Privacy Policy

Nemroot Technologies LLC  •  Version 2.0  •  Effective Date: October 6, 2026

This Privacy Policy explains how Nemroot Technologies LLC and its subsidiaries and affiliates (collectively, "Nemroot", "we", "us" and "our") collect, use and manage your personal information, meaning information that identifies or can be used to identify an individual, in connection with the services and products we develop or provide. This includes our AI-powered lead management tools, messaging and communication platforms, website widgets, voice call services, vehicle inventory management, web and mobile applications, and any other services Nemroot may offer (collectively, the "Services"). Capitalized terms used but not defined in this Privacy Policy have the meanings given in Nemroot's Dealer Terms of Service at nemroot.com/terms-of-service.

Where we process personal information on behalf of a Client, that processing is also governed by our Data Processing Addendum at nemroot.com/dpa. The service providers we use to process personal information are listed at nemroot.com/subprocessors.

1. Scope

This Privacy Policy applies to the following categories of individuals:

• "Clients": automobile dealerships, organizations or other business entities that have entered into an agreement with Nemroot to use the Services. When used in the context of personal information, this term refers to an individual acting on behalf of a Client.
• "Authorized Users": employees, agents, contractors and other personnel whom a Client has permitted to access and use the Services on its behalf, including managers, salespeople, finance personnel and administrators.
• "Leads": individuals who are current or prospective customers of a Client, including those who interact with a Client through our AI agent, website widget, telephone services or other communication channels provided by the Services.

This Privacy Policy also covers visitors to our website (the "Website"), which forms part of the Services. "You" and "your" refers to you as the reader. How we handle your personal information depends on whether you are a Client, Authorized User, Lead or Website visitor.

By using the Services or providing personal information to us, you acknowledge that your information will be processed in accordance with this Privacy Policy. We may revise this Privacy Policy as described in Section 13.

2. Information We Collect

The personal information we collect depends on your relationship with us and how you interact with the Services. Some information is provided directly by you, some is collected automatically, and some is obtained from other sources.

2.1 Information Collected Through the Services

A. Clients and Authorized Users

If you are a Client or an Authorized User, we collect personal information in connection with your subscription and use (or prospective use) of the Services, including:

• full name;
• email address;
• phone number;
• work address and general location;
• role-related information, such as job title and assigned role within the platform; and
• the content of communications sent or received through the Services, including text messages, message attachments, call recordings, call transcripts and call summaries.

Call recording. Call recording and transcription are enabled by default for calls placed or received through the Services. Each call is recorded, transcribed and summarized into the relevant customer record. Clients are responsible for giving any notice and obtaining any consent that the law requires before a call is recorded.

During registration and onboarding we may also collect business information such as business identification numbers. Payment information is collected and stored by our third-party payment processor, not by Nemroot.

B. Leads

If you are a Lead, we collect information through your interactions with the Services. This may include your use of our website widget, communication by SMS, email or phone, social media messaging (such as Facebook Messenger, Instagram or WhatsApp), and third-party lead sources (such as TrueCar, CarGurus, CarsForSale, Cars.com or AutoTrader). Depending on the Services used, we may collect:

• name, phone number and email address;
• mailing address and general location;
• lead information, including vehicle preferences, trade-in details, appointment history and inquiry details; and
• the content of communications exchanged through the Services, including text messages, message attachments, call recordings, call transcripts and call summaries. Calls with a dealership that uses the Services are recorded by default, and you may also interact with an AI assistant on the dealership's behalf.

C. Website Visitors

When you visit our Website to browse, request a demo or interact with our content, we may collect your name, email address, phone number, business name and job title. Additional information may be collected automatically, as described below.

D. Integration Partners

If you are a business partner seeking to integrate with Nemroot, we may collect your name and contact details as part of the integration process.

2.2 Automatically Collected Information

Certain information is collected automatically whenever anyone uses the Services.

A. Usage data. We record how you use the Services, such as traffic data, general location data, logs, communication records (including call timestamps, duration, completion status and the phone numbers involved), and resources accessed within the platform. We may also generate derived data, such as summaries of content processed by our AI features.

B. Widget data. Client websites may embed the Nemroot website widget. When you visit a site with our widget installed, we receive information including the web page you visited and details about your device.

C. Device information. We collect information about the device and software used to access the Services, including IP address, browser type, operating system version, phone carrier and manufacturer, device identifiers, mobile advertising identifiers and push notification tokens.

D. Linked account information. If you connect a third-party account (such as Google or a social media account) to the Services, we may receive information from that provider, including profile information and account usage data. See Section 3 for Google API Services.

E. Cookies and similar technologies. See Section 6.

2.3 Information from Other Sources

We may obtain personal information from third parties, including our marketing and service partners, and may collect publicly available information about businesses from public search pages or social media.

2.4 De-identified Information

We may receive or create de-identified information that can no longer reasonably be linked to an individual. We keep it in de-identified form and do not attempt to re-identify it unless permitted by law.

3. Google API Services User Data

Nemroot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

3.1 Data Accessed

When you connect your Google account to the Nemroot platform, we may request access to:

• Google Calendar (read and write): to create, view, update and delete appointment events on behalf of Authorized Users for dealership appointment scheduling, reminders and coordination between sales staff and customers.
• Google profile (basic info): name and email address, used to authenticate your account and identify you within the platform.

We request only the minimum permissions needed for the features you enable. You can revoke access at any time at myaccount.google.com/permissions.

3.2 Data Usage

• Google Calendar data is used only to manage dealership appointments as directed by Authorized Users within the Nemroot platform.
• We do not use Google user data to serve advertisements or for any purpose not directly related to the feature that requires the access.
• We do not use Google user data to train AI models.
• We do not allow humans to read Google user data unless we have your explicit consent, it is necessary for security purposes, it is required by law, or the use is limited to internal operations.

3.3 Data Sharing

We do not sell, rent or share Google user data with third parties except with our hosting and infrastructure providers (such as Google Cloud Platform) solely to operate the Services, or where required by law, regulation or valid legal process. We do not share Google user data with advertising networks, data brokers or any other third party for commercial purposes.

3.4 Data Storage and Protection

Google user data is stored on Google Cloud Platform infrastructure located in the United States, with encryption at rest (AES-256) and in transit (TLS 1.2 or higher), access limited to authorized personnel on a need-to-know basis, regular security reviews, and multi-factor authentication for administrative access.

3.5 Data Retention and Deletion

We retain Google user data only as long as necessary to provide the Services or as required by law. On account termination, or on your request, Google user data is deleted from our systems within 30 days. To request deletion, email support@nemroot.com with the subject line "Google Data Deletion Request". We will confirm deletion within 30 days of a verified request. Revoking access at myaccount.google.com/permissions disables Google-dependent features.

4. How We Use Your Information

4.1 Providing the Services

We may use your personal information to:

• provide, maintain and improve the Services and deliver related support and training;
• process communications between Clients, Authorized Users and Leads through the platform;
• operate our AI features, including answering and placing calls, drafting and sending messages, and transcribing and summarizing calls and conversations;
• assess eligibility to use specific Services and evaluate the performance of the platform;
• develop analytics for our business and for our Clients' dealership operations; and
• research and develop new features and offerings.

4.2 AI Features

Our AI features are powered in part by third-party AI service providers listed at nemroot.com/subprocessors. We send them personal information only as needed to provide the Services, under terms that do not permit them to use it to train their own models. We do not use personal information to train general-purpose AI models. We may use de-identified or aggregated information to improve the Services, as permitted by our Terms of Service. AI output may not always be accurate, and Clients are responsible for reviewing how they use it.

4.3 Marketing and Advertising

We may use your personal information to send marketing communications about features we believe may interest you, and to measure our audience and analyze usage. See Section 8.2 to opt out.

4.4 Communication

We may use your information to send service notifications, provide customer support, deliver newsletters, and respond to feedback about our Services or, if you are a Lead, about a Client's products and services.

4.5 Legal, Compliance and Security

We may use your personal information to enforce our Terms of Service and other legal rights, comply with legal and regulatory obligations, detect, prevent and investigate security incidents and fraud, establish, exercise and defend legal claims, and perform our contracts.

5. Sharing of Your Information

5.1 Providing the Services

We share personal information with our Clients and their Authorized Users to operate the Services. If you are a Lead, we share your information with the relevant Client, for example when you use our website widget, communicate with our AI agent, or interact through any supported channel. If a Client connects Nemroot with other applications or platforms, we may share personal information with those integration partners as the Client instructs.

We also share personal information with service providers that process it on our behalf to deliver the Services. These include cloud hosting and database providers, telephony and messaging carriers, AI and transcription providers, email delivery providers and our payment processor. The current list, with each provider's role and processing location, is published at nemroot.com/subprocessors. We may share personal information with our subsidiaries and affiliates solely to operate the Services.

Notwithstanding anything else in this Privacy Policy, SMS opt-in data, phone numbers and any information collected for SMS communications will not be sold, shared, rented or transferred to any third parties, affiliates or subsidiaries for their own marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

5.2 Legal, Compliance and Security

We may share personal information when we believe it is necessary to protect our rights or property, enforce our agreements, investigate and prevent fraud and security breaches, protect public safety, or comply with law, regulation, legal process or a governmental request.

5.3 Business Transfers

We may share personal information with a buyer or successor in a merger, acquisition, restructuring, dissolution or other sale or transfer of some or all of Nemroot's assets, including in bankruptcy or similar proceedings.

