responsible for the circumvention of any privacy settings or security features. You agree that we will not have any liability for misuse, access, acquisition, deletion, or disclosure of your personal information.

The safety and security of your personal information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

If you believe that your personal information has been accessed or acquired by an unauthorized person, you must promptly Contact Us so that we can quickly take necessary measures.

6. Data Retention

We store personal information for as long as reasonably required for its purpose or for any additional period required or allowed by applicable law (if any). The length of time for which we retain personal information depends on the purposes for which we collected and use it and/or as required to comply with applicable laws.

7. Your Choices

A. Notifications and Alerts.

If you choose to make purchases on the Services or provide your email address to us, you agree that we may contact you by email as set forth herein, including by sending a welcome email including information about your purchase and account. We will also periodically send you alerts regarding updated results for searches you have previously conducted, and updated information about the subject of your search.

1. Notification Opt-In.

We may offer you the ability to opt-in to receive notifications about new or upcoming products or services, and promotional materials and offers from us as well as from our subsidiaries, marketing partners, advertisers, and other third parties. We may offer these notifications via email, via browser notifications, or both. You may opt-out of receiving these notifications as described below.

2. Email Notification Opt-Out.

If you no longer wish to receive marketing email notifications, you may opt-out of receiving them as instructed in each email, or please click here for instructions. Be advised that you may not opt-out of receiving administrative email notifications from us related to technical support or customer services requests, billing and subscription issues, search alerts, or changes to the Terms or Policy.

3. Browser Push Notification Opt-Out.

By using our Services, you agree that we may provide browser push notifications. We may use a third party to provide these push notifications, which the third party will receive certain information related to you, including your IP address, your device identifier, and your geolocation. As part of these push notifications, the third party may provide advertisements and/or information related to our Services to you on other related websites.

If you no longer wish to receive browser push notifications, you may opt-out of receiving them by clicking here or using the instructions at the following links:

• Google Chrome/Android Phone users: https://support.google.com/chrome/answer/3220216?co=GENIE.Platform%3DDesktop&hl=en.
• Microsoft Edge users: https://www.windowscentral.com/how-manage-web-notifications-edge-windows-10.
• Firefox users: https://sendpulse.com/knowledge-base/push-notifications/general/enable-disable-push-notifications-mozilla-firefox.
• Opera users: https://davescomputertips.com/how-to-manage-desktop-notifications-in-opera/.
• Safari users: https://support.apple.com/guide/safari/manage-website-notifications-sfri40734/mac.
• Additional information: https://www.makeuseof.com/tag/disable-notifications-chrome-firefox-safari/.

B. Opting Out of Direct Marketing.

To exercise choices regarding the marketing information you receive, you may also review the following links:

• You may opt-out of tracking and receiving tailored advertisements on your mobile device by some mobile advertising companies and other similar entities by downloading the App Choices app at https://youradchoices.com/appchoices.
• You may opt-out of receiving permissible targeted advertisements by using the NAI Opt-out tool available at http://optout.networkadvertising.org/?c=1 or visiting About Ads at http://optout.aboutads.info.
• You can opt-out of having your activity on our Services made available to Google Analytics by installing the Google Analytics opt-out add-on for your web browser by visiting: https://tools.google.com/dlpage/gaoptout for your web browser.

8. ACCESSING, CORRECTING, OR DELETING YOUR INFORMATION

To the extent state laws provide users with certain data subject rights, those rights may be honored by InfoPay following proper authentication and verification. Please see the Contact Us section for more information.

9. Geographic Location of Data Storage and Processing

The Services collect personal information and processes and stores that personal information in databases located in the United States. If you are visiting the Services from a country outside the United States, you should be aware that you may transfer personal information about yourself to the United States, and that the data protection laws of the United States may not be as comprehensive as those in your own country. By visiting the Services and submitting any personal information you consent to the transfer of such personal information to the United States.

10. California Residents

The California Consumer Privacy Act of 2018 ("CCPA") and other California privacy laws provides California residents (i.e., consumers) with specific rights regarding personal information. This section of the Policy describes those CCPA rights and how to exercise those rights. This section does not apply to publicly available information.

A. Access to Specific Information and Data Portability Rights.

California residents have the right to request that InfoPay disclose certain information to you about InfoPay's collection and use of your personal information over the past twelve (12) months. Once InfoPay receives and confirms a verifiable consumer request from you, InfoPay will disclose to you, to the extent permitted by law:

• The categories of personal information InfoPay collected about you.
• The categories of sources for your personal information InfoPay collected about you.
• InfoPay's business or commercial purpose for collecting your personal information.
• The categories of third parties with whom InfoPay shares your personal information.
• If we disclosed your personal information for a business purpose, the personal information categories that each category of recipient obtained.

You shall have the right to request that the information described above be provided to you in a portable and readily usable format, to the extent technically feasible ("data portability").

B. Deletion Request Rights.

You have the right to request that InfoPay delete certain of your personal information that InfoPay collected from and/or related to you and retained, subject to certain exceptions.

To the extent that InfoPay can delete your personal information, once InfoPay receives and confirms your verifiable consumer request, InfoPay will delete (and direct our service providers to delete) your personal information, unless an exception applies.

We may deny your deletion request if retaining the personal information is necessary for us or our service providers to:

• Complete the transaction for which we collected your personal information, provide a good or service that you requested, or take actions reasonably anticipated within the context of our ongoing business relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that personal information that are compatible with the context in which you provided it.

C. Exercising Your Access, Data Portability, and Deletion Rights.

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to InfoPay by either:

• Visiting http://goodcar.com/legal-content/privacyform;
• Contacting us at privacy@goodcar.com; or
• Calling InfoPay at (800) 764-0104.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows InfoPay to reasonably verify you are the person about whom InfoPay collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows InfoPay to properly understand, evaluate, and respond to it.

InfoPay cannot respond to your request or provide you with your personal information if InfoPay cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request. Any disclosures provided pursuant to the CCPA will only cover the 12-month period preceding the receipt of the verifiable consumer request.

InfoPay will respond to a verifiable consumer request within 45 days of its receipt, or notify you that InfoPay requires more time to respond and the reason for the extended response time. InfoPay will deliver its written response by mail or electronically, at your option.

To the extent that your verifiable consumer request is excessive, repetitive, or manifestly unfounded, InfoPay may charge a reasonable fee to respond to such request.

D. No Discrimination.

InfoPay will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, InfoPay will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

11. Children's Information

This Services are not intended for use by persons under the age of eighteen (18). We do not knowingly collect any information from anyone under thirteen (13) years old. In the event that we discover that a person under the age of thirteen (13) (or a higher threshold where applicable) has provided information to us, we will take steps to comply with any applicable legal requirement to remove such personal information.

Contact us if you believe that we have mistakenly or unintentionally collected information from a child under the age of thirteen (13).

12. Contact Us

If you have any questions or concerns about this Policy or any GoodCar product or service offered by InfoPay, please click here to contact us, email us at privacy@goodcar.com, call us at (800) 764-0104, or write: