DATA & SECURITY STATEMENT

CarCare24x7 Inc.

A Canadian Corporation

Effective Date: November 19, 2025

Last Updated: November 19, 2025

Document Version: 1.0

1. Introduction
2. Definitions
3. Information We Collect
4. How We Use Your Information
5. Legal Basis for Processing
6. Information Sharing and Disclosure
7. Third-Party Service Providers and APIs
8. Data Security and Technology Infrastructure
9. Data Retention and Deletion
10. Your Rights and Choices
11. Cookies and Tracking Technologies
12. International Data Transfers
13. Children's Privacy
14. Changes to This Statement
15. Contact Information

1. INTRODUCTION

WHEREAS, CarCare24x7 Inc., a Canadian corporation ("CarCare24x7," "we," "us," or "our"), is committed to protecting the privacy and ensuring the security of personal information collected, processed, and stored in connection with the provision of our Services; and

WHEREAS, this Data & Security Statement (the "Statement") sets forth the policies, practices, and procedures governing the collection, use, storage, protection, disclosure, and retention of personal information when individuals access or use our mobile applications, including but not limited to Torqon and Torqon Wrench, web platforms, application programming interfaces (APIs), and related services (collectively, the "Services"); and

WHEREAS, by accessing, downloading, installing, or using any of our Services, you acknowledge that you have read, understood, and agree to be bound by the terms and conditions set forth in this Statement; and

WHEREAS, if you do not agree with any provision of this Statement, you must immediately cease all use of the Services and discontinue access thereto;

NOW, THEREFORE, this Statement is issued in compliance with applicable data protection laws and regulations, including but not limited to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) in the European Union, the California Consumer Privacy Act (CCPA), and other applicable federal, provincial, state, and local privacy laws and regulations.

2. DEFINITIONS

2.1 "Personal Information" means any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal Information includes, without limitation, name, email address, telephone number, vehicle identification information, location data, payment information, biometric data, and any other information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual.

2.2 "Services" means all services, products, platforms, applications, websites, APIs, and related technologies provided, operated, or made available by CarCare24x7, including but not limited to the Torqon mobile application for vehicle owners, the Torqon Wrench mobile application for garage operators and mechanics, web-based dashboards, administrative portals, and any associated software, hardware, or infrastructure.

2.3 "User" means any natural person who accesses, downloads, installs, registers for, or uses any of the Services, including but not limited to vehicle owners, garage operators, mechanics, service technicians, administrative personnel, and any other individual who interacts with the Services in any capacity.

2.4 "Service Provider" means any third-party entity, including but not limited to corporations, partnerships, sole proprietorships, and individuals, that provides services, products, or technologies to CarCare24x7 in connection with the operation, maintenance, or enhancement of the Services, including payment processors, cloud hosting providers, analytics service providers, communication service providers, and software vendors.

2.5 "Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.6 "Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Information.

2.7 "Data Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Information on behalf of the Data Controller.

3. INFORMATION WE COLLECT

3.1 Information You Provide to Us

CarCare24x7 collects Personal Information that you voluntarily provide to us when you engage in the following activities:

Create an account or profile on our platform
Book services through our mobile applications
Register as a garage or service provider
Contact our customer support team
Participate in surveys, promotions, or feedback programs
Subscribe to our newsletters or marketing communications

This information may include:

Personal Identifiers: Full name, email address, phone number, date of birth, and government-issued identification numbers when required for verification
Vehicle Information: Vehicle make, model, year, vehicle identification number (VIN), license plate number, mileage, and vehicle service history
Financial Information: Payment card numbers, billing addresses, bank account information (for garage partners), and transaction history
Profile Information: Profile pictures, preferences, service history, ratings, and reviews
Business Information: For garage partners, we collect business name, registration number, business address, tax identification numbers, and business licenses

3.2 Information Collected Automatically

When you use our Services, we automatically collect certain information, including:

