Safety & Compliance

DEOS AI Governance Policy

Dealer Data Protection, Controlled Autonomy, And Responsible Platform Intelligence

Company: I REVLAB, INC.
Author: DEOS Engineering, Management, and Legal Departments
Document Owner: DEOS Management, with Engineering and Legal oversight
Version: 1.0 Prepared: November 4, 2026

01. Purpose, Scope, And Governing Standard

DEOS exists to coordinate dealership engagement and authorized operational workflows while preserving each dealership's control of its information, business decisions, and customer relationships. This Policy establishes the requirements governing the AI systems, agents, models, retrieval services, integrations, media tools, and supporting technology used to perform those functions.

The scope includes DEOS, covered REVLAB VIDEO™ and legacy REPLAi™ services, internal administrative tools, contracted processing, and enabled production, pilot, trial, free-access, and beta environments. An evaluation designation does not reduce privacy, confidentiality, consent, or isolation requirements. Personnel and providers acting for the Company must follow the controls applicable to their work.

Autonomy means permission to execute a defined task within approved limits. It does not mean authority to disregard privacy, change dealership policy, expand access, or make unrestricted commercial decisions.

This Policy establishes mandatory governance requirements. An AI capability may process production dealership information only after its relevant controls have been implemented, tested, and approved. A planned integration or development component does not become an approved production processing path because it appears in a diagram, software repository, or vendor catalog.

The Policy is organized around the NIST AI Risk Management Framework's Govern, Map, Measure, and Manage functions and draws on its Generative AI Profile. These are voluntary reference frameworks, not certifications or governmental endorsements.[^1]

02. Core Commitments

These commitments apply to generated text and media, embeddings, classifications, recommendations, workflow decisions, tool calls, and derived data. Changing a record's format, removing its name, or placing it in model parameters does not automatically remove its protection.

03. Accountability And Governance Ownership

Management assigns named individuals to the following responsibilities. In a smaller organization, an individual may hold more than one role, but material production changes require review by someone other than their implementer.

The governance owners must review material incidents, unresolved high risks, deployment changes, model performance, provider changes, and corrective actions at least quarterly. This Policy must be reviewed at least annually and after a material change in architecture, law, processing purpose, or risk.

A risk exception must identify its owner, scope, compensating controls, expiration, and required approvals. An exception cannot waive law, an individual's rights, contractual data-use restrictions, or the core prohibition on unauthorized cross-dealer access and external shared-AI processing. Where those requirements cannot be met, the affected capability remains disabled.

04. Data Classification, Purpose, And Source Authority

The Dealer Data Universe (DDU) is the dealership-scoped context connecting authorized records, identities, interactions, permissions, and outcomes. It supports coordination among the DMS, CRM, DEOS, F&I, inventory, website, scheduling, and other approved systems. It does not make every connected record available to every user or replace the originating system's designated authority.

Protected Dealer Information includes DDU content; customer and employee information; DMS, CRM, F&I, inventory, and service records; private prompts and conversations; communication permissions; customer-specific outputs; likeness and biometric assets; and confidential dealership commercial information. Derived profiles, embeddings, summaries, and engagement histories remain protected when they contain, reveal, or permit inference about that information.

Each data source requires an identified purpose, lawful access authority, permitted fields, receiving systems, retention basis, and source owner. The integration register must specify the authoritative source for material facts and the permitted read and write operations. An agent's answer is not authority to change a posted transaction or override an approved price.

The Company does not sell, rent, or trade Protected Dealer Information, provide it to data brokers, or use it for another business's independent marketing or cross-context behavioral advertising. The processing license needed to provide DEOS does not create a separate right to monetize dealership records.

The Company must limit collection, retrieval, and processing to what an enabled function requires. General conversation and support channels must not serve as unrestricted intake for Social Security numbers, credit applications, payment-card details, credentials, regulated biometrics, or similarly sensitive information. Financial and other restricted data require specifically approved workflows.

Dealerships remain responsible for the accuracy and lawfulness of their supplied source information and instructions. DEOS remains responsible for its own processing, agreed reconciliation functions, and application of valid corrections and restrictions. Missing or conflicting records must produce a qualified answer, a held action, or escalation according to risk; the system must not invent a source fact to complete a task.

