DMSFocus Privacy Policy

Focus Data Solutions, LLC

Effective Date: July 23, 2026 Last Updated: July 23, 2026

1. Introduction and Scope

Focus Data Solutions, LLC ("Focus Data Solutions," "we," "us," or "our") provides DMSFocus, a business-to-business analytics platform for automotive dealerships (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with:

• the DMSFocus web application, dashboards, APIs, and related tools;

• our websites, including dmsfocus.com and its subdomains (the "Site"); and

• our sales, marketing, and support communications.

The Service is a business tool sold to dealerships, dealer groups, and related businesses ("Customers"). It is not directed to or intended for personal, family, or household use, and it is not offered to consumers directly.

This Privacy Policy is a statement of our practices. It is not a contract and does not create rights beyond those provided under applicable law. Our contractual obligations to Customers are set out in the DMSFocus Terms of Service and any separate written agreement or Data Processing Addendum ("DPA") between us and the Customer. In the event of a conflict between this Privacy Policy and a signed agreement with a Customer, the signed agreement controls with respect to that Customer's data.

2. Two Different Roles: Please Read This First

We handle information in two distinct capacities, and your rights and our responsibilities differ depending on which applies.

2.1 Dealer Data — we act as a service provider / processor

Our Customers upload, forward, or otherwise transmit business records from their dealer management systems ("DMS") and related systems to the Service. Those records — including records that identify or relate to the dealership's own customers, employees, and prospects — are referred to in this Policy as "Dealer Data."

The dealership is the controller (or "business") of Dealer Data. We are a service provider and processor. We process Dealer Data only to provide, secure, support, and improve the Service for that Customer, and only in accordance with the Customer's written agreement with us and its documented instructions. We do not sell Dealer Data, we do not share it for cross-context behavioral advertising, and we do not use it to build marketing profiles.

If you are a dealership customer, employee, or other individual whose information appears in Dealer Data, and you wish to exercise privacy rights over that information, contact the dealership that collected it. We will assist that dealership in responding to validated requests as required by law and our agreement with them. We generally cannot verify or act on such requests directly, because we do not have the direct relationship with you and do not control the purposes for which your information was collected.

2.2 Account, Site, and business-contact information — we act as the controller

We act as the controller (or "business") for information we collect for our own purposes, including:

• account and profile information for the individual dealership personnel who use the Service ("Authorized Users");

• billing and subscription information for our Customers;

• Site visitor, prospect, and marketing-contact information; and

• support, security, and usage information described in Section 3.

Sections 12 and 13 describe the rights available with respect to this category of information.

3. Information We Collect

3.1 Dealer Data submitted by Customers

Customers transmit DMS reports to the Service — most commonly by configuring their DMS or email system to deliver scheduled reports to a dedicated ingestion address we assign, and in some cases by direct upload or API. Those reports typically include:

Business and operational records — vehicle sales transactions and summaries; deal-level gross, front-end and back-end amounts, and finance and insurance (F&I) product detail; vehicle inventory, VINs, stocking and floorplan data; repair orders, work-in-process, labor hours, and effective labor rate; parts inventory, aging, obsolescence, and general-ledger balances; service writer and salesperson production; and store, department, and period-level performance metrics.

Personal information about the dealership's customers and prospects, limited to the fields present in the reports the dealership sends, which may include:

| Category | Examples | |---|---| | Identifiers | Customer name; postal address (street, city, state, ZIP); cell, home, and business telephone numbers; email address | | Commercial information | Vehicle purchased or serviced, VIN, deal or repair-order number, sale type (cash, financed, lease, rental, wholesale), transaction dates and amounts, F&I products purchased | | Employment-related information | Names and production metrics of dealership salespeople, service writers, F&I managers, and technicians |

We do not request, and the Service is not designed to ingest, the following about a dealership's customers: Social Security or taxpayer identification numbers, driver's license or government ID numbers, dates of birth, credit reports or credit scores, bank account or payment card numbers, precise geolocation, biometric data, or health information. Customers are contractually responsible for not transmitting these categories to the Service. If such data is transmitted to us despite this restriction, we will treat it as Dealer Data under this Policy and may delete it.

