Privacy Policy

Introduction

Ekho, Inc. and its affiliates (collectively, "Ekho," "we," or "us") provide software and services to dealerships, OEMs, distributors, and other partners (collectively, "Partners") that enable them to sell vehicles and accessories through their websites. In connection with our websites (the "Sites") and the Ekho services we provide (the "Services"), we collect personal information from: (i) visitors to our Sites, (ii) Partners interested in offering our Services, and (iii) end users who purchase vehicles and accessories from Partners through the Services ("End Users").

This Privacy Notice describes how Ekho collects, uses, and discloses personal information through our websites (the "Sites") and when you use our services (the "Services"), including any affiliated websites, software, or platforms owned or operated by Ekho where this Privacy Notice is posted.

When an end user visits a Partner's website and chooses to purchase a vehicle and/or accessories, the end user is redirected to an Ekho-powered page to provide information needed to complete the transaction, as described in this Privacy Notice. In connection with the personal information Ekho collects on the Ekho-powered page, Ekho acts as the data controller (where applicable), and our processing of that information is described in this Privacy Notice.

We may update this Privacy Notice from time to time to reflect changes in our privacy practices and applicable laws. We encourage you to review this Privacy Notice periodically to stay informed about how we collect, use, and disclose personal information. The "Last Updated" date at the top of this Privacy Notice indicates when it was most recently revised. If we make material changes, we will provide notice as required by applicable law (for example, by posting an updated notice on our Sites or through the Services).

If you have any questions, please contact us at [email protected].

1. Information We Collect

We collect personal information (a) directly from you, (b) automatically when you use our Sites or Services (for example, through cookies and similar technologies), and (c) from third parties. The types of personal information we collect depend on how you interact with our Sites and Services, as described below.

a. Information You Provide To Us

Ekho Site Visitors

You may visit our Sites without providing personal information directly to us. In that case, we collect certain information automatically, as described below.

Partners

If you are a Partner (or a prospective Partner) and you contact us or book a demo through our Sites, we collect business contact information, such as your name, business email address, and (if provided) your job title, phone number, and company name. We also collect information about your business, such as your business type and website URL.

End Users

If you are an End User purchasing a vehicle and/or accessories via the Services, we will collect information to enable you to purchase and pay for the vehicle and/or accessories, complete the vehicle registration and titling process (if applicable), and otherwise complete any transactions you request.

The information that we collect consists of the following:

• Account information: full name, email address, phone number, and password.
• Shipping information: full name and physical address.
• Payment information: credit card and/or bank account information is collected directly by our third-party payment processors, as described in the "Payment Processing" section.
• Product information: information about the products you purchase, including any customizations.
• Titling and registration information: full name, date of birth, sex, gender, phone number, military status, a photo of your driver's license or other state-issued identification, driver's license number, and physical address. In some cases we may also collect tax identification numbers (e.g., Social Security Number) as required by the registration state.
• Chat information: if you use our chat feature, we will collect any information that you provide via the chat feature.
• Biometric information: if you submit a photo of your driver's license or other identification document for identity verification, our third-party verification providers may derive biometric identifiers (such as facial geometry) from such images for the purpose of verifying your identity. We do not directly collect or store biometric templates, but our vendors may process biometric data on our behalf as part of the verification process.

b. Automatically Collected Information

When you visit or interact with our Sites and Services, we automatically collect certain information about your device, browser, and activity.

Cookies and Other Tracking Technologies

We (or our authorized service providers) automatically collect information through cookies and similar tracking technologies.

We use this information for purposes such as:

• Ensuring the Sites and Services function properly
• Understanding how you use the Sites and Services
• Measuring usage and performance metrics

Most browsers allow you to control cookies through their settings. For example, you may be able to choose to accept all cookies, reject cookies, or receive a notification when a cookie is set. Please consult the "Help" section of your browser (e.g., Microsoft Edge, Google Chrome, Mozilla Firefox, or Apple Safari).

You can learn more about cookies at allaboutcookies.org. Please note that blocking cookies may limit certain features or functionality of the Sites or Services.

Log Data and Device Information

We collect information about the device you use to access the Sites and Services and how you interact with them.

