Vast.com, Inc. (“we,” “us,” “our” or the “Company”) collects information about you when you use our mobile applications, websites, and other online products and services (collectively, the “Services”), and through other interactions and communications you have with us. This Privacy Policy Statement (“Privacy Policy”) applies to “you,” as a user of our Services and is designed to help you understand how we collect, use, share, and safeguard the information you provide to us and to assist you in making informed decisions when using our Services.

By using our Services you consent to our collection, storage, use and disclosure of your information as described in this Privacy Policy. Note that mobile platforms (iOS, Android, Windows etc.) define the types of data that apps cannot access without your consent. The permissions systems for obtaining your consent vary according with the platform your device uses; the main differences are in when the app asks for permission and what it asks for; you, the user, manages those permissions.

We collect “Personal Information” and “Non-Personal Information.”

Personal Information is information that can be used to personally identify you, for example your name, phone number, and e-mail address.

Non-Personal Information is information that cannot be used to personally identify you, for example, anonymous usage data, general demographic information we may collect, referring/exit pages and URLs, platform types, preferences you submit and preferences that are generated based on the data you submit and number of clicks.

We collect Personal and Non-Personal Information from you at several different points, including but not limited to the following:

• when you register with us;
• when you visit our websites
• when you communicate with our concierge;
• when you use our apps; and
• when you contact us for help.

Under the California Consumer Privacy Act (“CCPA”) we have collected the following categories of personal information from California consumers within the last twelve (12) months:

Category	Category Collected
A. Identifiers.	Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Yes
C. Protected classification characteristics under California or federal law.	No
D. Commercial information.	Yes
E. Biometric information.	Yes
F. Internet or other similar network activity.	Yes
G. Geolocation data.	Yes
H. Sensory data.	No
I. Professional or employment-related information.	Yes
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	No
K. Inferences drawn from other personal information.	Yes

We obtain the categories of personal information listed above from the following categories of sources:

• Directly or indirectly from you;
• From activity on our website, apps, marketing campaigns or social networking sites; and
• Service providers and other partners

Personal Information

We may use Personal Information that we collect about you to:

• deliver the products and services that you have requested;
• schedule appointments with dealers (if applicable);
• manage your customer relationship and provide you with customer support;
• perform analysis about your use of the Services;
• communicate with you by e-mail, postal mail, telephone and/or mobile devices about products or services that may be of interest to you;
• enforce our terms and conditions;
• manage our business;
• respond to investigation, court orders, legal process, or to investigate, prevent or take action regarding illegal activities, suspected fraud, or situations involving potential threats to the physical safety of any person, or as otherwise required by law; and
• perform functions as otherwise described to you at the time of collection.

We may, and you authorize us to, transfer your Personal Information to any of our affiliates for the purpose of processing or storage. Additionally, we may, and you authorize us to transfer your Personal Information to the extent that:

• We have your written consent.
• Transfer is to other Vast.com, Inc. entities and/or business partners who are acting on our behalf for the uses described in this Privacy Policy.
• Transfer is done in connection with a business transaction, such as a merger, acquisition, or liquidation of Vast.com, Inc.
• Transfer is necessary for vendors to perform certain functions on our behalf. We do share your Personal Information with vendors who are performing Services for the Company, such as the servers for our e-mail communications who are provided access to user’s e-mail address for purposes of sending e-mails from us. Those vendors use your Personal Information only at our direction and in accordance with our Privacy Policy.
• We believe, in our own sole discretion, that transfer is necessary to limit our liability or protect and defend the rights, property or personal safety of our Company, its affiliated companies, this Website or its users or to investigate violations of our agreements or Company policies.
• Transfer is required by law enforcement, government officials, or other third parties pursuant to a subpoena, court order, or other legal process or requirement applicable to our Company.

Non-Personal Information

We use Non-Personal Information to help us improve the Services and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns for the Services. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners, advertisers and other third parties at our discretion.

Except as otherwise stated in this Privacy Policy, we do not sell, trade, rent or otherwise share for marketing purposes your information with third parties without your consent. Information collected from you may be stored and processed in the United States or any other country in which our Company or agents or contractors work or maintain facilities, and by using our Services, you consent to any such transfer of information outside of your country.