6. Cookies and Tracking Technologies

6.1 Types of Technologies

A cookie is a small text file placed in your browser when you access the Services. We use session cookies, which expire at the end of your visit, and persistent cookies, which remain on your device. They may be first-party cookies set by us or third-party cookies set by partners such as Google Analytics. Pixels, tags and embedded scripts record how you interact with websites and applications.

6.2 Purposes

We may use these technologies to deliver and authenticate the Services, identify you or your device, remember your preferences, support personalization and advertising, protect against fraud, and analyze the performance and use of the Services. We use Google Analytics, which you can opt out of with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

6.3 Your Choices

You can control or reject cookies through your browser settings, although this may limit some features. Nemroot does not sell personal information. Depending on where you live, you may have the right to opt out of targeted advertising or other processing. To exercise that right, email support@nemroot.com with the subject line "Privacy Opt-Out".

7. Data Retention

We retain personal information as long as reasonably necessary to provide the Services and for the purposes described in this Privacy Policy, considering the nature and sensitivity of the information and our legal, tax and accounting obligations. In particular:

• Client data, including information about Authorized Users and Leads, is retained for the term of our agreement with the Client.
• After the agreement ends, the Client may export its data for thirty (30) days. We then delete it from our active systems within thirty (30) days after that export period ends.
• Copies in backups are overwritten or deleted on a rolling cycle of no more than ninety (90) days.
• Records we must keep by law, such as billing records and A2P 10DLC registration records, are kept for the period the law requires.
• Website visitor and marketing information is kept until you ask us to delete it or it is no longer needed.

8. Your Rights and Choices

8.1 Managing Your Information

A. Clients and Authorized Users. Please keep your account information accurate. You can access, update or correct your account information by logging in, or email support@nemroot.com to request access to, correction of or deletion of personal information we hold about you. Deleting all of your personal information may require closing your account. Clients who wish to manage Lead data that Nemroot processes on their behalf may email support@nemroot.com. We may retain usage records for billing, troubleshooting, fraud prevention or as required by law.

B. Leads. When we provide the Services to Clients, we generally act as a processor (service provider) on their behalf. If you are a Lead and wish to access, correct or delete your personal information, please direct your request to the relevant dealership. If you contact us, we will forward your request to that dealership.

C. State privacy rights. Depending on your state of residence, including Texas, you may have rights to access, correct, delete or obtain a copy of your personal information, and to opt out of certain processing. To exercise these rights where Nemroot is responsible for your information, email support@nemroot.com. We will verify your request and respond within the time required by law. If we deny your request, you may appeal by replying to our response with the subject line "Privacy Appeal".

8.2 Communications from Nemroot

You may unsubscribe from our promotional emails using the link in those emails. To stop receiving marketing text messages from Nemroot, reply STOP to any Nemroot marketing text. You may still receive transactional or account-related communications. If you are a Lead, a Client may also send you marketing communications through the Services. Follow the instructions in those messages or contact the Client directly to opt out.

8.3 Cookie Preferences

See Section 6.

9. Security Measures

We use reasonable administrative, technical and physical safeguards designed to protect the information we maintain, including encryption in transit and at rest, role-based access controls, individually attributed credentials, multi-factor authentication for administrative access, and logging of access to production systems. Personnel and contractors with access to personal information are bound by written confidentiality agreements. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your password confidential. We recommend that Clients enable multi-factor authentication.

10. Third-Party Practices and External Links

This Privacy Policy applies only to information Nemroot processes through the Website and the Services. Our Clients are independent businesses with their own privacy practices, and we are not responsible for them. The Services and Website may link to third-party websites or services that we do not operate. We are not responsible for their privacy practices and encourage you to review their policies.

11. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us as described in Section 14 and we will take steps to delete it.

12. Where We Process Information

The Services are intended for use in the United States. Personal information is hosted and processed in the United States by Nemroot and the service providers listed at nemroot.com/subprocessors. Some of our engineering and support personnel and contractors work outside the United States, including in Türkiye, and may access our U.S.-hosted systems remotely to develop, maintain and support the Services. They do so only as needed for those purposes and under written confidentiality and security obligations. Personal information is not otherwise transferred outside the United States except as required by law or as described at nemroot.com/subprocessors.

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new effective date. If we make material changes to how we process personal information, we will notify Clients and Authorized Users by email to the primary address on their account. Please keep your email address current and review this Privacy Policy periodically.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: info@nemroot.com
• Phone: (346) 666-7377
• Mail: Nemroot Technologies LLC, 14507 FM 529, Suite H, Houston, TX 77095

If you have a disability or are assisting someone with a disability and have difficulty accessing this Privacy Policy, please contact us at info@nemroot.com for assistance.