This may include:

• IP address
• Device type
• Browser type
• Internet service provider
• Operating system
• Unique device identifiers

We also collect activity and usage information, such as:

• Frequency and duration of use
• Pages visited
• Links clicked
• Other interactions with the Sites and Services

Location Information

We may infer your general location (for example, city or region) based on your IP address.

If you purchase a vehicle through the Services and choose to pick it up at a designated location, we may request access to your precise geolocation information to help identify the nearest pickup location. You may choose whether to allow this through your device settings.

Analytics

We use third-party analytics providers to help us understand how visitors use the Sites and Services. These providers may use cookies and similar technologies.

For example:

• Google Analytics helps us understand how Site Visitors engage with our Sites. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available here: https://tools.google.com/dlpage/gaoptout.
• Mixpanel provides analytics regarding user interactions with the Sites and Services. You may opt out of Mixpanel's data retention at mixpanel.com/optout.

Do Not Track

"Do Not Track" ("DNT") is a browser setting intended to signal that you do not want your online activity tracked across websites.

At this time, we do not respond to DNT or similar signals. For more information, visit allaboutdnt.com.

c. Information Received From Third Parties

From time to time, we receive personal information from third parties, including our partners and service providers. This may include transactional data from payment service providers, insurance service providers, identity verification providers, and information provided by our Partners.

We may also combine information we collect (as described above) with information we receive from third parties. For example, we may combine information submitted through a Partner sales inquiry with information from a third-party sales intelligence provider to better understand prospective Partners and market our Services.

Third parties from whom we may receive personal information include:

• Payment processors
• Fraud prevention and identity verification providers
• Partners (dealerships, OEMs, distributors, and others)
• Insurance partners
• Electronic signature and document processing providers
• Dealer compliance partners (e.g., registration and titling)
• Companies that offer co-branded services or products
• Analytics providers
• Law enforcement or other governmental authorities (as required by law)
• Publicly available sources

If you apply to finance a vehicle, we may also receive additional information from third parties in connection with the review of your application (including from credit reporting agencies), as described in separate notices provided in connection with the financing process.

2. Payment Processing

When you make payments through our Services, your credit card or other payment information is collected and processed by third-party payment processors (such as Stripe) in accordance with applicable payment card industry standards (PCI DSS). For example, if you pay by credit card, the payment information you submit through the Services is transmitted directly to our payment processor.

We receive only limited information from our payment processors (for example, the payment status and transaction details such as date and amount). We may also receive and store certain billing information you provide, such as your billing address. We do not receive or store full credit card numbers.

3. Children's Privacy

Our Sites and Services are not intended for or directed to individuals under 18 years of age, and we do not knowingly collect personal information from individuals under 18. If you believe that someone under 18 has provided personal information to Ekho through the Sites or Services, please contact us at [email protected]. We will take reasonable steps to delete that information, consistent with applicable law.

4. How We Use Your Information

We use personal information to:

• Provide, operate, and maintain the Sites and Services.
• Process transactions (including payments), fulfill orders, and manage purchases and returns (as applicable).
• Communicate with you about the Sites and Services (including confirmations, updates, and administrative messages).
• Provide customer support and respond to inquiries.
• Personalize and customize features and content, including tailoring the Services to your preferences.
• Analyze usage and trends, and improve the Sites and Services.
• Maintain the security of our Sites and Services, prevent fraud, and protect Ekho, our partners, and users.
• Comply with applicable legal obligations and enforce our agreements.
• Carry out any other purpose disclosed to you at the time we collect your information, or otherwise with your consent.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data category:

• Credit application data (SSNs, income, employment submitted for financing) — retained for a minimum of 25 months as required by Regulation B (Equal Credit Opportunity Act), then securely disposed of unless a longer retention period is required by applicable law or regulatory obligation.
• Transaction records and financial data — retained as required by federal and state tax, financing, and motor vehicle regulations (typically 5–7 years).
• Identity verification records — retained for a minimum of 5 years as required by KYC/AML and Bank Secrecy Act regulations.
• Platform activity data (browsing, analytics, cookies) — retained for up to 24 months for analytics and fraud prevention, then anonymized or deleted.
• Sensitive personal information (SSNs, financial accounts) — encrypted at rest and retained only as long as required for the specific transaction or regulatory obligation, then securely purged.