3.2 Account and Authorized User information

When a Customer provisions users, or when an Authorized User signs in, we collect: full name; business email address; the dealership, dealer group, store(s), and department(s) the user is assigned to; role and permission grants (including which modules and stores the user may view); authentication identifiers issued by our identity provider; profile preferences (default landing page, default store, notification and alert preferences); and, where the user is invited, the identity of the inviting administrator.

We do not store user passwords. Authentication is handled by Auth0 (see Section 9). Where a Customer uses single sign-on, credentials are handled by the Customer's identity provider.

3.3 Billing and subscription information

For paying Customers we collect and maintain: the Customer's legal and trade name, billing contact name and email, billing address, subscription plan, seat and store counts, monthly rate, invoice and payment history, and subscription status.

Payment card and bank account details are collected and processed directly by Stripe, our payment processor. We do not receive or store full payment card numbers. We receive limited transaction metadata such as the last four digits, card brand, expiration, authorization result, and Stripe customer and subscription identifiers.

3.4 Information collected automatically

When the Service or Site is used, we and our service providers automatically collect: IP address; browser type, version, and language; operating system and device type; referring and exit pages; pages, modules, and reports viewed; features used and actions taken; date, time, and duration of sessions; search and filter parameters submitted within the application; API and integration request metadata (including API token identifiers, endpoints called, timestamps, and response codes); and error and diagnostic data such as stack traces and performance timings.

We use cookies and similar technologies for these purposes as described in Section 8.

3.5 Support, communications, and security records

We collect information you provide when you contact us for support or otherwise communicate with us, including the contents of support tickets, emails, chat messages, screenshots, call notes, and any files or records you attach. We also maintain records of support sessions in which, with the Customer's authorization, our personnel access a Customer's account to diagnose an issue, together with audit records of that access.

We maintain security and audit logs, including sign-in and sign-out events, failed authentication attempts, permission and role changes, administrative actions, data import runs, and API token issuance and use.

3.6 AI feature inputs and outputs

Certain features — including the Focus AI assistant, the Focus Daily Briefing, the Key Targets setup assistant, and Focus Intelligence narrative coaching notes — send prompts to a third-party large language model provider. Those prompts contain the aggregated business metrics and, where relevant to the request, the record-level Dealer Data needed to answer. We store the resulting outputs, the questions asked, and any feedback the user submits on those outputs. See Section 7.

3.7 Marketplace information

If a Customer uses the parts marketplace, we collect listing information (part numbers, descriptions, condition, quantity, pricing, and images), order information (buyer and seller dealership, contact name, shipping address, quantities, amounts, carrier and tracking numbers), order status history, and related messages.

3.8 Site visitor and marketing information

On the Site we collect the information described in Section 3.4, plus information you voluntarily submit through demo request, contact, or newsletter forms — typically name, business email, phone number, dealership name, role, and any message you write. We may also obtain business-contact information about dealership personnel from publicly available sources, industry lists, events, and reputable business-data providers, for the purpose of marketing our Service to businesses.

4. Sources of Information

We obtain information: (a) directly from Customers and their Authorized Users; (b) automatically from devices and browsers used to access the Service and Site; (c) from our Customers' DMS and email systems, at the Customer's direction, through scheduled report delivery, upload, or integration; (d) from our service providers, including our identity provider, payment processor, hosting providers, and error-monitoring provider; and (e) from publicly available and third-party business-data sources for marketing purposes.

5. How We Use Information

We use information for the following purposes:

To provide and operate the Service — to authenticate users; enforce tenant, store, and module-level access controls; ingest, parse, validate, and store DMS reports; compute metrics, benchmarks, projections, alerts, and reports; render dashboards and drill-downs; generate exports and PDFs; operate the parts marketplace; and deliver notifications and alerts a user or Customer has enabled.

To administer accounts and billing — to provision and de-provision users, manage subscriptions and seat counts, invoice and collect fees, provide receipts and billing portals, and address non-payment.

To provide support — to respond to tickets and inquiries, reproduce and diagnose issues, and, with Customer authorization, access an account to resolve a problem.

