VinStream Privacy Policy

IronHill AI, LLC

Version: 2026-09-18-1

Effective date: September 18, 2026

1. Who we are and what this Policy covers

IronHill AI, LLC, a Pennsylvania limited liability company, provides VinStream, a video communication and dealership workflow service. “Company,” “we,” “us,” and “our” mean IronHill AI, LLC. Our address is 1526 Aspen Drive, Pottstown, PA 19464, United States. Contact us about privacy at info@ironhill.ai or by mail, marked “Privacy Request.”

This Policy covers our websites, applications, setup, contracts, billing, support and dealership/customer pages. VinStream serves United States dealerships and authorized personnel. Customers may use dealership links without an account.

This notice does not waive statutory rights, replace required consent or authorize unlawful recording/disclosure. Feature-specific notices may appear at collection.

2. Our role and the role of the dealership

We determine the purposes of processing information for our own business administration, including prospective customer inquiries, account security, contracts, billing, support, and legal compliance. Applicable laws may describe this role as a business or controller.

For customer videos, service case information, staff records and communications processed on a dealership's instructions, the dealership generally determines the business purpose and we provide the technology. Applicable laws may describe us as a service provider or processor for that activity. Our agreement with the dealership governs those instructions and our assistance with privacy requests.

The dealership controls employee permissions, content, recipients, follow-up and connected systems. Its notice governs its own processing. Its administrator may access account work records and activity. Contact the dealership about its records; you may also contact us for assistance or routing.

3. Information we collect and its sources

The information involved depends on your role and the features used:

• Identity, professional and contact information: names, business email addresses, phone numbers, dealership affiliations, job roles, account identifiers, invitation recipients, public staff profiles and photographs. Sources include you, your dealership, authorized administrators and identity providers.
• Account and security information: authentication identifiers, password/authentication information handled through the identity service, verification and invitation records, session information, access permissions, account recovery activity and security events. Some information, such as credentials permitting account access, may be sensitive personal information under applicable law.
• Commercial and contract information: legal customer and payer details, business and billing addresses, authorized signer details, selected stores, products, seats, prices, discounts, agreement versions, signatures and related evidence, invoices, subscription status and payment-provider transaction identifiers. Sources include customer representatives, authorized operators, signing services and payment providers.
• Dealership content: videos, audio, photographs, vehicle identifiers and descriptions, service findings, customer names, related notes and other material supplied through dealership workflows. Media may incidentally contain people, license plates or other identifying information.
• Customer requests: name, email or phone number, requested appointment date/time, associated vehicle and messages provided when you ask a dealership to contact you or respond to a feature.
• Activity and technical information: page and video opens, playback progress or completion, selected customer actions, event times, application check-ins, uploads, sharing activity, app version, device class, installation identifiers, notification tokens, network addresses and related security or diagnostic information. A browser session identifier may distinguish visits without requiring a login; a dealership may associate link activity with its intended recipient.
• Inquiries and support: the contact details, message and dealership information you submit, referral attribution, diagnostic categories/error codes and the correspondence needed to investigate and respond.

Sources include users, devices, authorized dealership personnel, public inventory sources and relevant providers. Do not place Social Security numbers, card security codes, health records or unrelated sensitive information in videos, notes or support messages.

4. How we use information

We use personal information to establish and administer accounts; verify identity and authorization; prepare and retain agreements; provide billing and subscription functions; operate video recording, upload, hosting, playback and sharing; deliver customer requests to the appropriate dealership; administer staff permissions; and provide account, security and service communications.

We use advertising-related information on pages carrying advertising to select and display ads, measure ad delivery and engagement, limit repetition, and detect advertising fraud, subject to applicable privacy choices. Section 5 explains advertising disclosures and the future use of intent information.

We also use information to diagnose failures, respond to support, understand use of service features, produce dealership activity and engagement reports, protect against fraud and misuse, maintain records of important actions, resolve disputes and meet legal obligations. Marketing inquiry information is used to respond and follow up about the requested service. You may ask us to stop promotional follow-up.

Engagement reports do not prove identity, attention, purchase intent or transaction agreement. Forwarded links and shared devices affect signals. Dealers control their use of reports for follow-up and management.

Optional automated inventory lookup may transmit a dealer-site address and VIN or stock identifier to a lookup provider. This does not authorize sending customer videos, service conversations or unrelated personal information to an artificial intelligence provider.

5. When information is disclosed

To the dealership and chosen recipients. We provide the relevant dealership and its permitted users with account content, customer requests and workflow/engagement information. Staff contact details and selected content may appear on customer pages according to dealership and profile settings. When you request an appointment or choose a contact action, relevant information is directed to the dealership or selected destination.

