Privacy Policy

Effective Date: April 1, 2026

Last Updated: April 1, 2026

1. Who We Are

Carbuki LLC ("Carbuki," "we," "us," or "our") is an AI voice agent and outbound marketing automation platform purpose-built for automotive dealerships. We operate as a data processor (or "service provider" under U.S. state privacy laws) on behalf of our dealership clients, who act as data controllers (or "businesses") with respect to their customers' personal information.

2. Scope of This Policy

This Policy covers:

• Personal information collected from website visitors, prospects, and business contacts.
• Consumer data processed by Carbuki's AI agents on behalf of dealership clients.

It does not cover how our dealership clients independently collect or use consumer data outside of Carbuki's platform. Consumers seeking to exercise rights regarding data collected by a dealership should contact the dealership directly.

3. Information We Collect

3.1 From Website Visitors and Prospects

When you request a demo, contact us, or submit an inquiry, we may collect:

• Name, email address, phone number
• Company name and job title
• Any other information you voluntarily provide
• Limited technical data: browser type, device info, pages visited, approximate usage data

3.2 Consumer Data Processed on Behalf of Dealerships

When operating as a data processor for dealership clients, Carbuki's AI agents may process the following categories of consumer personal information:

• Contact Information: Name, phone number, email (Purpose: Outbound campaign calls, appointment booking)
• Vehicle & Transaction Data: Lease maturity dates, VIN, service history (Purpose: Campaign targeting, re-engagement)
• Call Recordings & Transcripts: AI agent conversation audio and text (Purpose: Quality assurance, compliance logging, platform service delivery)
• Appointment Data: Scheduled service dates, preferences (Purpose: Service re-engagement, scheduling)
• F&I Interest Signals: Product inquiries captured during calls (Purpose: Finance & Insurance follow-up campaigns; treated as nonpublic personal information under GLBA where applicable)

This data is provided to Carbuki by the dealership or sourced from dealership-authorized third-party data providers. Carbuki does not independently source consumer PII.

4. How We Use Personal Information

4.1 Website Visitor Data

• Respond to inquiries and provide requested demonstrations
• Communicate about our services
• Operate, maintain, and improve our website
• Monitor and protect the security of our systems
• Comply with legal obligations

4.2 Consumer Data (as Data Processor)

• Execute outbound voice campaigns on behalf of the dealership
• Route and respond to inbound service calls
• Book and confirm appointments
• Generate campaign performance reporting for the dealership
• Maintain call logs for compliance and quality purposes

Carbuki does not use consumer data processed on behalf of dealerships for independent marketing, profiling, advertising, or cross-client analytics.

AI Model Training. Carbuki does not use consumer call recordings, transcripts, or other consumer personal information to train, fine-tune, or improve our general-purpose AI models without prior written authorization from the dealership client. Where a dealership opts in via the Data Processing Agreement, any such use is limited to data that has been de-identified in accordance with industry-standard practices and contractual safeguards against re-identification. Dealership-specific model tuning conducted solely for that dealership's account does not require separate authorization beyond the master service agreement.

5. How We Disclose Personal Information

We do not sell personal information for monetary value, and we do not share personal information for cross-context behavioral advertising.

5.1 Website Visitor Data

• Service providers: hosting, communications, analytics, security (see Section 6)
• Professional advisers (legal, accounting)
• Government authorities when required by law
• Successor entities in connection with a merger, acquisition, or restructuring

5.2 Consumer Data (as Data Processor)

• Only to the dealership client that provided the data, or at their direction
• To subprocessors strictly as necessary to deliver the contracted services (see Section 6)
• To government authorities when required by applicable law

Carbuki does not share consumer data across dealership accounts. Each client's data is logically isolated. In the event of a merger, acquisition, or restructuring, consumer data processed on behalf of dealerships is governed by the applicable Data Processing Agreement and is not transferred at Carbuki's discretion.

6. Subprocessors

Carbuki engages select third-party service providers (subprocessors) to assist in delivering our platform, including categories such as:

• Cloud infrastructure and hosting
• Telecommunications and voice transport
• Foundational AI model providers
• Data storage and backup
• Security monitoring and logging

We require all subprocessors to implement appropriate security measures and contractually bind them to process data only for the provision of their contracted services. A current list of subprocessors is available to dealership clients upon request. Carbuki will provide reasonable advance notice (typically 30 days) of material changes to our subprocessor list, and dealership clients may object to such changes pursuant to the terms of their Data Processing Agreement.

7. CCPA / CPRA Disclosures

7.1 Our Role Under the CCPA

Carbuki operates in a dual capacity:

• As a Business under the CCPA with respect to data collected directly from California residents who visit our website or interact with us as prospects.
• As a Service Provider under the CCPA with respect to consumer data processed on behalf of dealership clients — meaning we process such data only as instructed by the dealership and do not sell or share it for our own purposes.

7.2 California Consumer Rights

If you are a California resident whose data Carbuki has collected directly, you may have the right to:

• Know the categories and specific pieces of personal information collected about you
• Request deletion of your personal information, subject to legal exceptions
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information
• Limit the use of sensitive personal information
• Not receive discriminatory treatment for exercising your rights

If you are a consumer whose data was processed by Carbuki on behalf of a dealership, please direct your privacy request to the dealership directly, as they are the data controller. Carbuki will cooperate with the dealership in responding to verified consumer requests.

7.3 GLBA Notice

Automotive dealerships that arrange financing or insurance are typically considered financial institutions under the Gramm-Leach-Bliley Act (GLBA) and applicable FTC interpretations. Carbuki, as a service provider to such clients, supports their GLBA compliance obligations by:

• Limiting use of consumer financial information to the purposes authorized by the dealership
• Maintaining appropriate administrative, technical, and physical safeguards for nonpublic personal information (NPI)
• Not disclosing NPI to unaffiliated third parties except as directed by the dealership or required by law

Dealerships should reference their own GLBA privacy notices for consumer disclosures. Carbuki is available to execute Data Processing Agreements that align with GLBA Safeguards Rule requirements upon request.

7.4 How to Submit a Privacy Request

To exercise your rights for data Carbuki collected directly, contact us at:

• Email: support@carbuki.com
• Subject line: "Privacy Rights Request"

We may need to verify your identity before processing your request. We will respond within 45 days as required under the CCPA, with a possible 45-day extension upon notice if reasonably necessary.

8. Other State Privacy Rights

Residents of states with comprehensive consumer privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, and others — may have rights similar to those described above, including the rights to access, delete, correct, and obtain a copy of their personal information, and to opt out of certain processing such as targeted advertising or sale. Requests may be submitted using the contact information in Section 7d. Where state law provides an appeals process for denied requests, Carbuki will honor it.

For consumer data processed on behalf of a dealership, requests should be directed to the dealership as the data controller.

9. Do Not Sell or Share

Carbuki does not sell personal information for monetary value and does not share personal information for cross-context behavioral advertising. As a Service Provider, we process consumer data solely at the direction of our dealership clients.

10. Telemarketing, TCPA, and Call Recording Compliance

Carbuki provides an AI voice platform, but the dealership client is the initiator of the communication and remains solely responsible for complying with the Telephone Consumer Protection Act (TCPA), federal and state telemarketing regulations, Do Not Call (DNC) requirements, and applicable state wiretapping and call recording laws — including two-party consent requirements in states such as California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, and Washington.

Specifically, the dealership is responsible for:

• Obtaining and maintaining legally required prior express consent (including prior express written consent where applicable) before initiating automated outbound calls
• Scrubbing contact lists against federal and state DNC registries and internal opt-out lists
• Honoring consumer revocation of consent and DNC requests in a timely manner
• Providing accurate caller identification information

Carbuki provides supporting tooling, including configurable call-start recording disclosures, opt-out capture during conversations, and DNC suppression list management. By default, Carbuki's AI agents are configured to disclose that calls are being recorded at the start of each call; dealerships may adjust this configuration consistent with their legal obligations and bear responsibility for any such adjustments.

11. Data Retention

We retain website visitor and prospect data only for as long as necessary to fulfill the purposes outlined in this Policy, generally not longer than 24 months after last interaction unless legally required.

For consumer data processed as a Service Provider, Carbuki retains such data (including call recordings and transcripts) for the duration specified in the Data Processing Agreement with the dealership, or as long as necessary to provide the contracted platform services. Default retention for call recordings and transcripts is 12 months unless the dealership instructs otherwise. Upon termination of the contract or at the dealership's verified request, consumer data is securely deleted or returned, subject to prevailing legal obligations and reasonable backup cycles.

12. Data Residency and International Transfers

Carbuki's primary platform infrastructure and data storage are hosted in the United States. To support platform development, maintenance, and 24/7 technical operations, authorized personnel — including engineering and support teams located outside the United States, in jurisdictions such as China — may have controlled, role-based access to certain systems.

All such access is governed by:

• Role-based access controls and least-privilege provisioning
• Encryption in transit and at rest
• Contractual confidentiality and data protection obligations
• Logging and monitoring

Carbuki does not transfer consumer data to jurisdictions outside the United States for storage. Dealership clients with specific data residency requirements should address them in the Data Processing Agreement.

13. Data Security

Carbuki implements technical, administrative, and organizational safeguards designed to protect personal information. See our companion Security Policy for full details. Key controls include:

• Encryption in transit (TLS) and at rest for all consumer personal information
• Access controls limited to authorized personnel with a documented business need
• Logging and monitoring of access to production systems
• Regular security assessments and vulnerability management
• Incident response with notification to affected dealerships without undue delay and, in any event, within 72 hours of confirmation of a reportable breach

14. Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on our website with an updated effective date. Dealership clients will be notified of material changes to data processing practices in accordance with their Data Processing Agreement.

16. Governing Law

This Policy is governed by the laws of the State of California, without regard to its conflict-of-laws principles, except where preempted by applicable federal or state privacy law granting consumers rights based on their state of residence.

17. Contact Us

Questions about this Policy or our privacy practices:

Carbuki LLC 222 Broadway APT 703 Oakland CA 94607 - 3846 United States
Email: support@carbuki.com
Subject: Privacy Inquiry / DPA Request / Privacy Rights Request

This Privacy Policy applies to information collected through our website.