Terms & Policies

DEOS Privacy Policy

Last Updated: November 2, 2026

1. Who We Are And What This Policy Covers

I REVLAB, INC. ("Company," "REVLAB," "we," "us," or "our") provides DEOS™ (Dealer Engagement Operating System), REVLAB VIDEO, and related AI-powered dealership engagement technology. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information in connection with https://deos1.com, all Company-operated subdomains of deos1.com, and other Company websites, applications, demonstrations, and services that link to this Policy (collectively, the "Services").

The Services may include personalized video; AI-assisted voice, SMS, email, and chat; customer follow-up and appointment coordination; creative and video production tools; dealership system integrations; and role-based internal intelligence. Processing depends on the features enabled, the information available through authorized integrations, and the applicable customer agreement. Describing a capability here does not mean it is enabled for every customer or visitor.

This Policy explains our practices; it is not a blanket consent to collect information, record calls, create a replica, send marketing communications, or use sensitive information. We obtain separate notices, permissions, and consents where required. Nothing in this Policy limits privacy rights that cannot lawfully be waived.

2. Our Role And The Dealership's Role

Information we control. We determine the purposes and means of processing information used for our own website administration, business inquiries, customer account management, billing, security, and Company marketing. We act as a controller or business for that information where those terms apply.

Information processed for a dealership. When DEOS processes a dealership's customer or staff information to provide contracted services, we generally act as the dealership's processor or service provider, subject to its documented instructions, applicable law, and our agreement. The dealership determines its customer relationships, permitted campaigns, source-system access, and authorized users. Its privacy notices and communication disclosures also apply.

For dealership-directed processing, the applicable service agreement and data processing agreement govern our obligations to the dealership. They do not override an individual's mandatory legal rights. A dealership's website does not become our website merely because it embeds DEOS functionality.

If your request concerns a dealership's customer records or communications, contact that dealership directly. You may also contact us; we will assist or route the request as appropriate. We may need the dealership's instructions before changing or deleting records it controls.

3. Personal Information We Collect

We collect information directly from individuals, automatically through use of the Services, and from dealerships and other authorized sources. We do not collect every category about every person.

Sources include your interactions with us; dealership staff; dealership management systems (DMS), customer relationship management systems (CRM), inventory, scheduling, and other authorized applications; communication delivery providers; and business contacts or referral sources. Publicly available business information may also support our business outreach.

Some integrated records or submitted content may contain sensitive personal information. We seek to limit processing to what is necessary for the authorized feature. Do not enter Social Security numbers, driver's license images, full financial account details, health information, passwords, or other sensitive material in a public form, general chat, or demonstration. Use only a designated feature that expressly requests and is authorized to process that information. Access to an integrated system does not authorize unrestricted use of all information in that system.

4. How We Use Personal Information

Subject to our role, applicable law, and the relevant agreement, we use personal information to:

• Provide, administer, maintain, troubleshoot, and support the Services.
• Respond to inquiries, fulfill requests, schedule appointments, and coordinate human assistance.
• Deliver authorized sales and service engagement, reminders, follow-up, customer recovery, and personalized content for dealerships.
• Reconcile customer identities, normalize records, identify duplicates, and maintain connected customer context within an authorized dealership environment.
• Provide role-based answers, summaries, operational insights, and reporting to authorized dealership personnel.
• Create authorized audio, video, images, human replicas, and animated content.
• Record communication permissions, apply suppression requests, and maintain evidence of authorized activity.
• Evaluate reliability and performance, investigate errors, and improve service functionality within applicable contractual and legal restrictions.
• Manage contracts, billing, business relationships, and Company communications.
• Detect and prevent fraud, abuse, unauthorized access, and other security threats.
• Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal rights.

We do not treat receipt of dealership data as permission to use it for unrelated Company marketing, create a cross-dealership consumer marketing database, or disclose it for another customer's independent purposes. Information may be combined within a dealer group only to the extent authorized and lawful.