To secure the Service — to monitor for, investigate, prevent, and respond to fraud, abuse, unauthorized access, security incidents, and violations of our Terms of Service; to maintain audit trails; and to enforce rate limits and other protective controls.

To maintain, improve, and develop the Service — to monitor performance and reliability, debug errors, run internal analytics on feature usage, test changes, and design new features. Where we use Dealer Data for improvement purposes, we do so consistent with our role as a service provider and, wherever practicable, on aggregated or de-identified data.

To communicate with you — to send service, security, billing, and administrative messages (which Authorized Users cannot opt out of while their account is active); to respond to your requests; and, subject to Section 8 and applicable law, to send marketing communications about our products to business contacts, from which you may opt out at any time.

To comply with law and protect rights — to comply with legal obligations, respond to lawful requests and legal process, establish, exercise, or defend legal claims, and protect the rights, property, safety, and security of Focus Data Solutions, our Customers, and others.

To create aggregated and de-identified data — as described in Section 6.

We do not use Dealer Data for advertising, do not sell it, and do not disclose it to any third party except as described in Section 9.

6. Aggregated and De-Identified Data

We may create aggregated, anonymized, or de-identified data and statistics from information processed through the Service — for example, industry-level or region-level performance benchmarks, model training and tuning inputs for our own analytical models, capacity and reliability metrics, and product-usage statistics. Such data is created and used in a form that does not identify, and cannot reasonably be used to identify, any individual, any Customer, or any dealership store, and is not reverse-engineerable to a specific Customer.

We may use and retain aggregated and de-identified data for any lawful business purpose, including improving and marketing the Service, and this right survives termination of a Customer's subscription. We maintain such data in de-identified form and will not attempt to re-identify it, except as permitted by law to test our de-identification. We will not disclose aggregated data in a manner that identifies an individual Customer, dealership, or person without that party's consent.

7. Artificial Intelligence Features

Some features of the Service use third-party large language models to summarize, narrate, or answer questions about a Customer's data. You should understand the following:

• What is sent. When an AI feature is invoked, the relevant metrics and, where necessary to answer, record-level Dealer Data from the requesting user's authorized scope are transmitted to our AI provider (currently OpenAI) for processing. AI features respect the same store, department, and module permissions as the rest of the Service.

• Training. We use our AI provider under commercial API terms that do not permit the provider to use our inputs or outputs to train its models. We do not authorize any AI provider to train on Dealer Data.

• Retention by the provider. Our AI provider may retain inputs and outputs for a limited period for abuse monitoring and legal compliance, in accordance with its enterprise API terms.

• Accuracy. AI-generated narratives, briefings, insights, and coaching notes are automated interpretations and may be incomplete or wrong. Numeric figures presented in AI narratives are computed by our deterministic calculation engine, not by the language model, and the Service validates that the model reproduces those figures; nevertheless, all AI output should be independently verified before being relied upon for any business decision. See the Terms of Service for the applicable disclaimers.

• Control. AI features are gated at the tenant level and, for certain features, at the individual user level. A Customer administrator may disable them. Customers who do not wish to have any Dealer Data processed by an AI provider should contact us to have these features disabled for their tenant.

8. Cookies, Analytics, and Your Choices

Strictly necessary cookies. The Service uses cookies and similar storage that are required to operate — to establish and maintain an authenticated session, protect against cross-site request forgery, remember your tenant and store context, load balance, and preserve interface preferences. The Service cannot function without these.

Analytics and performance. We and our providers collect usage and performance telemetry as described in Section 3.4 to understand how features are used and to detect and diagnose errors. Our error-monitoring provider is configured to scrub personal information from captured events.

Advertising. We do not use the Service to serve third-party targeted advertising, and we do not permit third-party advertising trackers inside the authenticated application. Our public marketing Site may use limited analytics and marketing-attribution technologies; where required by law, we present a cookie notice and honor available choices.

