CartelOne

Workforce Privacy Notice

Effective date: June 25, 2026  ·  Legal entity: AutoCartel Texas LLC

1. Introduction and Scope

This Workforce Privacy Notice explains how AutoCartel Texas LLC and its applicable affiliated organizations (“we,” “us,” or the “Company”) collect, use, share, and protect personal information when you use the CartelOne platform, including the cartelone.com web application and any associated mobile applications (the “Platform”).

CartelOne is an internal workforce tool intended solely for authorized employees, contractors, managers, administrators, and affiliated personnel of AutoCartel Texas LLC and its affiliated organizations. It is not intended for the general public. This Notice applies to personal information processed in connection with that internal workforce use and does not apply to public consumer services.

2. Categories of Personal Information We Collect

2.1 Account and identity data

Name, work email address, role (Photographer or Administrator), employee or HomeNet identifier, and your assigned rooftop, region, and market.

2.2 Compensation and performance data

Pay rates, earnings and bonus figures, units or photos produced, and related performance, productivity, ranking, leaderboard, goal, scheduling, attendance, workload, and operational metrics made available through the Platform. Some of this data originates from connected systems (see Section 4).

2.3 Systems, device, and usage data

Log-in information, authentication records, device and browser data, IP address, session activity, timestamps, app usage information, error logs, and other technical information generated through use of the Platform. We do not use third-party analytics or crash-reporting tools. Usage and device data is limited to server-side logs and the identifiers needed to keep you signed in and to secure the Platform.

2.4 Information from integrations and Company systems

Information imported or received from workforce management, scheduling, payroll, HR, operational, identity, and related systems, including Connecteam (scheduling and workforce data, accessed through its API) and reference data about dealerships and rooftops maintained by the Company.

3. How We Use Personal Information

We use personal information to:

4. How We Share Personal Information

We do not sell your personal information. We may disclose personal information to:

We do not disclose personal information from the Platform for public marketing or advertising purposes.

5. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Notice, including to administer the workforce relationship, operate the Platform, maintain payroll and business records, investigate disputes, enforce agreements and policies, comply with legal obligations, and protect against fraud and security incidents.

Payroll, compensation, performance, and employment-related records may be retained for up to seven (7) years following account termination or separation, or longer if required by applicable federal, state, tax, employment, or legal recordkeeping requirements. Information may be retained in backups, archives, and logs for a period of time after active use ends. Deletion is not immediate or absolute, and some information cannot be deleted where retention is required by law or necessary to protect the Company’s legal rights.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information appropriate to the nature of the information we process, including encryption of data in transit and role-based access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Users are responsible for maintaining the confidentiality of their credentials and for promptly reporting suspected unauthorized access or security concerns to the Company.

7. Data Location and Cloud Hosting

The Platform and its providers operate in the United States. By using the Platform, you acknowledge that your personal information may be processed by cloud-based infrastructure and service providers, including Supabase and Vercel, which may process data in data centers located in the United States.

8. Access, Corrections, and Privacy Requests

Subject to applicable law, users may request access to certain personal information, request correction of inaccurate information, or ask questions about our privacy practices by contacting us using the details in Section 14. We may limit or deny a request where permitted by law, including where information must be retained for payroll, tax, employment, legal, audit, or recordkeeping purposes, or where disclosure would adversely affect the rights of others or the security of the Platform.

If you believe payroll, compensation, or performance information displayed in the Platform is inaccurate, you should promptly notify the Company through your manager, HR, payroll department, or the support contact below.

9. Account and Data Deletion

You may request deletion of your account and personal data by navigating to your profile within the app, selecting Delete Account, and confirming the action. Profile information, login credentials, and usage data will be permanently deleted upon confirmation. Payroll, compensation, employment, and legal records may be retained for the period specified in Section 5 as required by applicable law. Once the applicable retention period expires, remaining data associated with your account will be permanently deleted.

10. Supplemental State-Law Privacy Rights

Depending on where you are located and the Company’s legal obligations, additional privacy rights or disclosures may apply. The Company will provide supplemental notices where required by applicable law.

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended (CCPA/CPRA), including rights to know, delete, and correct personal information, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

11. Children’s Privacy

The Platform is intended only for authorized adults (18 years or older) and is not directed at children. We do not knowingly collect personal information from anyone under 18.

12. Cookies and Similar Technologies

The web application uses cookies and similar technologies that are strictly necessary to sign you in and keep the Platform secure. We do not use any non-essential, analytics, or advertising cookies or SDKs. The web application stores a single functional cookie (sidebar:state) that remembers your sidebar layout preference and uses browser local storage to keep you signed in. No consent banner is required for these strictly-necessary technologies.

13. Push Notifications

CartelOne may send push notifications related to payroll updates, performance metrics, goal tracking, leaderboard rankings, operational reminders, Company communications, and account and security notifications. You can manage notification preferences through the application settings.

14. Contact Us

For privacy questions, to exercise your rights, or to report a security concern, contact:

Privacy Officer
AutoCartel Texas LLC
support@autocartel.com

15. Updates to This Notice

We may update this Workforce Privacy Notice from time to time. The effective date at the top reflects the latest version. Material changes will be communicated through the Platform or by other reasonable means. Your continued use of the Platform after changes are posted constitutes acknowledgment of the updated Notice.