Device Information: Device type, operating system (iOS, Android), device identifiers, mobile network information, and app version
Usage Information: Features used, pages viewed, time spent on the platform, clickstream data, and interaction patterns
Location Information: Precise location data (GPS coordinates) when you enable location services, approximate location based on IP address, and location history for service tracking
Log Information: IP address, browser type, access times, pages viewed, referring website addresses, and error logs
Communication Data: Records of communications through our in-app chat features, customer support interactions, and AI-powered carChat conversations

3.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Social media platforms when you choose to log in using social authentication (Google, Facebook)
Payment processors (Stripe, PayPal) regarding transaction status and payment methods
Google Maps API and Google Places API for location and business information
Garage partners who provide service history and vehicle maintenance records
Public databases and business directories for garage verification

4. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

4.1 Service Delivery and Operations

Facilitate connections between car owners and certified garages
Process and manage service bookings and appointments
Enable real-time service tracking and status updates
Provide AI-powered carChat for customer support and vehicle diagnostics
Manage garage operations through the Torqon Wrench dashboard
Process payments and manage financial transactions
Send service confirmations, reminders, and updates

4.2 Communication

Respond to your inquiries, requests, and support tickets
Send transactional messages related to your bookings and services
Provide notifications about service status, payment confirmations, and account activity
Send emergency alerts and important service updates
Facilitate communication between car owners and garage partners

4.3 Service Improvement and Analytics

Analyze usage patterns and user behavior to improve our Services
Develop new features and functionality
Conduct research and analytics to enhance user experience
Monitor and optimize platform performance
Detect and prevent fraud, abuse, and security threats

4.4 Marketing and Promotions (with Consent)

Send promotional offers, discounts, and marketing communications (only with your explicit consent)
Personalize marketing content based on your preferences and service history
Conduct marketing campaigns and measure campaign effectiveness

4.5 Legal Compliance and Protection

Comply with applicable laws, regulations, and legal processes
Respond to government requests and court orders
Protect our rights, property, and safety, as well as that of our users
Enforce our Terms of Service and other agreements
Investigate potential violations and prevent fraud

5. LEGAL BASIS FOR PROCESSING

We process your personal information based on the following legal grounds:

Contractual Necessity: To perform our contract with you and provide the Services you have requested
Legitimate Interests: To improve our Services, prevent fraud, ensure security, and conduct business operations
Consent: When you have provided explicit consent for specific processing activities, such as marketing communications
Legal Obligation: To comply with applicable laws, regulations, and legal requirements
Vital Interests: To protect the safety and security of our users and the public

7. THIRD-PARTY SERVICE PROVIDERS AND APIs

Our Services integrate with various third-party services and APIs. The following describes how we use these services and what information may be shared:

7.1 Payment Processing

Stripe API: Processes credit card and debit card payments. Stripe handles payment card information in accordance with PCI DSS standards. We do not store full payment card numbers on our servers.
PayPal API: Provides alternative payment methods for international users. PayPal processes payments according to their privacy policy.

7.2 Cloud Infrastructure and Storage

AWS EC2: Hosts our application servers and backend infrastructure. Data is stored in secure, encrypted data centers.
AWS S3: Stores files, images, documents, and backups. All data is encrypted at rest and in transit.
MongoDB: Our primary database system stores user accounts, bookings, service records, and application data. Data is encrypted and backed up regularly.

7.3 Communication Services

Twilio API: Sends SMS notifications and handles phone number verification. Twilio processes phone numbers and message content.
Firebase Cloud Messaging: Delivers push notifications to mobile devices. Device tokens and notification preferences are shared with Firebase.
SendGrid / Mailgun: Sends transactional and marketing emails. Email addresses and email content are processed by these services.