Your choices. Most browsers let you refuse or delete cookies; blocking strictly necessary cookies will prevent the Service from working. Some browsers transmit a Global Privacy Control (GPC) or similar opt-out preference signal; because we do not sell personal information or share it for cross-context behavioral advertising, there is no such activity to opt out of, but we honor recognized signals where required. You may opt out of marketing emails using the unsubscribe link in any marketing message or by contacting us; you will continue to receive transactional and service messages.

9. How We Disclose Information

We disclose information only as follows.

9.1 To the Customer and its authorized personnel

Dealer Data is made available to the Customer that owns it and to the Authorized Users that Customer designates, subject to the store, department, and module permissions the Customer configures. A Customer's administrators can see the activity, permissions, and account information of users within that Customer's account. If you use the Service through your employer, your employer controls your account.

9.2 To service providers and subprocessors

We use the following third parties to deliver the Service. Each is bound by contract to process information only as needed to perform its function for us, to protect it, and not to use it for its own purposes.

| Subprocessor | Function | Data involved | |---|---|---| | Vercel Inc. | Application hosting, edge delivery | All data transiting the application | | MongoDB, Inc. (Atlas) | Primary database hosting (data at rest) | Dealer Data, account, billing metadata | | Render Services, Inc. | Hosting of the report-ingestion service | Inbound DMS reports in transit | | Twilio Inc. (SendGrid) | Inbound report parsing and outbound transactional email | Inbound DMS reports; email addresses and message content | | Okta, Inc. (Auth0) | Authentication and identity management | Authorized User identifiers and authentication events | | Stripe, Inc. | Subscription billing and payment processing | Customer billing information and payment details | | OpenAI, L.L.C. | Large language model processing for AI features | Prompt contents as described in Section 7 | | Functional Software, Inc. (Sentry) | Application error and performance monitoring | Diagnostic events, scrubbed of personal information | | GitHub, Inc. / Microsoft | Source control and engineering operations | No Dealer Data in the ordinary course |

We may add or replace subprocessors as the Service evolves. Customers with a DPA will receive notice of material subprocessor changes as provided in that DPA. A current list is available on request at the address in Section 17.

9.3 Marketplace counterparties

If a Customer lists or purchases parts through the marketplace, information reasonably necessary to complete the transaction — including the dealership's identity, contact person, shipping address, order contents, and tracking information — is disclosed to the counterparty dealership. Focus Data Solutions is not a party to those transactions. See the Terms of Service.

9.4 Professional advisors and corporate transactions

We may disclose information to our auditors, accountants, insurers, and legal counsel under duties of confidentiality, and to a successor or acquirer in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, provided that the recipient agrees to handle the information consistent with this Policy and any applicable Customer agreement, and that Customers are notified as required by their agreement.

9.5 Legal and safety disclosures

We may disclose information if we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process, or is reasonably necessary to enforce our agreements, investigate suspected fraud or violations, or protect the rights, property, or safety of Focus Data Solutions, our Customers, or the public. Where Dealer Data is the subject of a legal demand and we are legally permitted to do so, we will notify the affected Customer so it may seek a protective order or other appropriate remedy.

9.6 What we never do

We do not sell personal information, and we have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months. We do not disclose Dealer Data to other dealerships or dealer groups, and the Service enforces tenant isolation designed to prevent one Customer from accessing another Customer's data.

10. Data Security

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, disclosure, and destruction, appropriate to the sensitivity of the data and the size and complexity of our business. Current measures include:

• Encryption of data in transit using TLS and of data at rest at the storage layer.

• Tenant isolation enforced at the application and data-access layers, with server-side authorization on data-serving routes rather than client-side enforcement alone.

• Role- and grant-based access control, including per-user store, company, and module grants, with restrictive changes taking effect on re-authentication.

• Authentication through a dedicated identity provider, with support for organization-based access.

• Network restriction of the production database to approved application infrastructure, and IP allowlisting of administrative interfaces.

• Authenticated, signed ingestion — report-import requests between our ingestion service and the application are cryptographically signed, and the destination tenant is resolved server-side rather than accepted from the caller.

• Logging and monitoring, including audit trails of administrative access and support sessions, and error monitoring configured to scrub personal information.

• Least privilege for personnel access, granted only to those who need it to perform their duties, and revoked on role change or separation.