We will retain any Personal Information and Non-Personal Information only for as long as is necessary to fulfill the business purpose it was collected. We will also retain and use any Personal Information and Non-Personal Information for as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

We implement security measures designed to protect your information from unauthorized access. Your account is protected by your account password and we urge you to take steps to keep your personal information safe by not disclosing your password and by logging out of your account after each use. We further protect your information from potential security breaches by implementing certain technological security measures including encryption, firewalls and secure socket layer technology. However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such firewalls and secure server software. By using our Services, you acknowledge that you understand and agree to assume these risks.

• Cookies. In an effort to improve the quality of the Services, we track information provided to us by your browser or by our software application when you view or use the Services, such as the website you came from (known as the “referring URL”), the type of browser you use, the device from which you connected to the Services, the time and date of access, and other information that does not personally identify you.

The Company may use both persistent and session cookies; persistent cookies remain on your computer after you close your session and until you delete them, while session cookies expire when you close your browser. For example, we store a persistent cookie to track the following: information you provide us by registering for an account, and information you provide us by signing up for Market Reports.

You have many choices with regards to the management of cookies on your computer. All major browsers allow you to block or delete cookies from your system. Before taking such steps, you should be aware that the Services may not work properly if you choose to block the placement of cookies on your computer. You will need to decide whether enabling cookies outweigh privacy concerns. To learn more about your ability to manage cookies, please consult the privacy features in your browser.

Web Beacons. Our Company and third parties may also use small pieces of code called “web beacons” or “clear gifs” to collect anonymous and aggregate advertising metrics, such as counting page views, promotion views, or advertising responses. These “web beacons” may be used to deliver cookies that conform to our Company’s cookie requirements.

Analytics Services. We use the following third-party data analytics platforms to improve our Services:

• Google Analytics. We use Google Analytics to help understand how visitors interact with our websites so that the websites can be improved. You can read Google’s security and privacy policies for Google Analytics. You can chose not to have your data used by Google Analytics by downloading Google’s opt-out browser add-on.

• Facebook Analytics. We use Facebook measuring tools to improve our advertising and measurement systems. You can view Facebook’s Data Policy at https://www.facebook.com/privacy/explanation

• Google Firebase Crashlytics (formerly Fabric Crashlytics). We use Firebase, a service provided by Google, Inc. to provide crash support. The data collected by Google Firebase is provided to us in aggregated form through a crash report. The report contains information about crashes, specifically what kind of device was being used when the app crashed and which version was in use during the crash. We use the reports to improve the overall performance of our apps. These crash reports do not include Personal Information or other personal account information. You can view Crashlytics’s Terms of Service at https://firebase.google.com/terms/crashlytics.

• App Annie. We use App Annie, a service by App Annie Europe Limited, to help us understand the mobile apps’ downloads and usage. You can view App Annie privacy policy at https://www.appannie.com/legal/privacy/.

• Mixpanel.

  We use Mixpanel, an advanced analytics service provided by Mixpanel, Inc. Mixpanel allows us to analyze how visitors use our mobile apps. Usage information and Personal Information is stored by Mixpanel and is subject to their privacy policy. You can view Mixpanel privacy policy at https://mixpanel.com/privacy and can read the Mixpanel Terms of use at https://mixpanel.com/terms/. Furthermore, you can opt out of Mixpanel collecting and storing such data at any time by following the instructions in the link below: https://mixpanel.com/optout/.

• Links. As part of the Services, we may create links to other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Services. Therefore, this Privacy Policy does not apply to your use of a third party website accessed by selecting a link on our website or via our Services. To the extent that you access or use the Services through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that website or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.
• Other. Our Company sites may use third parties to present or serve the advertisements that you may see at its web pages and to conduct research about the advertisements and web usage. This Privacy Statement does not cover any use of information that such third parties may have collected from you or the methods used by the third parties to collect that information.

The Company reserves the right to change this Privacy Policy at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary e-mail address specified in your account or by placing a prominent notice on our site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. It is your responsibility to review this Privacy Policy periodically as your continued use of the Service represents your agreement with the then-current Privacy Policy. The provisions of this Privacy Policy supersede all previous notices or statements regarding our privacy practices.

• If you have any questions regarding this Privacy Policy or our privacy practices, please contact us through our contact us page.

This document was last updated on November 18, 2020.