Bifrost Privacy Policy

Dealer Glass and Calibrations LLC ("DGNC," "we," "our," or "us") is committed to protecting the privacy and security of the information entrusted to us.

This Privacy Policy explains how DGNC collects, uses, stores, shares, protects, and otherwise processes personal information through Bifrost, DGNC's proprietary business operations platform.

Bifrost is used exclusively by DGNC personnel and authorized Partner Dealerships to facilitate customer lead intake, automotive glass replacement and calibration operations, customer communications, scheduling, reporting, workflow management, insurance processing, and related business activities.

This Privacy Policy applies to information collected through Bifrost and related services operated by DGNC.

By accessing or using Bifrost, you acknowledge that your information will be handled in accordance with this Privacy Policy.

This Privacy Policy applies to:

• Authorized Users of Bifrost, including DGNC employees, contractors, representatives, Partner Dealership personnel, dealership administrators, and other approved users;
• customers whose information is submitted to DGNC through Bifrost;
• communications generated through Bifrost;
• and information collected in connection with operation of the Service.

This Privacy Policy does not apply to:

• employment records maintained solely by Partner Dealerships;
• websites, applications, or services operated by third parties;
• or information collected outside the operation of Bifrost unless otherwise stated.

Third-party services integrated with Bifrost maintain their own privacy policies and practices.

The information collected through Bifrost depends upon how the Service is used.

A. Customer Information. Authorized Users may submit information relating to customers seeking automotive glass replacement, repair, calibration, or related services. Customer Information may include:

• first and last name;
• telephone number;
• email address;
• physical address;
• Vehicle Identification Number (VIN);
• vehicle year, make, and model;
• insurance carrier;
• insurance policy number;
• insurance claim number;
• deductible information;
• insurance adjuster information;
• photographs of vehicle damage;
• photographs of driver's licenses or other identification when required for service or insurance processing;
• damage descriptions and service notes;
• appointment information;
• communications relating to the requested service;
• warranty information;
• service history;
• and other information voluntarily provided during the service process.

Vehicle photographs may incidentally contain license plates, surrounding property, or individuals appearing in the background. DGNC does not intentionally collect biometric information through these photographs.

Where the optional scanning feature is used, images of documents such as driver's licenses, insurance cards, or VIN plates may be captured and processed by an automated document-extraction service to prefill lead fields. See "Document Scanning and Automated Extraction" below.

B. Authorized User Information. For individuals authorized to access Bifrost, DGNC may collect:

• full name;
• business email address;
• business telephone number;
• dealership affiliation;
• user role;
• permissions;
• authentication credentials;
• account status;
• login history;
• audit records;
• and other administrative information necessary to manage access to the Service.

Passwords are not stored in plain text.

C. Technical Information. When Authorized Users access Bifrost, DGNC may automatically collect certain technical information necessary to operate, secure, maintain, and improve the Service. Depending on how the Service is accessed, such information may include:

• IP address;
• browser type;
• device type;
• operating system;
• authentication events;
• session information;
• diagnostic information;
• error logs;
• audit logs;
• timestamps;
• and other technical information generated through the normal operation of the Service.

DGNC also maintains records identifying the Partner Dealership associated with each submitted Lead. DGNC does not intentionally collect precise GPS location information through Bifrost.

Information collected through Bifrost generally comes from one of the following sources:

• information entered directly by Authorized Users;
• information voluntarily provided by customers;
• information generated through use of the Service;
• information received through integrated third-party systems;
• information extracted from document images through the optional scanning feature;
• authentication providers used to access the Service;
• and technical information automatically generated during operation of the Service.

Certain information, such as VIN decoding, may be supplemented through publicly available government resources or authorized third-party integrations.

DGNC uses information collected through Bifrost to operate, improve, and support its business operations. Depending on the circumstances, information may be used to:

• process customer Leads;
• coordinate automotive glass replacement and calibration services;
• verify insurance information;
• communicate with customers regarding requested services;
• schedule appointments;
• dispatch technicians;
• administer warranties;
• provide customer support;
• authenticate Authorized Users;
• administer user accounts;
• maintain audit records;
• detect fraud and unauthorized activity;
• protect the security of the Service;
• comply with legal and regulatory obligations;
• produce operational reporting and analytics;
• administer dealership performance reporting;
• administer commissions and incentive programs;
• improve workflows and operational efficiency;
• develop new features and functionality;
• and otherwise operate DGNC's business.

DGNC processes personal information only for legitimate business purposes and in accordance with applicable law.

Bifrost is designed to receive customer information from Authorized Users acting on behalf of Partner Dealerships. Each Authorized User submitting Customer Information represents that:

• the customer knowingly provided the submitted information;
• the customer authorized DGNC to contact them regarding the requested services;
• any legally required disclosures were provided prior to submission;
• and all applicable federal, state, and local legal requirements governing the collection of Customer Information have been satisfied.

DGNC maintains electronic records of customer consent affirmations and related audit information to support compliance, security, and operational integrity.

DGNC does not sell personal information.

DGNC does not share personal information with third parties for cross-context behavioral advertising, targeted advertising, or similar marketing purposes.