05. The DEOS AI Processing Boundary

5.1 Protected Processing

DEOS DOES NOT USE A DEALERSHIP'S PRIVATE CUSTOMER RECORDS, PROMPTS, CONVERSATIONS, BIOMETRIC INFORMATION, OR LIKENESS ASSETS TO TRAIN SHARED OR GENERAL-PURPOSE AI MODELS FOR UNRELATED CUSTOMERS.

Protected Dealer Information must not be submitted to a public chatbot, outside shared LLM application, independent model API, external AI research service, or provider-controlled AI product for independent analysis, enrichment, training, or product improvement. This restriction includes indirect submission through an agent, plug-in, web search, embedding service, reranker, moderation tool, speech service, media service, or debugging assistant.

An outside provider's statement that it does not train on inputs is not, by itself, permission to send protected DDU information to that provider's shared AI application. Approval requires conformity with the processing boundary and the governing Agreement. A user prompt or administrator setting cannot create an exception.

DEOS may use authorized cloud hosting, storage, networking, and inference-compute providers to operate Company-controlled workloads within the approved boundary. The required distinction is operational and contractual control: approved execution environment, controlled data access and egress, restricted provider use, defined retention, and accountable administration. It is not a claim that every model weight, software component, physical server, or GPU was developed or owned by the Company.

Third-party model weights or licensed components may be used only under reviewed terms and an approved deployment. Their origin does not authorize exporting customer context to their publisher. A private network address or dedicated endpoint alone does not establish that a workload meets these requirements.

5.2 Necessary Operational Exchanges

Authorized messages necessarily reach recipients and contracted delivery providers. Approved connectors exchange defined information with the dealership's source systems. Payment, recall, and other expressly enabled services may require minimum-scope operational exchanges. Lawful disclosures may also be required.

These exchanges must be recorded in the data-flow and provider inventory. They do not grant unrestricted DDU access or independent AI reuse. For example, a text carrier receives the destination number and authorized message needed for delivery; it does not receive the dealership's full customer database. Carrier processing and customer-authorized source synchronization are distinct from submitting private context to an outside shared AI model.

Every applicable contract must restrict use, access, retention, onward processing, and independent training, and provide appropriate deletion, security, incident, and oversight obligations. The Company must assess whether a provider acts as a subprocessor, another service provider, or an independently responsible recipient for the specific exchange.

5.3 Enforcing The Boundary

Production architecture must use an approved model and endpoint registry, restricted credentials, controlled outbound destinations, and data-aware routing. Restricted payloads must fail closed when an approved processing path is unavailable. There must be no undisclosed fallback to a public or shared model service.

Model context, attachments, tool results, audio, video, and logs must follow the same classification rules as their underlying information. Egress tests must cover successful requests, retries, timeouts, error reporting, provider observability, and administrative troubleshooting. A provider or deployment change requires revalidation before receiving production information.

06. Dealership Isolation And Authorized Group Access

Each dealership must have a separately identified tenant environment with enforced logical segregation or a stronger contracted deployment arrangement. Shared infrastructure is permitted only where the required separation is preserved. A tenant environment does not inherently promise a dedicated server, GPU, database server, or cloud account.

Isolation must operate at each material boundary:

A dealer group, OEM, agency, common brand, shared employee, or matching customer name does not establish authority to combine records. Group access requires documented authority for each participating dealership and a defined purpose and scope. Authorized consolidated business reporting must preserve source permissions and must not create a pooled cross-dealer customer identity graph or reusable customer-level DDU.

Support and emergency access must be necessary, time-limited, approved through the applicable procedure, and logged. Privileged access must not create a standing right to browse unrelated stores. Termination or role changes must revoke access and invalidate affected sessions and credentials according to the access-control procedure.

07. Improvement Without Cross-Dealer Data Transfer

7.1 Three Different Activities

DEOS distinguishes using a dealership's information to serve that dealership, improving the common platform, and training a reusable model. They require different authority and controls.

More usage can expose recurring technical defects, integration needs, and interaction-design limitations. Addressing those issues can strengthen common capabilities for eligible users. This is a controlled development process, not an unrestricted entitlement to ingest every interaction into shared machine learning.