• Change management, including code review, automated testing, and dependency vulnerability management.

No method of transmission or storage is completely secure. While we work hard to protect information, we cannot and do not guarantee absolute security, and we do not warrant that the Service will be free of vulnerabilities or that unauthorized access will never occur. You are responsible for maintaining the confidentiality of your credentials, for promptly de-provisioning users who leave your organization, and for notifying us of any suspected compromise.

Incident notification. If we become aware of a security incident affecting Dealer Data, we will notify the affected Customer without undue delay and in any event within the timeframe required by our agreement with that Customer and applicable law, and will cooperate reasonably in the Customer's own notification and remediation obligations. Because the dealership is the controller of Dealer Data, notification to affected individuals and regulators is the dealership's responsibility unless law or contract provides otherwise.

11. Data Retention

We retain information for as long as needed for the purposes described in this Policy, and thereafter as required for legal, tax, accounting, audit, dispute-resolution, and security purposes.

• Dealer Data is retained for the duration of the Customer's subscription, because the Service's value depends on multi-year historical trend analysis. Following termination or expiration of a subscription, Dealer Data is retained during the post-termination export window described in the Terms of Service and is then deleted or de-identified in the ordinary course, subject to backup retention cycles and any legal hold.

• Account and Authorized User records are retained while the account is active and for a reasonable period afterward for audit and dispute-resolution purposes.

• Billing records are retained as required by tax and accounting law, typically at least seven (7) years.

• Security, audit, and diagnostic logs are retained on a rolling basis, typically for up to twelve (12) months, unless a longer period is needed for an investigation.

• Aggregated and de-identified data may be retained indefinitely, as described in Section 6.

• Backups are retained on a rolling schedule and expire automatically; deleted data may persist in backups until those backups cycle out.

Customers may request deletion of their Dealer Data at any time as provided in the Terms of Service or their agreement with us.

12. Your Privacy Rights

12.1 Individuals whose data appears in Dealer Data

If you are a dealership's customer, prospect, or employee and your information reaches us through a dealership's reports, please direct your request to that dealership. As a service provider, we act only on the instructions of the dealership with respect to that data. We will assist the dealership in identifying, exporting, correcting, or deleting your records as required by our agreement with it and applicable law. If you contact us directly, we will, where we can identify the relevant dealership, forward your request to it and tell you we have done so.

12.2 Authorized Users, Site visitors, and business contacts

Depending on where you live, you may have some or all of the following rights with respect to information for which we are the controller: to know or access the personal information we hold about you and how we use and disclose it; to correct inaccurate information; to delete your information; to obtain a portable copy; to opt out of sale, sharing for cross-context behavioral advertising, and profiling with legal or similarly significant effects (we do not engage in these activities); to limit the use of sensitive personal information (we do not collect sensitive personal information for our own purposes); and to be free from discrimination for exercising your rights.

How to exercise a right. Email privacy@dmsfocus.com or write to us at the address in Section 17, stating the right you wish to exercise. We will acknowledge and respond within the time required by applicable law — generally forty-five (45) days, extendable where permitted.

Verification. To protect your information, we will take reasonable steps to verify your identity before acting, typically by confirming control of the email address associated with your account or by matching information you provide against our records. We may decline a request we cannot verify.

Authorized agents. You may use an authorized agent where the law permits; we may require proof of the agent's authority and direct verification from you.

Appeals. If we decline your request, you may appeal by replying to our response or writing to privacy@dmsfocus.com with the subject line "Privacy Appeal." We will respond to the appeal within the period required by applicable law and, if we deny it, will provide information about any further recourse available to you, including contacting your state attorney general.

Note on limits. Some information is exempt from these rights, including information subject to the Gramm-Leach-Bliley Act (Section 13), information we must retain to comply with law, and information necessary to detect security incidents or protect against fraud or illegal activity.

13. Financial Privacy Laws (GLBA) and Other Sector Rules

Automotive dealerships that arrange financing or leasing are generally "financial institutions" subject to the Gramm-Leach-Bliley Act ("GLBA") and the FTC Safeguards Rule, and some Dealer Data may constitute "nonpublic personal information" under GLBA. Where that is the case:

• We act as a service provider to the dealership and are contractually obligated to maintain appropriate safeguards for that information and to use it only for the purposes for which it was disclosed to us.