DGNC may disclose personal information only as reasonably necessary to operate the Service, provide requested services, comply with legal obligations, protect legitimate business interests, or as otherwise permitted by applicable law. Depending on the circumstances, information may be shared with:

• authorized DGNC personnel;
• Authorized Users acting on behalf of the originating Partner Dealership;
• technology service providers supporting operation of the Service;
• insurance companies, administrators, or claims processors involved in servicing a customer's request;
• governmental authorities or law enforcement when legally required;
• professional advisors, auditors, insurers, accountants, or legal counsel;
• or other parties when authorized by the customer or required by law.

DGNC requires service providers receiving personal information to use that information only for authorized business purposes and to maintain appropriate safeguards consistent with applicable law.

DGNC uses trusted third-party providers to operate, maintain, and improve Bifrost. Depending upon the functionality being used, these providers may assist with services including:

• cloud hosting and infrastructure;
• database management;
• authentication services;
• customer relationship management;
• email delivery;
• VIN decoding;
• document image scanning and automated data extraction;
• communications;
• document storage;
• system monitoring;
• analytics;
• security;
• and other operational support services.

Current providers may include:

• Amazon Web Services (AWS);
• HubSpot;
• Google Workspace and Google OAuth;
• Google Vertex AI (Gemini models) — used to extract text and fields from document images (such as driver's licenses, insurance cards, and VIN plates) captured through the optional scanning feature;
• Amazon Simple Email Service (SES);
• the National Highway Traffic Safety Administration (NHTSA) Vehicle Product Information Catalog (vPIC);
• and other technology providers supporting the Service.

DGNC may add, replace, or discontinue service providers as business needs evolve. These providers process information only to perform services on DGNC's behalf or as otherwise permitted by applicable law.

DGNC does not control the independent privacy practices of third-party websites or services that users may access outside of Bifrost.

As DGNC continues to grow, its ownership, organizational structure, or business operations may change over time.

In connection with a proposed or completed merger, acquisition, investment, financing, change of control, corporate restructuring, reorganization, bankruptcy, receivership, sale of assets, or other business transaction, personal information and related business records maintained through Bifrost may be transferred as part of that transaction, subject to applicable law.

Any successor or acquiring organization receiving such information will remain subject to applicable legal obligations governing the use and protection of that information.

DGNC may evaluate, develop, and implement new technologies to improve Bifrost and the services provided to customers and Partner Dealerships. To support these efforts, DGNC may use aggregated, anonymized, or de-identified information to:

• improve operational workflows;
• enhance reporting;
• optimize scheduling and routing;
• improve customer service;
• develop automation tools;
• improve fraud detection;
• enhance quality assurance;
• improve forecasting;
• develop artificial intelligence and machine learning capabilities;
• improve analytics;
• and develop future features of the Service.

DGNC does not use personally identifiable Customer Information to train publicly available or third-party artificial intelligence models except where expressly authorized by the customer or otherwise permitted by applicable law.

Nothing in this section authorizes the sale or public disclosure of Customer Information.

Bifrost offers an optional scanning feature that lets an Authorized User capture an image of a document — such as a driver's license, insurance card, or vehicle VIN plate — using the device camera, and automatically extract relevant fields (for example, name, address, VIN, or insurance carrier and policy number) to prefill the lead form and reduce manual typing.

When this feature is used, the captured image is transmitted securely to a third-party artificial-intelligence document-extraction service — currently Google Vertex AI (Gemini models) — solely to perform the extraction and return the recognized fields.

Key characteristics of this feature:

• Scanning is optional. An Authorized User may always enter information manually instead of scanning.
• Images submitted for scanning are processed transiently in memory to perform the extraction and are not retained by DGNC's scanning pipeline after the fields are returned.
• Under DGNC's agreement with the extraction provider, images and data submitted for extraction are not used to train the provider's generally available artificial-intelligence models.
• Extracted values are returned to the Authorized User to review, correct, and confirm before the lead is submitted; automated extraction may contain errors and is not a substitute for verification.
• An Authorized User must have obtained the customer's authorization before scanning any document that contains the customer's personal information, consistent with the "Customer Authorization" section above.

Where required by applicable law or DGNC policy, the scanning feature may be limited to certain jurisdictions or disabled. DGNC may change or discontinue the extraction provider at any time.

Protecting Customer Information is an important part of DGNC's business operations. DGNC maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, misuse, or destruction. Depending upon the nature of the information and the systems involved, these safeguards may include:

• role-based access controls;
• authentication controls;
• encryption of data during transmission;
• encryption of stored information where appropriate;
• secure cloud infrastructure;
• audit logging;
• activity monitoring;
• access reviews;
• least-privilege security principles;
• employee training;
• vendor security reviews;
• and other commercially reasonable security practices.

No method of transmitting information over the Internet or storing electronic information can be guaranteed to be completely secure. Accordingly, while DGNC employs reasonable safeguards designed to protect personal information, no security system is infallible, and DGNC cannot guarantee absolute security.

If DGNC becomes aware of a security incident affecting personal information, DGNC will respond in accordance with applicable law and its internal incident response procedures.

Users are responsible for maintaining the confidentiality of their account credentials and promptly notifying DGNC of any suspected unauthorized access to their accounts.

DGNC retains personal information only for as long as reasonably necessary to:

• operate its business;
• provide requested services;
• administer warranties;
• maintain customer relationships;
• comply with contractual obligations;
• satisfy legal, regulatory, tax, insurance, and recordkeeping requirements;
• resolve disputes;
• investigate fraud;
• enforce agreements;
• protect its legal interests;
• improve the Service;
• and fulfill other legitimate business purposes.

Retention periods vary depending upon the nature of the information and applicable legal requirements. When personal information is no longer reasonably necessary for these purposes, DGNC may securely delete, anonymize, or otherwise dispose of the information in accordance with its records management practices.

Authorized Users are responsible for ensuring that information submitted through Bifrost is accurate, complete, and submitted with all required authorizations. Users should promptly update or correct information when inaccuracies become known.

DGNC relies upon Authorized Users and Partner Dealerships to provide accurate information in order to properly deliver services, administer customer requests, and maintain the integrity of its business records.

Depending on your location and applicable law, you may have certain rights regarding your personal information. Subject to identity verification and applicable legal exceptions, you may have the right to:

• request access to the personal information DGNC maintains about you;
• request correction of inaccurate or incomplete personal information;
• request deletion of personal information where permitted by law;
• request information regarding how your personal information is used and disclosed;
• request a copy of certain personal information in a portable format where applicable;
• object to or restrict certain processing activities where permitted by law;
• withdraw consent where processing is based upon consent; and
• exercise any other rights available under applicable privacy laws.

DGNC will respond to verified privacy requests within the timeframes required by applicable law. Certain information may be retained despite a deletion request where necessary to comply with legal obligations, resolve disputes, protect legitimate business interests, prevent fraud, enforce agreements, or complete ongoing business operations.

Privacy requests may be submitted using the contact information provided at the end of this Privacy Policy.

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the "CCPA"), may provide you with additional privacy rights regarding your personal information. Subject to applicable law and verification of your identity, California residents may have the right to:

• know what categories of personal information DGNC has collected;
• know the sources from which personal information was collected;
• understand the business purposes for which personal information is used;
• understand the categories of third parties with whom personal information has been shared;
• request access to personal information maintained by DGNC;
• request correction of inaccurate personal information;
• request deletion of personal information;
• request information regarding the retention of personal information;
• opt out of any sale or sharing of personal information, if applicable; and
• receive equal service and pricing regardless of whether these rights are exercised.

DGNC does not sell personal information. DGNC does not share personal information for cross-context behavioral advertising or targeted advertising as those terms are defined under applicable California law. DGNC does not discriminate against individuals who exercise their privacy rights.

Additional California-specific notices or request procedures may be made available as required by applicable law.

Bifrost uses cookies and similar technologies that are necessary for the operation, security, authentication, and administration of the Service. These technologies may be used to:

• maintain secure user sessions;
• authenticate Authorized Users;
• remember user preferences;
• improve system performance;
• detect fraud and unauthorized activity;
• and support the secure operation of the Service.

As Bifrost evolves, additional cookies or similar technologies may be introduced to improve functionality, security, analytics, or user experience. Third-party services integrated with Bifrost may maintain their own cookie practices, which are governed by their respective privacy policies.

Users may adjust browser settings to manage cookies; however, disabling certain cookies may affect the functionality of the Service.

Bifrost is designed for use by authorized adults acting in a business capacity. The Service is not directed toward children and is not intended for use by individuals under the age of sixteen (16).

DGNC does not knowingly collect personal information directly from children through Bifrost. If DGNC becomes aware that personal information relating to a child has been submitted through the Service without appropriate authorization, DGNC will take commercially reasonable steps to remove or otherwise address that information in accordance with applicable law.

Parents or legal guardians who believe that a child's personal information has been submitted through Bifrost may contact DGNC using the information provided below.

Bifrost is operated from and intended primarily for use within the United States. Personal information processed through the Service is generally stored and processed in the United States.

Individuals who access the Service from outside the United States understand that their information may be transferred to, processed in, and stored within the United States, where privacy laws may differ from those of their country of residence. By accessing or using the Service, users acknowledge and consent to such processing where permitted by applicable law.

Should DGNC expand its operations into additional jurisdictions, this Privacy Policy may be updated to address any additional legal requirements.

DGNC may update this Privacy Policy from time to time to reflect changes in business practices, technology, legal requirements, or the functionality of the Service. When material changes are made, DGNC may provide notice through one or more of the following methods:

• notifications within Bifrost;
• electronic mail;
• postings on DGNC-operated websites;
• or other reasonable means of communication.

The "Last Updated" date at the beginning of this Privacy Policy indicates when the current version became effective. Your continued use of the Service following the effective date of an updated Privacy Policy is subject to the revised Privacy Policy to the extent permitted by applicable law.

Questions regarding this Privacy Policy, privacy practices, data requests, or the handling of personal information may be directed to:

Dealer Glass and Calibrations LLC 139 Sandpiper Ridge Dr., Ormond Beach, Florida 32176

Email: privacy@dealerglassandcalibrations.com