7.4 AI and Machine Learning

OpenAI GPT API: Powers our AI carChat feature for customer support and vehicle diagnostics. Chat conversations and vehicle information may be processed by OpenAI. We do not share personally identifiable information unless necessary for service delivery.
OpenAI Vision API: Analyzes vehicle images for damage assessment and diagnostics. Vehicle images are processed by OpenAI for analysis purposes.

7.5 Location and Mapping Services

Google Maps API: Provides mapping, navigation, and geolocation services. Location data and route information are shared with Google.
Google Places API: Enables garage discovery and provides business information. Search queries and location data are shared with Google.

7.6 Authentication and Security

Auth0 / Firebase Auth: Manages user authentication and authorization. Login credentials and authentication tokens are processed by these services.
OAuth 2.0: Enables social login integration (Google, Facebook). When you choose social login, authentication is handled by the respective social media platform.
JWT Tokens: We use JSON Web Tokens for secure API access and session management. Tokens are stored securely and expire after a set period.

7.7 Analytics and Monitoring

Google Analytics: Tracks user behavior and website/app usage. Anonymized usage data is shared with Google Analytics.
Mixpanel: Provides event tracking and user journey analysis. User interactions and events are tracked by Mixpanel.
Datadog / New Relic: Monitors application performance and system health. System logs and performance metrics are shared with these services.

Important: These third-party services have their own privacy policies and terms of service. We encourage you to review their policies to understand how they handle your information. We are not responsible for the privacy practices of these third-party services.

8. DATA SECURITY AND TECHNOLOGY INFRASTRUCTURE

We implement comprehensive security measures to protect your personal information:

8.1 Encryption

Transport Layer Security (TLS/SSL): All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.2 or higher protocols
Data at Rest: All data stored in our databases and cloud storage is encrypted using AES-256 encryption
Payment Data: Payment card information is encrypted and tokenized. We do not store full payment card numbers on our servers
Database Encryption: MongoDB databases are encrypted at rest, and sensitive fields are encrypted using application-level encryption

8.2 Access Controls

Multi-factor authentication (MFA) is required for all administrative access
Role-based access controls (RBAC) ensure employees only access data necessary for their job functions
Regular access reviews and audits are conducted to ensure appropriate access levels
Strong password policies and secure credential management
Session management with automatic timeout and secure token handling

8.3 Infrastructure Security

Cloud Infrastructure (AWS): Our services are hosted on Amazon Web Services (AWS) EC2 instances with security groups, network ACLs, and VPC isolation
Firewall Protection: Network firewalls and security groups protect our servers from unauthorized access
DDoS Protection: AWS Shield provides protection against distributed denial-of-service attacks
Intrusion Detection: Automated monitoring systems detect and respond to security threats
Regular Updates: All systems and dependencies are regularly updated with security patches

8.4 Application Security

Secure Development: Our applications (Flutter mobile apps, Node.js backend, React.js web dashboards) are developed following secure coding practices
Input Validation: All user inputs are validated and sanitized to prevent injection attacks
API Security: RESTful APIs are secured with authentication tokens (JWT) and rate limiting
Code Reviews: All code changes undergo security reviews before deployment
Dependency Management: Third-party dependencies are regularly scanned for vulnerabilities

8.5 Monitoring and Incident Response

24/7 Monitoring: Our systems are monitored around the clock using Datadog and New Relic for performance and security events
Security Audits: Regular security audits and penetration testing are conducted by internal and external security teams
Incident Response Plan: We have a documented incident response plan to quickly address and mitigate security incidents
Logging: Comprehensive logging of all system activities for security analysis and forensic investigations
Backup and Recovery: Regular automated backups are performed, and disaster recovery procedures are tested regularly

8.6 Data Processing Technologies

Message Queuing (Kafka): Handles asynchronous processing and background jobs securely
Caching (Redis): In-memory caching improves performance while maintaining data security
GeoSpatial Queries: MongoDB's built-in GeoSpatial capabilities enable secure location-based queries

Note: While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information to the best of our ability.