We may create and use aggregated or deidentified information for legitimate analytics and service development. Where we rely on a legal deidentification standard, we maintain required safeguards and commitments against reidentification, except for permitted testing of the deidentification process.

5. AI Processing, Connected Data, And Internal Intelligence

DEOS uses AI to interpret requests, generate content, summarize records, coordinate workflows, and support external and internal engagement. Prompts, connected context, outputs, and action records may contain personal information. Authorized personnel may review relevant records for support, safety, quality evaluation, or issue resolution, subject to access restrictions and our processing obligations.

The Dealer Data Universe is a connected intelligence layer built from authorized sources. Matching and reconciliation may associate records believed to relate to the same person or vehicle. Source records and AI-generated inferences can be incomplete or inaccurate. Contact the relevant dealership to request correction of its records; contact us for information we control. Correcting an underlying record may require changes in the originating system.

Internal access is governed by assigned permissions. The platform does not make all dealership information available to every staff member merely because the information is connected. Operational reports may include staff assignments, customer interactions, and workflow activity; dealerships are responsible for providing any required workplace notices for their use of these features.

Model training. We do not use dealership customer information, private prompts, conversation content, biometric information, or likeness assets to train general-purpose or shared AI models for unrelated customers. Processing necessary to create an expressly authorized, customer-specific replica or configuration is distinct from general model training and remains subject to the applicable consent and agreement. Any materially different training use requires a separate lawful basis, appropriate notice, and any required authorization; this Policy alone does not authorize it.

Infrastructure. A proprietary AI stack does not mean information is processed without outside infrastructure. Authorized hosting, inference-compute, storage, messaging, and other service providers may process information to deliver the Services under applicable restrictions. Such processing does not authorize those providers to use customer information for their own general model training or independent marketing.

Engagement prioritization and recommendations may use automated analysis. This Policy does not authorize using DEOS to make solely automated decisions with legal or similarly significant effects, such as credit eligibility, employment, or insurance decisions. Any feature involving legally regulated automated decision-making requires applicable feature-specific disclosures, safeguards, and rights procedures before that use.

6. Calls, Messages, Email, And Engagement Measurement

AI interactions and recordings. A call or chat may involve an AI assistant. Where a call is recorded or transcribed, appropriate notice and any legally required consent must precede that processing. Consent to visit a website is not consent to record a call. If you do not wish to be recorded, tell the assistant or dealership and request an available alternative. Do not disclose information in an interaction that is unnecessary for your request.

Request-based SMS. When you ask an assistant to text appointment details, store information, a vehicle link, or a verification code, we process your mobile number and related request information to fulfill that request. We maintain delivery, consent, and opt-out records. Number verification confirms control of a number; it does not by itself provide marketing consent.

Other dealership communications. Dealership-enabled campaigns, outbound calls, and other automated messages require their own appropriate permissions and applicable disclosures. Permission for a requested informational text does not authorize unrelated promotional texts or calls. Where required, marketing consent is obtained separately and is not a condition of purchase. The limited website-assistant SMS program described in the Site Terms remains subject to those program terms.

SMS information protection. We do not sell or share mobile information with third parties or affiliates for their own marketing or promotional purposes. Text-message opt-in data and consent are not shared for those purposes. We may disclose the minimum necessary information to the dealership directing the communication and providers supporting delivery, consent administration, and compliance, or as required by law. These operational disclosures do not permit independent marketing use.

Reply STOP to opt out of the applicable SMS program and HELP for help. An opt-out confirmation may be sent. Contact support@deos1.com for assistance or broader communication preferences. Message and data rates may apply. Opting out does not erase records needed to honor your choice, automatically withdraw permissions for every separate dealership program, or necessarily stop requested communications through another channel. Tell us or the dealership if you want a broader restriction.

Company promotional emails provide an unsubscribe method; you may also email legal@deos1.com. Necessary account, security, transaction, and legal notices may continue where lawful. For dealership marketing, use its unsubscribe method or contact it directly.