7.2 Behavior Patterns Are Not Automatically Anonymous

A customer response, appointment outcome, conversion event, preferred contact time, vehicle association, employee action, or dealership-specific engagement tactic can reveal private or commercially sensitive information even after names are removed. Calling that information a “behavior pattern,” “model-level insight,” “embedding,” “aggregate,” or “learning signal” does not authorize its reuse across dealers.

DEOS DOES NOT POOL ONE DEALERSHIP'S DDU CUSTOMER INFORMATION WITH ANOTHER DEALERSHIP'S INFORMATION, INCLUDING THROUGH A POOLED DATASET LABELED AGGREGATED OR DEIDENTIFIED.

Under the existing subscription protections, shared operational telemetry is limited to measures such as technical capacity, latency, and error rates that do not contain or combine protected dealership content. Tenant-specific operational logs remain protected even when central personnel need them for a permitted support or security task. Hashing identifiers or transmitting model gradients is not an automatic exception.

Common improvements may reflect general engineering lessons, such as adding a confirmation check after an uncertain booking or improving handling of an interrupted conversation. Engineers must express and test those changes without carrying across a dealership's records, private wording, specific conversion tactics, commercial parameters, or customer behavior history. Synthetic examples must be created independently or reviewed to ensure they do not reproduce protected source material.

An example that may be shared is a generic rule to verify destination acceptance before marking a booking complete. An example that may not be shared is a particular dealer's customer-response history used to optimize a competing dealer's audience, timing, offer, or sales approach.

7.3 Controlled Model Development

Any training, fine-tuning, evaluation, retrieval tuning, distillation, reinforcement learning, or feedback pipeline must have a recorded purpose, input provenance, data classification, legal authority, permitted destination, retention schedule, and owner. Private content must not leak into a shared model through human annotation, examples in tickets, stored agent traces, distilled outputs, or synthetic data derived from protected records.

Customer-specific learning remains tenant-restricted and requires the applicable authorization. A separately authorized replica is not permission to train unrelated models. If a training input is later found to be impermissible, the affected dataset and artifacts must be isolated, investigated, and remediated; releasing a replacement requires evidence that the prohibited contribution is no longer present or usable.

No production interaction may autonomously rewrite shared model weights or expand a common agent's authority. Changes require the evaluation and release process in Section 12. A broader cross-dealer engagement-learning program would require a separate legal and technical design and valid changes to governing obligations before use; this Policy does not authorize one by implication.

08. Competitive Neutrality And Independent Dealership Decisions

DEOS is governed as a common technology foundation. It must not function as a conduit for one dealership to obtain another's confidential records, strategy, private performance, customer relationships, or operating decisions.

The Company prohibits using nonpublic competitor information to determine another dealer's prices, concessions, compensation, inventory decisions, targeting, or commercial strategy. This restriction applies to recommendations and model training as well as direct disclosure. Identical software availability does not make the exchange of competitively sensitive information permissible. Antitrust scrutiny of algorithmic coordination is a relevant governance consideration, not a certification that a particular architecture eliminates all competition-law risk.[^2]

General improvements are released under documented product scope, entitlements, availability, and staged deployment criteria. No dealership purchases access to another dealer's protected intelligence through a premium feature, agency role, group designation, or support request. Differences in lawful local data, configuration, deployment, and execution can produce different results; the Policy does not promise identical commercial outcomes.

The system must not secretly steer customers or opportunities between dealerships to benefit the Company or another participant. Any authorized multi-store routing program requires its own disclosed business rules, permissions, and conflict review. DEOS does not guarantee that misuse is technically impossible; it requires prevention, testing, detection, investigation, and remediation.

09. Agent Authority And Controlled Autonomy

9.1 Approval Before Execution

Every production agent and materially distinct workflow must have an inventory entry identifying its purpose, owner, model and tool versions, data scope, permitted operations, destinations, trigger, action limits, escalation route, and stop conditions. The inventory includes internal agents and background workers, not only visible conversational assistants.

The applicable authority must be explicit:

Standing approval can authorize recurring eligible tasks without reviewing every message. It must specify the population, purpose, content rules, channels, timing, commercial limits, allowed systems, and circumstances requiring human review. Silence, a broad instruction to increase sales, or acceptance of general subscription terms does not establish unlimited action authority.