In certain cases, applicable law or regulatory requirements — including state-level dealer compliance obligations — may require retention of specific records for periods longer than those described above. We will retain such records as required and securely dispose of them when the applicable retention period expires.

6. When We Disclose Your Information

We may disclose personal information in the following circumstances:

• Affiliates. To our affiliates for purposes consistent with this Privacy Notice.
• Service Providers and Partners. To vendors, consultants, and other service providers that perform services on our behalf (for example, hosting, analytics, customer support, payment processing, identity verification, fraud prevention, insurance, document processing/e-signature, and compliance services).
• Partners. To Partners in connection with providing the Services and facilitating transactions and related support.
• Government Agencies/Legal Process. To law enforcement, regulators, government authorities, or other third parties if we believe disclosure is necessary to comply with applicable law, respond to lawful requests, or protect the rights, property, or safety of Ekho, our users, or others.
• Business Transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or other transaction involving the sale or transfer of all or part of our business or assets.
• At Your Direction/With Consent. To third parties when you direct us to do so or otherwise with your consent.

7. Gramm-Leach-Bliley Act (GLBA)

Ekho facilitates vehicle financing by submitting buyer applications to lending partners and processing F&I (finance and insurance) products. In connection with these activities, Ekho may be considered a "financial institution" as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.).

Personal information collected in connection with providing financial products or services — including information provided on credit or financing applications, information resulting from financing transactions, and information otherwise obtained in connection with providing a financial product or service — is subject to the protections of the GLBA and its implementing regulations.

We maintain safeguards consistent with the GLBA and the FTC Safeguards Rule to protect the security, confidentiality, and integrity of nonpublic personal information. For questions about how we handle information subject to the GLBA, please contact us at [email protected].

8. AI and Automated Processing

Ekho uses artificial intelligence and machine learning technologies to power features of our Services, including AI-powered chat, SMS, and email agents that communicate with end users on behalf of Partners.

How AI Processes Your Information

When you interact with an AI-powered feature of our Services (such as a chat widget, SMS conversation, or email exchange), the AI may process personal information you provide — including your name, contact information, vehicle preferences, and the content of your messages — in order to respond to your inquiries, qualify your interest, and facilitate your transaction.

AI-Generated Inferences

Our AI and fraud prevention systems may generate inferences about you based on your interactions and transaction data, such as purchase intent indicators and fraud risk scores. These inferences are used to improve the quality of service, prioritize follow-up, and protect against fraudulent activity.

Human Oversight

All consequential decisions — including financing application outcomes, transaction approvals or denials, and fraud-related actions — involve human review before taking effect. AI-generated inferences and recommendations are used to assist human decision-makers, not to replace them.

Use of Data for AI Improvement

Ekho does not use identifiable personal information to train artificial intelligence or machine learning models. We may use aggregated or de-identified data — from which personally identifiable information has been removed — to improve and enhance the performance of our Services. Financial information is used only to provide the Services and is not used for any other purpose unless de-identified.

Conversation Data Retention

Content from AI-powered conversations (chat, SMS, email) is retained as part of the transaction and customer relationship record. This data is subject to the same retention periods and security protections described in Section 5 (Data Retention) and Section 11 (Information Security) of this Privacy Notice.

9. Driver's Privacy Protection Act (DPPA) Notice

Ekho complies with the federal Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721–2725, which regulates the disclosure and use of personal information contained in motor vehicle records.

In connection with the vehicle purchase, registration, and titling services we provide, Ekho may collect, receive, and process certain personal information derived from motor vehicle records, including information obtained from you directly and/or from government agencies or authorized third parties. This information may include, for example, your name, address, driver's license number, date of birth, and other information required to complete vehicle registration, titling, compliance, or related services.

Ekho uses and discloses personal information subject to the DPPA only for purposes permitted under the DPPA, including, where applicable:

• To carry out vehicle registration, titling, and dealer compliance activities;
• To facilitate vehicle purchase transactions and related services requested by you;
• To verify identity, prevent fraud, and maintain the security of our Services;
• To comply with legal obligations, law enforcement requests, or governmental requirements; and
• As otherwise permitted by applicable law or with your consent.

Ekho does not knowingly use or disclose personal information obtained from motor vehicle records for purposes prohibited by the DPPA. We require our service providers and partners who receive such information to use it only for permitted purposes and in accordance with applicable law.