Emails, video links, and related pages may record delivery, opening, clicking, viewing, replies, and appointment activity. These events help evaluate engagement and may be linked to a customer record. Technical limitations, including email privacy features, can affect their accuracy. Applicable tracking and consent choices apply.

7. Human Likeness, Voice, And Biometric Information

What we process. Authorized replica creation may involve photographs, video footage ("Persona Videos"), voice recordings, facial geometry or landmarks, expression and movement information, voice characteristics, and related embeddings, templates, or model assets. Photographs and ordinary recordings are not automatically biometric identifiers under every law; derived geometry, voiceprints, or other representations may qualify depending on the processing and applicable law. We apply required biometric protections where applicable.

Authorization and permitted purposes. Before collecting or deriving regulated biometric information, we provide legally required notice of the information, purpose, and retention period and obtain the required informed written release or other legally sufficient consent. A dealership's instruction alone does not replace an individual's consent where the law requires that consent. An uploader must have authority to provide another person's content and any necessary likeness rights.

We use these materials to create and operate the expressly authorized replica, synthesize speech and video, map expressions, synchronize audio and imagery, and produce approved communications. We do not use them for surveillance or biometric identity verification. We do not use a person's likeness in our own advertising, create impersonations outside the authorized scope, or train general models for unrelated customers without separate lawful authorization. A recorded customer call is not, by itself, permission to clone that customer's voice.

Disclosure and protection. We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Fees for an authorized content-production service do not grant a purchaser unrestricted rights in a person's identity. Access and processing are limited to authorized personnel and necessary service providers, and any disclosure of regulated biometric information requires the consent or other legal authority applicable to that disclosure. A general business transfer provision does not independently authorize a prohibited biometric disclosure.

Public retention and destruction schedule. We retain biometric information, Persona Videos, and customer-specific replica assets only while needed for the expressly authorized purpose, with a maximum retention period of twenty-four (24) months from collection or creation of the particular asset. We initiate permanent destruction when the authorized purpose is satisfied, the applicable account terminates, or a valid withdrawal or deletion request requires destruction, whichever occurs first, and complete it without undue delay within any legally required deadline. Continued subscription or generation of a new asset does not reset the retention period for an older asset. Any shorter legal deadline controls; in all events, regulated Illinois biometric data is destroyed when the initial purpose is satisfied or within three years of the individual's last interaction with us, whichever occurs first.

Destruction includes source materials, regulated templates and embeddings, and replica-specific assets capable of reproducing the person's likeness. We use deletion, cryptographic erasure, or another method reasonably designed to render the information unrecoverable. Routine backup practices do not extend a mandatory biometric destruction deadline. An applicable court order or legally mandatory preservation requirement is handled only to the extent legally permitted or required, with restricted access and no continued production use.

Delivered media already held by an authorized dealership or recipient is distinct from the underlying biometric or replica assets. Its retention and use remain subject to the person's authorization, applicable agreement, and law; deleting our assets does not recall every previously delivered copy. Contact legal@deos1.com to withdraw authorization, request deletion, or report unauthorized likeness use. Withdrawal does not retroactively invalidate lawful prior processing.

8. How We Disclose Information

We disclose personal information only for applicable purposes described here, subject to law and our processing obligations:

• To the relevant dealership and authorized users: Information needed to fulfill requests, maintain its records, manage engagement, and provide permitted reporting.
• To service providers: Hosting, compute, storage, communications, technical support, security, analytics, payment, and professional-service providers, as needed for their assigned functions. Applicable agreements restrict processing, confidentiality, and security and require appropriate downstream protections.
• Through authorized integrations: Information needed to retrieve or update records, schedule appointments, record outcomes, and perform dealership-directed workflows. Independent system providers also have their own contractual and privacy obligations.
• For legal and safety purposes: As required or permitted by law, including lawful process, fraud prevention, incident response, protection of individuals, and establishment or defense of legal claims. We assess requests and limit disclosures as appropriate.
• In a corporate transaction: Information may be disclosed in connection with a proposed or completed financing, merger, acquisition, reorganization, or asset transfer, subject to confidentiality, applicable law, and contractual restrictions. Transaction diligence does not authorize unrestricted disclosure of customer records or biometrics. We provide notice or obtain consent where required.
• At your direction or with valid consent: For a separately explained purpose, within the scope of that authorization.