9.2 Runtime Controls

Before each consequential step, the system must validate identity, tenant, task scope, current permission, source freshness, recipient eligibility, suppression status, applicable commercial rules, and destination state. Queued work must recheck controls at execution; the permission present when work was scheduled may have changed.

Tools must expose narrowly defined operations with validated inputs and restricted outputs. Tool credentials and backend authorization must enforce limits independently of a model's instructions. An agent cannot grant itself access, delegate greater authority than it holds, modify consent, alter its approval rules, or activate another tenant's tools.

Agent-to-agent interactions require the same controls. An external shopper agent, another dealer agent, or a tool response is an untrusted input, not proof of customer identity or permission to disclose records. Bounded delegation must preserve the original task identity, tenant, permissions, and action budget.

9.3 Safe Completion And Escalation

Execution must use suitable duplicate prevention, bounded retries, time and volume limits, and destination reconciliation. A generated message, a delivery, a reply, a booking, and a completed sale or repair are separate outcomes. An uncertain operation must be checked before repeating it.

Human escalation must preserve the relevant conversation, reason, pending commitments, and source context. A handoff requires acknowledgment by an assigned person or staffed queue, with fallback routing and defined coverage. The assistant must not promise immediate human availability outside that arrangement.

Affected workflows must pause when required data, authorization, safe routing, or critical controls are unavailable. Staff must have a tested method to stop a workflow or channel. Service recovery must preserve current suppression, consent, permissions, and unresolved customer commitments.

10. Commercial Decisions, Fairness, And Consumer Protection

DEOS supports communication and authorized work. It does not obtain independent authority to approve credit, choose a lender, establish insurance eligibility, make employment decisions, sign contracts, authorize repairs, adjudicate warranty rights, or provide binding legal or professional advice.

The ordinary service must not make solely automated decisions with legal or similarly significant effects. Any proposed feature that could materially determine access to financing, employment, insurance, or another regulated opportunity requires a separate use-case assessment, feature authorization, applicable notices and rights procedures, and an approved decision process before activation. Adding a nominal human click does not substitute for meaningful review by a person able to understand and change the decision.

Protected characteristics and unjustified proxies must not be used to unlawfully discriminate. Evaluation must examine foreseeable disparities in routing, language handling, accessibility, response quality, and access to human assistance. Collection of sensitive attributes for testing requires its own lawful basis and controls. Commercial objectives must not reward harassment, concealment, fabricated urgency, or exploitation of vulnerability.

Pricing, availability, incentives, financing illustrations, and fees must come from authorized current sources and approved rules. Material terms and eligibility conditions must not be invented or omitted to improve conversion. Exact financial calculations require validated calculation tools and inputs. Applicable credit notices and reasons remain subject to ECOA and Regulation B; AI does not remove those duties.[^3]

Dealerships remain responsible for their offers and approved content. The Company remains responsible for its own conduct and agreed platform controls. Neither a contractual allocation nor an AI disclaimer authorizes deceptive advertising or excuses failure to follow approved restrictions. The FTC's March 13, 2026 dealership pricing notice is expressly relevant to the content controls in this Policy.[^4]

11. Communications, Synthetic Media, And Individual Rights

11.1 Channel Permissions

Outbound workflows must distinguish informational requests from advertising and telemarketing, retain the applicable permission evidence, and apply current contact, timing, frequency, identification, and suppression rules. A customer relationship, purchased list, verified phone number, incoming inquiry, or general platform acceptance does not automatically establish permission for every channel and purpose.

AI-generated voices fall within the TCPA's artificial/prerecorded-voice framework. Applicable consent, identification, opt-out, and other restrictions must be assessed before launch; telemarketing can require prior express written consent. Email workflows require the applicable CAN-SPAM controls. State calling, recording, privacy, and consumer-protection requirements may impose additional duties.[^5]

DEOS must recognize supported opt-out expressions, route other legally effective revocations for action, and apply the appropriate scope and deadlines. A changed integration or campaign must not erase suppression history. A requested informational SMS must not silently enroll its recipient in promotional campaigns. The Company must maintain evidence of permission, revocation, and execution sufficient for appropriate review.