To service providers. We use providers for hosting, databases, file storage, video processing and delivery, identity and authentication, email, security, billing, electronic signatures and notifications. Depending on enabled features, these include Cloudflare for infrastructure, video, storage, email and bot protection; Supabase for identity; Stripe for payment and subscription functions; SignWell for electronic signing; and Expo and Apple services for mobile notifications. An enabled automated inventory lookup may use OpenAI for the limited lookup described above. Availability of an integration does not mean every account uses it.

Providers receive information relevant to their functions. Hosted payment details go to the processor; VinStream receives billing transaction/subscription information. Signing providers process documents, signer information and evidence, including individual document signatures, dates, stated representative titles and acknowledgment choices, with related electronic-signing audit information. Providers may have independent legal or security responsibilities described in their notices.

For legal and business purposes. We may disclose relevant information to professional advisers, authorities or other persons when reasonably necessary to comply with law or valid legal process, investigate misuse, protect rights or safety, or establish or defend claims. Information may be reviewed or transferred in a proposed or completed merger, financing, acquisition, reorganization or sale of business assets, subject to applicable confidentiality and privacy requirements.

Advertising partners, including Google AdSense. We use Google AdSense on pages where advertising is enabled. Google and other third-party advertising vendors or networks may place or read cookies, use web beacons, and receive IP addresses, browser/device identifiers, page and ad interactions, and inferred interests to deliver and measure advertisements and prevent fraud. Google advertising cookies can support personalized ads based on visits to this and other websites. These recipients may use information for their own advertising purposes, subject to their notices and applicable choices; describing a recipient as a service provider does not make its independent advertising uses processing solely for us. Learn about Google's partner-site processing at https://policies.google.com/technologies/partner-sites and manage Google personalization at https://myadcenter.google.com/. Other participating vendors' advertising choices may be available through https://optout.aboutads.info/.

Sale, sharing and potential commercial data products. Disclosures for cross-context behavioral advertising or targeted advertising may constitute a sale or sharing of personal information under applicable state law, including where no money changes hands. We therefore do not represent that all third-party advertising disclosures fall outside those definitions. Intent information can include inferred interest in vehicles or services derived from browsing, viewing or requested interactions. We may sell, license or otherwise disclose relevant information for monetary or other valuable consideration through future commercial data products, subject to applicable law, your choices and our contractual rights. Potential categories include contact and professional identifiers; browser, device and advertising identifiers; vehicle interests and associated commercial interactions; browsing, video and advertising engagement; approximate location derived from an IP address; and inferences about likely vehicle or service interest. We do not necessarily collect every category in every interaction. Potential recipients include dealerships and other automotive businesses, advertisers and advertising networks, audience and analytics providers, data intermediaries, and market-research customers. Potential purposes include prospect identification, audience development, advertising, market analysis and measuring commercial interest. These are possible future uses, not a statement that every category is currently collected, sold or available for purchase.

Before introducing a materially different sale or use of identifiable or linkable intent information, we will identify the actual information, source, recipient categories and purposes in the applicable notice, provide legally required opt-out or opt-in mechanisms, and obtain required permissions. We will honor existing collection notices and contractual restrictions, including the dealership data-processing terms. This Policy does not itself authorize sale of dealership-controlled Customer Content or retroactive repurposing of information collected under contrary promises. Aggregated or deidentified information is treated separately only when it meets applicable legal standards; a hashed email, cookie ID or other linkable identifier is not automatically anonymous. A future program must not knowingly sell or share information about a person under 16 without legally required authorization.

Other disclosures require your direction or consent where applicable.

6. Shared links, external destinations and your device

A dealership video link may allow anyone possessing the valid link to view the content within its access settings. Recipients can forward links or retain screenshots, recordings and communications. Link expiry or revocation can stop later access through VinStream but does not retrieve copies another person already made. Share links only with intended recipients and contact the dealership promptly about an unintended disclosure.

External scheduling, finance, telephone, email or other destinations operate under their own privacy notices. Information entered after leaving VinStream is handled by the destination. Browser and device permissions may be requested for camera, microphone, selected media and notifications when needed for a feature. You can change permissions in device settings; disabling a permission may prevent the associated function. Uninstalling an application does not itself cancel a subscription or erase information held by the dealership.

7. Browser storage and communications choices

VinStream and embedded services use browser/device storage and similar technologies for authentication, security, session continuity, recovery and feature operation. For example, session storage can keep a video-viewing session identifier, while account sessions and verification state can persist as appropriate to the authentication flow. Video event reporting can occur when a page or player is used.

You may clear/restrict browser storage and control device notifications. This may require another sign-in or affect playback/recovery without removing server records. Stop promotional communications through an available unsubscribe method or by contacting us; necessary service messages may continue.