We do not sell or rent customer lists. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use dealership customer information for our own targeted advertising. We do not knowingly sell or share personal information of individuals under sixteen. We do not use sensitive personal information to infer characteristics for purposes that would trigger a California right to limit beyond the permitted purposes described in this Policy. These statements concern legal definitions as well as ordinary commercial usage; a disclosure to provide a contracted service is not automatically a sale or advertising share.

9. Cookies And Similar Technologies

The Services may use cookies, local storage, pixels, and similar technologies for authentication, security, preferences, functional operation, and permitted analytics or engagement measurement. A technology's purpose and configuration determine whether consent is required; calling it an analytics tool does not make it exempt.

Where required, we obtain consent before activating nonessential technologies and provide a method to withdraw or change that consent. You can also manage cookies through your browser; blocking essential storage may affect functionality. Browser settings may not control information already collected or every form of tracking.

We honor legally required opt-out preference signals, including Global Privacy Control, for processing to which the signal applies. Because we do not sell or share personal information for cross-context behavioral advertising, there is no such activity to opt out of under our stated practices. A signal does not by itself prevent essential security processing or all permitted measurement. Other browser "Do Not Track" signals do not have a uniform implementation standard and may not alter our processing.

10. Retention And Deletion

Except for the specific likeness and biometric schedule in Section 7, we determine retention by the purpose of collection, sensitivity, applicable agreement, account lifecycle, legal requirements, limitation periods, security needs, and whether a less identifiable record can meet the need.

We delete, return, or appropriately deidentify information when it is no longer needed. For nonbiometric information, isolated backup copies may remain until normal expiration, subject to restricted access, no ordinary business use, and reapplication of deletion requests if restored. We may preserve limited information where legally necessary for security, compliance, disputes, or other applicable exceptions. Exceptions are not authority for indefinite retention or unrelated reuse. The stricter Section 7 schedule controls the assets it covers.

11. Security And Processing Locations

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, access restrictions, and controls appropriate to the nature of the processing. No system is completely secure. This statement does not waive our obligations to implement required safeguards or provide legally required incident notices.

The Company is based in the United States. Information may be processed in the United States and in other locations used by authorized providers, subject to applicable restrictions and customer commitments. We do not represent that all processing occurs exclusively in the United States. Where a law restricts international transfers, we use an applicable lawful transfer mechanism and required safeguards. Contact us for information about safeguards applicable to your information.

12. Privacy Rights And How To Exercise Them

Depending on your residence, the information, our role, and applicable law, you may have rights to:

• Confirm processing, obtain access, and receive information about categories, sources, purposes, and recipients.
• Obtain a portable copy of eligible information.
• Correct inaccurate information and request deletion.
• Withdraw consent where processing depends on consent, without affecting lawful prior processing.
• Object to or restrict specified processing where applicable.
• Opt out of sale, legally defined advertising sharing, targeted advertising, or specified consequential profiling where applicable.
• Limit certain uses or disclosures of sensitive personal information where applicable.
• Receive information about, obtain human review of, or challenge covered automated decisions where applicable.
• Exercise rights without unlawful discrimination or retaliation and appeal an eligible denial.

Submit a request to legal@deos1.com with the subject "Privacy Request," or write to the Privacy Contact at the address in Section 16. Include sufficient information to identify the relationship or dealership concerned and explain the request. Do not send passwords, full government identifiers, or unnecessary sensitive documents. No new account is required to submit a request.

We verify identity and authority to the extent required and proportionate to the request, using information we already hold where practical. An authorized agent may submit a request with appropriate evidence of authority; direct confirmation may be required where lawful. Opt-out requests are not subject to identity verification requirements applicable only to access or deletion requests.