11.2 AI Identification, Recording, And Replicas

AI interactions must identify the dealership and the assistant's AI nature clearly at an appropriate point, including the beginning of an AI-led voice interaction. An assistant must not falsely claim to be a human employee or deny its automated nature. The exact presentation must meet applicable channel and jurisdiction requirements.

Recording and transcription require applicable advance notices and consents. A recording does not itself authorize voice cloning. Creating or operating a replica requires verified authority for the person, permitted use, approved assets, and any legally required individual release. A dealership's account acceptance or an opt-out mechanism cannot replace an affirmative biometric consent required by law.

Regulated biometric information, source videos, and replica-specific assets follow Privacy Policy Section 7, including its public destruction schedule, 24-month maximum for the particular asset, earlier applicable destruction events, and shorter mandatory deadlines. A new asset or continued subscription does not restart an older asset's retention clock. The Illinois Biometric Information Privacy Act is among the laws evaluated where applicable; entity- and activity-specific exemptions require analysis rather than assumption.[^6]

Unauthorized impersonation, deceptive endorsements, surveillance, and biometric identification outside an expressly authorized feature are prohibited. Synthetic media must not fabricate a person's approval, conceal material offer terms, or imply that an OEM, regulator, or customer endorsed something they did not approve.

11.3 Rights, Assistance, And Special Situations

The Company must maintain procedures to support applicable access, correction, deletion, objection, opt-out, and other privacy rights, with appropriate verification and minimum necessary evidence. Where the dealership directs processing, DEOS must assist it under the governing agreement and law. Rights requests must not be repurposed for marketing.

Customer-facing services must provide an accessible way to request human assistance and appropriate alternatives where a supported communication mode is unsuitable. The platform is not an emergency service or substitute for qualified repair, medical, legal, or financial judgment. Urgent safety concerns require the approved human or emergency direction, not improvised technical assurances.

The service is intended for business dealership use and ordinary automotive interactions. Deliberate youth-focused, sensitive profiling, or other materially different use requires assessment before enablement. Unexpected sensitive disclosures must be minimized, protected, and routed under the relevant procedure.

12. Model, Agent, And Software Release Assurance

Each production model and material AI component must have a documented intended use, provenance and licensing basis, deployment location, permitted input classes, known limitations, owner, and approved version. The register must cover speech, media, classification, retrieval, and scoring components as well as LLMs.

Release evaluation must address the risks of the actual capability:

Thresholds must be set before evaluation and approved according to risk. A reproducible unauthorized cross-tenant disclosure, prohibited external routing path, or bypass of a material safety control blocks the affected release. Statistical quality results do not override a known boundary failure.

Development and test environments should use synthetic or otherwise specifically authorized material. Production data must not be copied into an evaluation environment for convenience. Tenant-specific evaluation of private content requires its own protected environment and purpose; test results must not export that content into a common training corpus.

Material changes to model version, prompts, retrieval, routing, permissions, integrations, tool schemas, safety controls, or providers require an appropriate impact review and regression testing. Staged deployment must have observable acceptance criteria and a rollback or disablement plan. A rollback must also be assessed if the earlier version contains a known defect or incompatible data state.

13. Security And Abuse Resistance

The information security program must protect AI processing as part of the wider application environment. Required safeguards include least-privilege access, multifactor authentication for privileged and other applicable access, protected credentials, encryption in transit and at rest, network and egress restrictions, vulnerability management, secure change control, and risk-based monitoring and testing.

Prompt instructions alone are not a security boundary. Customer messages, web content, uploaded documents, tool results, and retrieved text must be treated as potentially hostile. Untrusted instructions must not authorize a tool operation, disclose secrets, change system policy, or broaden a tenant's access. Executable tools require appropriate isolation and limits; arbitrary code or unrestricted network access is not a default conversational capability.

Security review must address data exfiltration, model extraction, credential theft, training-data contamination, malicious feedback, inference about protected records, and abusive request volume. Abuse controls must allow investigation and proportionate account or workflow suspension without silently transferring legitimate work into an unapproved processing path.

Personnel and contractors must receive training appropriate to their access and responsibilities. Company personnel must not paste protected records into consumer AI tools, unapproved coding assistants, ticketing examples, or external debugging services. Necessary operational access must be limited, recorded, and reviewed.

