· YOUR INFORMATION

Business Data-Handling Policy

Responsibilities and safeguards for business, customer, employee, inventory and service information in .

Effective October 26, 2026 · Version 2026-10-26.1

Send a privacy, export or deletion request ·

Purpose and instructions

The business retains its rights in its uploaded data and is responsible for lawful collection, accuracy, notices, consents and authorized instructions. processes that data to operate the requested software, provide support, protect the service and meet legal duties. Do not upload unrelated sensitive records or information you lack permission to use. A separate data-processing addendum must be agreed before use where applicable law or a customer’s requirements call for one; this policy is not a substitute for an executed addendum or a promise of certification.

Minimum necessary collection

Use only the fields and attachments needed for the task. Customer records should ordinarily contain contact and service information, not full card details, Social Security numbers, government identification or health records. Serial/part imports should contain relevant part descriptions, manufacturer/model, serial numbers and authorized vehicle/job links. Verify imports and AI-filled values before saving. Remove private information, people’s identifying details and embedded location metadata from public inventory photos when unnecessary.

Access, accounts and support

Use individual accounts and appropriate business roles; do not share passwords, signing links, activation codes or provider keys. Owners/managers must review access when staff join, change roles or leave. Admin access is limited to authorized operational purposes. Security-sensitive provider credentials are stored through the protected connection settings; do not put them in ordinary notes, contracts or email. Revoke access promptly after departure or suspected compromise and preserve relevant audit evidence.

Sharing with providers and manufacturers

The Privacy Notice identifies the main hosting, identity, signing, payment, email, inventory, AI and optional accounting providers. Send only the data needed for the requested operation. Confirm customer authority and manufacturer/dealer authorization before sending a warranty packet outside the system. The current OEM tracking tools do not themselves establish API approval or submit every claim. Never send customer private information in an OEM integration-approval inquiry. A business must approve a new optional integration before its private records are shared with that provider.

Transfers, title and financial records

A stored VIN, serial number, title note or generated document does not establish ownership, transfer legal title or approve a warranty claim. Staff must validate title documents and follow the applicable transfer process. Square payment success must come from verified provider records, not an account activation badge, a screenshot or a user-entered promise. Keep financial evidence separate from routine notes so legally needed records can be retained without keeping an unnecessary full customer profile.

Requests, export and end of service

Route customer/employee privacy requests to the business responsible for the record and notify where platform assistance is needed. Verify both identity and authority before export, disclosure or deletion. Export assistance remains available for the agreement’s 30-day post-termination period; delivery method and scope are reviewed for security and available formats. Archive is reversible hiding, not permanent deletion. Payment disputes, retention holds and law may require keeping specific records; explain exceptions and delete separable unnecessary information.

Incident handling

Report suspected unauthorized access, misdirected emails, exposed signing links, missing devices/backups or inappropriate record access promptly to reece.cameron@camperworthai.com. Include a safe description and affected business, not passwords or full sensitive records. will assess, contain, preserve evidence, coordinate with the affected business and providers, and give legally required notices. Where North Carolina law requires a custodian to notify a data owner immediately after discovery, that duty applies; notices to affected persons must follow applicable law without unreasonable delay. Do not postpone a legally required notice while waiting for every forensic detail.

Policy administration

M. Reece Cameron owns this policy and reviews provider changes, access, privacy requests, incidents and retention exceptions. Administrative handling includes a record of request verification, decisions, scope, completion evidence and any hold. Changes affecting signed contractual rights require the agreement’s amendment process. This policy describes the operating rules; it does not claim an independent security audit, universal automatic deletion or guaranteed prevention of a breach.

Contact

Attention M. Reece Cameron
reece.cameron@camperworthai.com
5540 Centerview Drive, Suite 200, Raleigh, NC 27606

Related provider information: Google services · Google advertising controls · SignWell privacy · Cloudflare privacy