If you have questions regarding our DPPA-related practices, you may contact us at [email protected].

10. Third-Party Websites

The Sites and Services may contain links to third-party websites or services that are not owned or controlled by Ekho. Any personal information you provide to those third parties is governed by their privacy policies, not this Privacy Notice. We encourage you to review the privacy policies of any third-party website or service before providing personal information.

11. Information Security

We implement and maintain reasonable administrative, physical, and technical safeguards designed to protect personal information under our control from unauthorized access, use, disclosure, alteration, loss, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of your information.

12. Cookies and Tracking Technologies

When you visit our Sites, we and our authorized service providers use cookies, pixels, and similar tracking technologies to collect information about your browsing activity. This section describes the types of cookies we use and your choices regarding them.

Types of Cookies

• Essential cookies: Required for the Sites to function properly. These cannot be disabled without affecting site functionality.
• Analytics cookies: Help us understand how visitors use our Sites by collecting information about pages visited, time spent, and interactions. We use third-party analytics providers including Google Analytics and Mixpanel. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. You can opt out of Mixpanel at mixpanel.com/optout.
• Marketing cookies: Used to deliver relevant advertisements and measure campaign effectiveness. These cookies may track your activity across websites and may constitute "sharing" of personal information under certain state privacy laws.

Your Cookie Choices

Most browsers allow you to control cookies through their settings. You can choose to accept all cookies, reject non-essential cookies, or receive a notification when a cookie is set. Please note that blocking certain cookies may limit features or functionality of our Sites.

You can learn more about cookies at allaboutcookies.org.

13. Processing In The United States

Ekho operates the Sites and Services from the United States, and we process personal information in the United States. If you access the Sites or Services or submit information to us from outside the United States, your personal information may be transferred to, stored in, and processed in the United States and other jurisdictions where we or our service providers operate. These jurisdictions may have data protection laws that differ from those in the country or region where you reside.

The Sites and Services are intended exclusively for use within the United States and are not directed to individuals outside the United States.

14. Your Choices

You may have certain choices and rights regarding our collection and use of your personal information. These choices and rights may vary depending on where you live and may be subject to verification and applicable exceptions under law.

Exercise Your Marketing Choices

If you receive marketing emails from us, you can opt out at any time by using the unsubscribe link in the email or by contacting us at [email protected]. Please note that even if you opt out of marketing communications, we may still send you non-marketing messages related to your transactions, account, or our ongoing business relationship.

U.S. State Privacy Rights

Depending on where you reside, you may have certain rights regarding your personal information under applicable state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), and other state laws. While each law varies, common rights include:

• Right to Know / Access: You may request information about the personal data we have collected about you, including the categories and specific pieces of information, the sources, and the purposes for collection.
• Right to Delete: You may request that we delete personal information we have collected about you, subject to certain legal exceptions.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt Out: You may opt out of the sale or sharing of your personal information, targeted advertising, or certain profiling activities, where applicable under your state's law.
• Right to Data Portability: In certain states, you may request a copy of your personal information in a portable, readily usable format.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law.

California Consumer Privacy Act (CCPA/CPRA) Notice

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: You may direct us to limit our use of sensitive personal information (such as government IDs, SSNs, and precise geolocation) to what is necessary to perform the Services.
• Right to Opt Out of Sale/Sharing: We do not sell your personal information for money. However, our use of analytics and advertising cookies may constitute "sharing" under the CCPA. You may opt out by enabling the Global Privacy Control (GPC) in your browser, which we honor as a valid opt-out signal.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise your rights, contact us at [email protected]. We will respond within 45 days as required by law.

15. Contact Information

If you have any questions or concerns about this Privacy Notice or our privacy practices, or if you would like to exercise your privacy rights, you may contact us at:

Email: [email protected]
Address: 31 East 32nd Street, Floor 3, New York, New York 10016

16. Changes To This Privacy Notice

The "Last Updated" date at the top of this page indicates when this Privacy Notice was most recently revised. We may update this Privacy Notice periodically to reflect changes in our privacy practices or applicable law. If we make material changes, we will provide notice as required, such as by posting an updated notice on the Sites or by sending a message to the email address associated with your account (if applicable).