14. Monitoring, Traceability, And Incident Response

Material actions must be traceable through an appropriate record of initiating user or standing workflow, dealership scope, source identifiers and times, applicable permission, model and workflow version, tool operation, destination response, and outcome. Records should explain the basis for an action without unnecessarily retaining private prompts or sensitive payloads. This requirement concerns usable decision evidence, not disclosure or retention of hidden model reasoning.

Monitoring must distinguish attempted actions from completed work and track exceptions, failures, duplicate prevention, handoff acceptance, complaints, opt-outs, and material quality deterioration. Business outcome analysis must declare its attribution method and avoid counting the same event more than once. Sensitive monitoring results remain tenant-restricted.

AI-related security and safety events must enter the incident process. Examples include suspected cross-dealer exposure, prohibited model routing, an unauthorized commercial action, defective suppression, unapproved likeness use, or a compromised learning input. Response must include containment, preservation of appropriate evidence, impact assessment, correction, root-cause analysis, and verified recovery.

The Company must notify affected customers and other parties as required by the Agreement and applicable law, with available facts and appropriate updates. Investigation must not be used to delay a notice beyond its governing deadline. The responsible legal and security owners must assess customer, individual, regulator, and law-enforcement notifications separately; one notice does not necessarily satisfy the others.

Where a model or shared artifact may contain impermissible information, the response must assess deployment suspension, affected versions, downstream copies, removal, and retraining or replacement. A corrected prompt alone is not sufficient if protected information remains in an accessible artifact.

15. Retention, Deletion, And Service Exit

Data retention must follow documented purposes, governing contracts, the Privacy Policy, and applicable law. Schedules must distinguish customer records, messages, permissions, transaction evidence, operational logs, model context, temporary processing files, replicas, and approved training assets. “Useful for AI” is not an independent retention purpose.

Deletion and correction procedures must address applicable copies, indexes, embeddings, caches, context stores, customer-specific model assets, exports, and contracted providers. Suppression evidence may need to remain in minimized form to honor an opt-out. A valid legal hold must be narrowly scoped, access-restricted, reviewed, and released when no longer required.

Backups must have defined expiry and restoration controls. Restored information must not reactivate deleted records, expired likeness rights, or revoked communication permissions. Backup arrangements must not extend a mandatory biometric destruction deadline. Termination must disable live processing and affected access, followed by return, export, and deletion under the applicable schedule and legal requirements.

The Company must not add protected dealership information to a shared model on the assumption that deleting source files later will remove it. Training and retention controls must operate before data enters an artifact.

16. Regulatory Applicability And Control Mapping

Keeping information inside a private processing boundary reduces specific exposure. It does not eliminate obligations concerning collection, purpose, notices, individual rights, advertising, communications, security, or automated decisions. The Company must assess the applicable entity, data, activity, jurisdiction, and effective date before enabling a regulated use.

The following mapping describes governance requirements, not a claim of universal certification or a legal conclusion that every feature falls within every listed regime.

As of this document's preparation date, California's 2025 privacy regulations are effective with phased compliance dates, including January 1, 2027 for covered ADMT requirements. Colorado's Attorney General identifies replacement ADMT and chatbot legislation with January 1, 2027 effective dates. Legal must validate current provisions, scope, and rules before the affected launch; earlier summaries of superseded legislation are not a deployment basis.[^8][^9]

International deployment requires its own assessment of territorial scope, processing roles, transfer mechanisms, privacy and AI obligations, localization, and feature restrictions. This U.S.-focused Policy does not represent that every international deployment is enabled or compliant by default.

17. Customer Assurance And Evidence

The Company must maintain evidence appropriate to the service and its risk: current data-flow and provider inventories; model and agent registers; permission and isolation tests; release evaluations; training-input provenance; access reviews; retention procedures; incident exercises; and remediation records.

Qualified customer reviewers may request relevant assurance information through the agreed diligence process. Disclosure may require confidentiality protection and redaction of other customers' information, security-sensitive detail, and protected intellectual property. These limits must not be used to misstate the existence or scope of a control or audit.

