OTOPHYX COMPREHENSIVE GLOBAL
PRIVACY POLICY AND STATUTORY DISCLOSURE

1. INTRODUCTION AND CORPORATE COMMITMENT

OtoPhyx, Inc., including its global subsidiaries, parents, and affiliates (collectively, "OtoPhyx," the "Company," "we," "us," or "our"), operates with a commitment to transparency and the highest standards of data stewardship. This Comprehensive Global Privacy Policy ("Policy") is designed to meet and exceed the requirements of the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR), and other applicable global data protection frameworks.

This Policy governs all data processing activities associated with our digital ecosystem, including but not limited to our primary domain otophyx.com, our mobile applications available on the Apple App Store and Google Play Store, our proprietary APIs, and any offline interactions (collectively, the "Services").

BY INTERACTING WITH OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS POLICY IN ITS ENTIRETY. YOUR CONTINUED USE CONSTITUTES CONSENT TO THE PROCESSING OF YOUR DATA AS OUTLINED HEREIN.

2. THE CATEGORIES OF DATA WE COLLECT (EXHAUSTIVE LIST)

OtoPhyx collects data to provide a seamless automotive marketplace experience. We categorize the information we collect as follows:

A. Personal Identifiers and Demographic Information

• Direct Identifiers: Full legal name, alias, unique personal identifier, online identifier, IP address, email address, account name, and phone number.
• Government-Issued Identifiers: Driver's license number, passport number, or Social Security number (collected only where strictly necessary for tax reporting or high-value transaction verification).
• Demographics: Age, gender, race, ethnicity, and marital status (where provided voluntarily or inferred for marketing optimization).

B. Commercial and Financial Data

• Vehicle Telemetry and Records: Vehicle Identification Number (VIN), make, model, year, engine type, mileage, service history, and diagnostic trouble codes (DTCs).
• Transaction History: Records of quotes requested, appointments booked, services completed, and payments made.
• Financial Instruments: Credit/debit card numbers (tokenized), bank account details for payouts, and billing addresses.

C. Digital and Network Activity (The "Digital Footprint")

• Browsing Behavior: URL clickstreams, time spent on specific pages, bounce rates, and navigation patterns.
• Technical Metadata: Browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Interaction Data: Engagement with advertisements, emails opened, and links clicked within our newsletters.

D. Geolocation and Sensory Data

• Precise Geolocation: GPS-based coordinates collected via mobile devices to facilitate nearby shop discovery and towing services.
• Audio/Visual Data: Recorded customer service calls for quality assurance, and photographs of vehicles uploaded for damage assessment or service verification.

E. Inferences and Derived Data

• Consumer Profiles: Sophisticated profiles drawn from the data above reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, and aptitudes.

3. METHODS OF DATA COLLECTION

We utilize a multi-layered approach to data acquisition:

• Direct Submission: Information you provide when creating an account, filling out forms, or communicating with our support team.
• Automated Collection (Cookies and Tracking): We use first-party and third-party cookies, web beacons, pixel tags, and local storage (HTML) to track activity.
• Third-Party Integration: We receive data from automotive service providers (shops), marketing partners, credit reporting agencies, and social media platforms (when you link your account).

4. GRANULAR BUSINESS PURPOSES FOR PROCESSING

OtoPhyx processes your data for the following essential business functions:

• Service Fulfillment: Facilitating the matching process between vehicle owners and service providers.
• Product Optimization: Utilizing machine learning and AI to improve our recommendation engines.
• Fraud Prevention: Deploying advanced heuristics to detect and mitigate fraudulent bookings and payments.
• Legal Defense: Maintaining records necessary to defend against legal claims or to comply with subpoenas and court orders.
• Direct Marketing: Sending tailored communications regarding vehicle maintenance reminders and promotional offers.

5. DATA SHARING AND DISCLOSURE PROTOCOLS

We do not sell your personal information for money. However, we "share" data in the following contexts:

• Service Providers (The "Fulfillment Chain"): We transmit your vehicle and contact data to the specific repair shops or towing companies you select.
• Corporate Affiliates: We share data within our corporate family for centralized management and strategic planning.
• Marketing Partners: We share hashed identifiers with platforms like Google and Meta for cross-context behavioral advertising.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred as a core business asset.

6. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA) - THE "BILL OF RIGHTS"

California residents are afforded the following statutory protections:

• Right to Know: The right to request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: The right to request the deletion of your data, subject to legal and operational retention requirements.
• Right to Correct: The right to demand the rectification of inaccurate personal data.
• Right to Opt-Out of Sale or Sharing: The right to direct us not to sell or share your information for targeted advertising.
• Right to Limit Sensitive Data: The right to restrict our use of sensitive personal information (e.g., precise geolocation) to only what is necessary to provide the Services.
• Right to Non-Discrimination: We will not deny you services or provide a different level of quality if you exercise these rights.

7. INTERNATIONAL DATA TRANSFERS AND THE "SAFE HARBOR"

OtoPhyx is headquartered in the United States. If you are accessing our Services from the EU, UK, or other regions with laws governing data collection and use, please note that you are transferring your personal information to the United States. We utilize Standard Contractual Clauses (SCCs) and other approved mechanisms to ensure your data remains protected.

8. DATA RETENTION AND ARCHIVAL POLICIES

We adhere to a strict data minimization principle. Your data is retained only for the duration of your active relationship with us plus a mandatory archival period (typically 7 years) to comply with tax, legal, and regulatory statutes of limitations.

9. CHILDREN'S PRIVACY (COPPA COMPLIANCE)

Our Services are not intended for individuals under the age of 18. We do not knowingly collect data from children under 13. If we discover such data has been collected, we will initiate an immediate purge of that information from our servers.

10. SECURITY ARCHITECTURE

OtoPhyx employs a "Defense-in-Depth" security strategy, incorporating:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit.
• Access Control: Strict Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) for all internal systems.
• Monitoring: 24/7 security monitoring and periodic penetration testing by third-party firms.

11. GOOGLE PLAY DATA SAFETY AND DELETION

In compliance with Google Play's Data Safety requirements, users may request full account and data deletion at any time via our dedicated portal: https://otophyx.com/accountdeletion. Requests are typically processed within 30 days.

12. AMENDMENTS AND NOTIFICATION

OtoPhyx reserves the right to amend this Policy at its sole discretion. We will notify you of material changes via email or a prominent notice on our platform. Your continued use of the Services after such notification constitutes your acceptance of the revised Policy.

13. CONTACT THE PRIVACY OFFICE