Do Not Sell or Share My Personal Information. To request an opt-out of sale, sharing for cross-context behavioral advertising or targeted advertising, contact info@ironhill.ai with "Privacy Opt-Out" and enough information to identify the relevant interaction or account. You do not need to create an account or sign a contract to submit this request. Use the advertising-provider controls linked above for those providers' personalization settings; those controls do not replace an opt-out submitted to us. This email route supplements any browser-level or consent-management choice required on an advertising page. Where applicable law requires an opt-out of specified profiling, you may exercise that right as described below. Applicable legally recognized preference signals, including Global Privacy Control, must be respected for the processing to which they apply. A general browser “Do Not Track” setting is not necessarily equivalent to such a signal.

8. Retention and deletion

Retention depends on the information's purpose, dealership instructions, configured service settings and legal requirements. Account and professional contact information is retained as needed for the relationship, access administration and related obligations. Videos and service content are subject to applicable media settings and deletion processes. Engagement, security and diagnostic records are retained according to operational need, incident investigation and applicable records requirements.

Executed agreements, signature evidence, invoices and related audit records may need to remain after account closure to document transactions, meet legal obligations or resolve disputes. Inquiry and delivery information may have different retention periods from the emails or records delivered to the recipient. Backup, provider and recovery copies may also have separate deletion cycles.

Retention exceptions must relate to a legitimate continuing purpose, such as a legal obligation, actual dispute or preservation requirement. Closing a link, ending access and deleting underlying content are separate actions. We address deletion requests according to our role and applicable law, including explaining a relevant exception when a request cannot be fully fulfilled. We do not promise that every copy disappears immediately when an account or link is closed.

9. Security and processing locations

We use safeguards intended to protect information, including authentication, access controls and protected communications and storage mechanisms appropriate to the relevant service. No system or transmission can be guaranteed completely secure. Keep credentials and private links secure and report suspected unauthorized access to info@ironhill.ai. We address incidents and provide notifications as required by applicable law and our relevant contractual obligations.

VinStream serves United States dealership clients. Our providers may operate infrastructure or provide support in more than one country; information is not represented as stored exclusively in Pennsylvania or exclusively in the United States. Applicable contractual and legal requirements govern transfers and provider access.

10. Privacy rights and requests

Depending on your state, the applicable law, our role and any exemptions, you may have rights to confirm processing; access or obtain a portable copy of information; correct inaccuracies; request deletion; learn relevant collection, use and disclosure categories; limit certain uses of sensitive information; and opt out of specified sale, advertising or profiling activities. These rights may apply differently to dealership employees, business contacts and individual consumers. A business relationship does not automatically eliminate all privacy rights.

For California residents, applicable CCPA rights can include knowledge/access, correction, deletion, portability, opt-out of sale or sharing, limits on specified sensitive-information use, and freedom from unlawful discrimination. Coverage depends on statutory applicability, not merely on whether VinStream is described as business software. Other state laws may provide additional rights and a right to appeal a denied request.

Submit a request to info@ironhill.ai or our postal address. Describe your request and relationship to VinStream, and provide enough information to locate the relevant account or interaction. Do not send passwords, verification codes, full payment details or unnecessary identity documents. We may reasonably verify identity and authority before disclosing, changing or deleting records. An authorized agent may submit a request with evidence of permission as required by applicable law. Creating a VinStream account is not required merely to contact us about privacy.

We respond within applicable legal periods and explain permitted extensions or denials. If you disagree with a response, reply with “Privacy Appeal” and the reason; where applicable, we will review the appeal and explain further complaint options, including contacting your state attorney general or privacy regulator. We will not unlawfully retaliate or discriminate for exercising protected rights. Information needed to fulfill the requested service may still be necessary to provide that service.

11. Children

VinStream accounts are for authorized adult business users; the service is not directed to children under 13. Do not intentionally upload children's personal information for unrelated purposes. If you believe a child has provided personal information through VinStream without appropriate authorization, contact us so we can investigate and take appropriate action under applicable law.

12. Changes and questions

We may update this Policy as features, practices or legal requirements change. The published version will identify its effective date. We will provide additional notice or obtain consent when required for a material change; merely revising this Policy does not supply legally required consent for a new use. Contact IronHill AI, LLC, 1526 Aspen Drive, Pottstown, PA 19464, or info@ironhill.ai, for questions, accessibility assistance or a copy of this Policy.

13. Signed acknowledgment of receipt

A signature on the standalone acknowledgment confirms that the identified representative received this version and could retain it. It is not consent to personalized advertising, sale of intent information, optional marketing, or processing that requires separate permission. It does not waive privacy rights, accept arbitration, authorize a payment, or supply consent for employees, dealership customers or other individuals. Those choices must be obtained from the appropriate person through the applicable process.