Certifications, attestations, penetration-test results, and standards alignment must be described accurately by entity, system scope, date, and assessor. A cloud provider's certification is not a DEOS certification. Reference to NIST, SOC 2, ISO standards, or a legal framework does not mean the Company has obtained an independent audit or certification unless it expressly supplies that evidence.

The public Policy describes required controls. Detailed endpoint lists, network rules, credentials, vulnerability findings, and private architecture maps are not public disclosures. Material limitations affecting contracted processing must be addressed through the appropriate customer and governance channels.

18. Relationship To DEOS Documents And Policy Changes

This Policy must be read with the DEOS Product And Services Subscription Terms And Conditions, Privacy Policy, Legal Notices, applicable Order, and any controlling data processing or security addendum. It does not silently amend their priority, remedies, allocation of responsibility, or individual rights. Its operational requirements do not diminish a stricter applicable legal or contractual protection.

The white paper and operating model explain an architecture and operating approach. Their illustrative workload ratios, signal counts, lifecycle categories, and savings scenarios do not expand an agent's authority or create a compliance exemption. The nearly 200 daily signals described in the white paper are operating context; the 22 lifecycle touchpoints are a configurable best-practice consolidation, not a required communication schedule.

The Company must record material Policy changes and provide appropriate notice. A published revision cannot retroactively authorize a prohibited training use, reduce existing individual rights, or override a binding privacy promise merely through continued use. Material purpose or processing-boundary changes require the applicable contractual process, lawful basis, notices, and required authorizations before implementation.[^10]

19. Questions, Rights Requests, And Reporting

For AI governance, privacy, legal, or diligence inquiries, contact legal@deos1.com. For operational support, suspected account compromise, or a workflow that should be paused, contact support@deos1.com. Do not email passwords, full financial records, regulated biometric files, or an unrestricted customer export. The Company will arrange an appropriate method when sensitive evidence is needed.

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431

20. Authorities And Reference Materials

References below support the legal and framework discussion and do not indicate approvals of DEOS. Regulatory applicability and changes are separately assessed at implementation and review.

[^1]: National Institute of Standards and Technology, AI Risk Management Framework and NIST AI 600-1, Generative Artificial Intelligence Profile. Voluntary governance references; no certification is asserted.

[^2]: U.S. Department of Justice, Justice Department Requires RealPage to End the Sharing of Competitively Sensitive Information and Alignment of Pricing Among Competitors, November 24, 2025. The cited announcement describes a proposed settlement and illustrates information-sharing concerns; it is not an automotive-specific rule or safe harbor.

[^3]: 12 CFR § 1002.9, Regulation B Notifications. FCRA and related requirements require separate review where consumer-report information or covered decisions are involved; this Policy does not authorize those uses.

[^4]: Federal Trade Commission, FTC Warns 97 Auto Dealership Groups About Deceptive Pricing, March 13, 2026, and associated Warning Letter Re: Deceptive Pricing, also referenced in Subscription Terms Section 11.4.

[^5]: Federal Communications Commission, Declaratory Ruling FCC 24-17; 47 CFR § 64.1200; Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business. Apply current rules and jurisdiction-specific requirements rather than assuming one channel's permission covers another.

[^6]: Illinois General Assembly, 740 ILCS 14/15, Biometric Information Privacy Act. Applicability, definitions, exemptions, and other state biometric and likeness rules require separate assessment. DEOS Privacy Policy Section 7 supplies the specific asset-retention commitment.

[^7]: 16 CFR Part 313, Privacy of Consumer Financial Information; 16 CFR § 314.4, Safeguards Rule elements; Federal Trade Commission, Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions.

[^8]: California Privacy Protection Agency, Approved CCPA regulatory text, including service-provider/contractor restrictions and applicable risk-assessment and ADMT provisions; California Finalizes Regulations to Strengthen Consumers' Privacy, September 23, 2025, for phased compliance dates. Coverage and exemptions must be assessed for the particular processing.

[^9]: Colorado Attorney General, Automated Decision-Making Technology and Chatbot Safety Rulemaking. The official page describes 2026 replacement legislation, January 1, 2027 effective dates, and implementing rulemaking. Recheck applicable final requirements before deployment.

[^10]: Federal Trade Commission, AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive, February 2024. Existing privacy promises require particular attention before a new training or disclosure use.