• Information subject to GLBA is exempt from most U.S. state consumer privacy laws, and requests concerning it must be handled by the dealership under its own GLBA privacy notice.

• The dealership remains responsible for providing GLBA privacy notices and opt-outs to its customers, for its obligations under the Safeguards Rule (including oversight of its service providers), and for its compliance with the FTC and CFPB rules applicable to it.

Dealerships are also responsible for their own compliance with laws including the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and state law governing the collection and use of consumer information — including with respect to any use they make of information surfaced by the Service, such as customer contact information used for marketing.

14. Children's Privacy

The Service is a business tool intended for use by individuals aged 18 or older acting in a professional capacity. We do not knowingly collect personal information from children under 16 for our own purposes. If we learn we have collected such information other than as Dealer Data submitted by a Customer, we will delete it. If you believe a child's information has been provided to us, contact privacy@dmsfocus.com.

15. Location of Processing and International Users

The Service is offered to businesses in the United States, and information is stored and processed in the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law, and you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction. We do not currently offer the Service to individuals in the European Economic Area, the United Kingdom, or Switzerland on the basis of the GDPR, and this Policy does not constitute a GDPR-compliant notice; Customers with such requirements should contact us before transmitting any data subject to those laws.

16. Third-Party Sites and Services

The Service and Site may link to or interoperate with third-party websites and services, including a Customer's DMS provider, identity provider, and marketplace counterparties. We do not control those third parties, and this Policy does not apply to them. Review their privacy policies before providing information to them.

17. Changes to This Policy and How to Contact Us

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and post the revised Policy on the Site. If we make material changes to how we handle information for which we are the controller, we will provide additional notice, such as by email to account administrators or an in-application notice, before the change takes effect. Changes affecting our handling of Dealer Data will be made in accordance with our agreements with Customers. Your continued use of the Service after the effective date of a revision constitutes acceptance of it.

Contact us:

Focus Data Solutions, LLC Attn: Privacy Mailing address available on request at privacy@dmsfocus.com Email: privacy@dmsfocus.com Legal notices: legal@dmsfocus.com

Appendix A — U.S. State Privacy Law Disclosure Table

The following describes, for the twelve months preceding the Last Updated date, information for which we act as the controller/business (Section 2.2). Dealer Data is excluded from this table because we process it only as a service provider.

| Statutory category | Do we collect it? | Sources | Business purpose | Disclosed to (for a business purpose) | Sold or shared? | |---|---|---|---|---|---| | Identifiers (name, business email, phone, IP address, account ID) | Yes | You; your employer; automatic collection; business-data sources | Account provisioning, authentication, support, billing, security, marketing | Hosting, identity, email, billing, and monitoring providers | No | | Customer records (billing contact and billing address) | Yes | You; your employer | Billing and collections | Payment processor; accountants | No | | Commercial information (subscription plan, purchase history) | Yes | Your transactions with us | Billing, account management, support | Payment processor; accountants | No | | Internet/network activity (usage, pages viewed, diagnostics) | Yes | Automatic collection | Operating, securing, and improving the Service | Hosting and monitoring providers | No | | Professional/employment information (job title, dealership, role) | Yes | You; your employer; business-data sources | Account provisioning, permissions, support, marketing | Hosting and identity providers | No | | Geolocation (coarse, derived from IP) | Yes | Automatic collection | Security and fraud prevention | Hosting and monitoring providers | No | | Audio/visual (support screenshots or recordings you send) | Only if you provide it | You | Support | Hosting provider | No | | Sensitive personal information (SSN, government ID, financial account, precise geolocation, biometric, health, race, religion, union membership, contents of private communications) | No | — | — | — | No | | Inferences used to create a personal profile | No | — | — | — | No |

We retain each category for the periods described in Section 11.

*This document describes Focus Data Solutions, LLC's privacy practices as of the effective date above. It is provided for informational purposes and does not constitute legal advice.*