We respond within applicable legal deadlines. For covered California access, correction, and deletion requests, we generally respond within 45 calendar days, subject to a legally permitted extension with notice. Other requests, including opt-outs, may have shorter deadlines. We explain a denial and available appeal rights where required. To appeal, email legal@deos1.com with the subject "Privacy Appeal." We respond within the applicable deadline and explain any available regulator complaint route. You may contact your state attorney general or other competent privacy regulator independently.

Rights are subject to lawful exceptions, such as protecting another person's information, completing authorized transactions, maintaining necessary security or suppression records, complying with law, and defending legal claims. We apply exceptions only as permitted. For dealership-controlled information, we support the dealership's response as required rather than treating this Policy as authority to change its records independently.

13. Additional California Disclosures

For California residents, the categories in Section 3 describe information our Services may collect, the sources, and business purposes. Section 8 identifies recipient categories. When collected in the preceding twelve months, identifiers, professional and account data, commercial and vehicle records, communications, internet activity, audio/visual information, inferences, and applicable sensitive information may have been disclosed to the relevant dealership or necessary providers for the business purposes described. Actual categories depend on the relationship and enabled features; this is not a claim that every category is collected about everyone.

Sensitive information may include account access credentials, communication content, regulated biometrics, and financial or government identification information if specifically authorized and necessary. Ordinary IP-derived approximate location is distinct from precise geolocation. We do not intentionally collect precise device location through the general business-information website. We use and disclose sensitive information only for applicable permitted service, security, compliance, and other legally authorized purposes, not for unrelated characteristic inference.

We have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve months. We do not offer a financial incentive program for the collection, sale, or sharing of personal information. Any future such program would require a separate notice and applicable consent.

California rights include access to categories and specific pieces of eligible information, deletion, correction, portability, applicable opt-out and sensitive-information limitation rights, and nondiscrimination. Section 12 explains requests and authorized agents. A statute's applicability and any exemption are assessed for the particular information and activity; an automotive or financial-services relationship does not automatically exempt all information held by DEOS.

We do not disclose personal information to third parties for their own direct marketing purposes. California residents may contact legal@deos1.com about California direct-marketing disclosure rights.

14. Individuals Outside The United States And Children

Where European, United Kingdom, or comparable privacy laws apply to processing we control, we rely as appropriate on contractual necessity, legitimate interests such as operating and securing a business service, legal obligations, or consent. We assess legitimate interests against affected individuals' rights. Special-category information requires an additional lawful condition where applicable; a general legitimate interest does not replace it. Individuals may exercise applicable rights through Section 12 and complain to their competent supervisory authority. For dealership-directed processing, the dealership determines the applicable lawful basis. We do not represent that every Service is offered in every jurisdiction.

The business-information Site and dealership administration tools are intended for adults. We do not direct the Services to children under thirteen or knowingly collect their personal information. A parent allowing a child to browse does not authorize otherwise prohibited collection. If you believe we have collected such information, contact legal@deos1.com so we can investigate and take appropriate action. We do not knowingly create replicas of minors through the ordinary business workflow; any authorized exception requires a separate assessment and all legally required permissions before collection.

15. Other Notices And Policy Changes

Independent dealership sites, linked websites, and third-party services have their own privacy practices. Review their notices before submitting information. Their independent processing is not governed solely by this Policy.

We may update this Policy to reflect changes in practices, Services, or law. The revised date identifies the current version. For material changes, we provide appropriate notice, such as a prominent website notice or direct communication, and obtain consent where legally required. Continued use does not substitute for consent required for a new purpose, biometric processing, marketing, or other regulated activity. We do not apply materially incompatible uses to previously collected information without the necessary legal basis and required notice or consent.

16. Contact Us

I REVLAB, INC.
Attention: Privacy Contact
4910 Communications Ave
Suite 120
Boca Raton, FL 33431
United States

Privacy, rights requests, and likeness concerns: legal@deos1.com
Service and messaging support: support@deos1.com

To request this Policy in an accessible alternative format, contact legal@deos1.com.