Service provider security addendum

1. What this covers

"Customer information" means the nonpublic personal information about your customers that you put into CarShots Compliance, as the FTC Safeguards Rule defines it (16 CFR 314.2).

Under the Safeguards Rule, CarShots is your service provider for that information (16 CFR 314.4(f)).

2. How we use customer information

We use customer information only to provide CarShots Compliance to you, to keep it secure, and as the law requires.

We do not sell it, use it for advertising, or share it with anyone except the providers in section 4.

3. How we protect it

We protect customer information with the safeguards in this section, and we review them at least once a year and after any incident.

We require multi-factor authentication on CarShots Compliance accounts, encrypt sensitive fields with AES-256-GCM on top of encryption at rest, keep files in private storage, and log access to customer information.

We do not collect Social Security numbers or keep driver's license photos, and we delete uploaded deal files after 30 days unless you choose to keep them.

Only CarShots staff who need access to support you can reach your records.

4. Other providers

We use outside providers for hosting, databases, file storage, email and AI processing. We choose providers that can protect the information and bind them by contract to do so.

You can ask us for the current list at any time.

5. If something goes wrong

If we learn that customer information you gave us was acquired without authorization, we will notify the account owner by email promptly, without waiting until every detail is known.

We will share what we know about what happened and which records were involved, keep you updated, and give you the information you need for any notice you must send, including an FTC notice under 16 CFR 314.4(j).

6. Your oversight

Once a year, or after an incident, you can ask us for a written summary of our security program, and we will answer reasonable security questionnaires.

This lets you meet the Safeguards Rule duty to check on your service providers from time to time.

7. When you leave

You can export your records before you close your account.

After your account closes, we delete customer information within a reasonable time, except copies we must keep by law and backup copies, which are deleted on their regular schedule and stay protected until then.

8. Your part

You choose who at your store has access, keep MFA on, protect your own devices and logins, and remove staff who leave.

You remain responsible for your own compliance program and for filing your own reports, such as Form 8300 and any FTC breach notice.

9. Everything else

This addendum lasts as long as you use CarShots Compliance, and sections 5 and 7 continue for as long as we hold your customer information.

Templates and tools, not legal advice. Have your own attorney review it if you have questions.