9. DATA RETENTION AND DELETION

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes outlined in this Statement, unless a longer retention period is required or permitted by law.

9.1 Retention Periods

Active Accounts: Personal information associated with active accounts is retained while your account remains active
Transaction Records: Financial and transaction records are retained for 7 years to comply with accounting and tax regulations
Service History: Vehicle service history and maintenance records are retained to provide ongoing service value and improve service quality
Marketing Data: Marketing consent and preferences are retained until you withdraw consent or request deletion
Legal Requirements: Some information may be retained longer if required by law, court order, or regulatory requirements

9.2 Account Deletion

You may request deletion of your account at any time by contacting us at privacy@carcare24x7.com. Upon receiving a deletion request:

We will delete or anonymize your personal information within 30 days, except where retention is required by law
Transaction records may be retained for legal compliance purposes but will be anonymized
Service history may be retained in anonymized form for analytics and service improvement
Some information may remain in backup systems for a limited period but will not be actively used

10. YOUR RIGHTS AND CHOICES

Depending on your location, you may have certain rights regarding your personal information:

10.1 Access and Portability

You have the right to request access to your personal information and receive a copy of your data in a structured, commonly used, and machine-readable format.

10.2 Rectification

You can request correction of inaccurate or incomplete personal information. You can also update your information directly through your account settings.

10.3 Erasure

You have the right to request deletion of your personal information, subject to legal retention requirements. You can delete your account through the app settings or by contacting us.

10.4 Objection and Restriction

You can object to processing of your personal information for certain purposes, such as direct marketing, and request restriction of processing in certain circumstances.

10.5 Withdraw Consent

You can withdraw your consent for data processing at any time, particularly for marketing communications. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

10.6 Location Services

You can control location data collection through your device settings. Disabling location services may limit certain features, such as finding nearby garages and real-time service tracking.

10.7 Marketing Communications

You can opt out of marketing communications by:

Clicking the "unsubscribe" link in marketing emails
Adjusting notification preferences in your account settings
Contacting us at privacy@carcare24x7.com

To Exercise Your Rights:

Please contact us at privacy@carcare24x7.com with your request. We will respond to your request within 30 days, or as required by applicable law. We may need to verify your identity before processing your request.

11. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, and similar tracking technologies to collect information about your use of our Services.

11.1 Types of Cookies

Essential Cookies: Required for the platform to function properly, including authentication, security, and session management. These cannot be disabled.
Analytics Cookies: Help us understand how users interact with our platform. We use Google Analytics and Mixpanel for this purpose.
Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness. These are only used with your consent.
Functional Cookies: Remember your preferences and settings to enhance your experience.

11.2 Managing Cookies

You can manage cookie preferences through:

Your browser settings (most browsers allow you to refuse or delete cookies)
Our cookie consent banner when you first visit our website
Your account settings within our mobile applications

Note: Disabling certain cookies may limit functionality and affect your user experience.

12. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country.

When we transfer your information internationally, we ensure appropriate safeguards are in place, including:

Standard contractual clauses approved by data protection authorities
Ensuring that third-party service providers are certified under appropriate data protection frameworks (e.g., EU-U.S. Privacy Shield Framework, where applicable)
Implementing additional security measures to protect your information

By using our Services, you consent to the transfer of your information to countries outside your country of residence, including the United States, where many of our service providers are located.

13. CHILDREN'S PRIVACY

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@carcare24x7.com.

14. CHANGES TO THIS STATEMENT

We may update this Data & Security Statement from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. We will notify you of any material changes by:

Posting the updated Statement on this page with a new "Last Updated" date
Sending an email notification to the email address associated with your account
Displaying a prominent notice within our mobile applications

Your continued use of our Services after such changes constitutes your acceptance of the updated Statement. We encourage you to review this Statement periodically to stay informed about how we protect your information.

15. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Data & Security Statement or our data practices, please contact us: