AutoStream Data Processing Agreement

Effective date: July 10, 2026 · Last updated: July 10, 2026

This document is a working draft. Have it reviewed by a qualified attorney before relying on it, particularly the sections on automated platform interaction and third-party data collection.

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the agreement between the dealership customer (“Customer,” “Controller,” or “you”) and AutoStream, LLC (“AutoStream,” “Processor,” “we,” or “us”) governing use of the AutoStream dashboard and Chrome extension (the “Service”), including the AutoStream Terms of Service. This DPA describes how AutoStream processes personal data on Customer’s behalf in the course of providing the Service. Capitalized terms not defined here have the meanings given in the Terms of Service or the AutoStream Privacy Policy.

1. Roles of the Parties

• Customer (the dealership) is the controller of personal data relating to its own personnel and salespeople who use the Service, and directs what dealership inventory data is connected to the Service.
• AutoStream acts as a processor (or “service provider,” depending on applicable law) that processes personal data solely on Customer’s documented instructions and for the purpose of providing the Service.
• Where Customer connects vehicle inventory data that itself contains personal data (this is not expected in the ordinary course, as vehicle inventory data is generally non-personal), Customer remains the controller of that data as well.

2. Scope and Purpose of Processing

AutoStream processes personal data only as necessary to:

• Authenticate and manage Customer’s dealership account and Authorized Users;
• Collect and display Customer’s vehicle inventory in the dashboard and extension;
• Pre-fill and support the manual posting of vehicle listings to Facebook Marketplace;
• Generate AI-assisted listing captions and photo checks via Anthropic’s Claude API, where enabled by Customer; and
• Provide account support, maintain security, and satisfy legal or contractual obligations related to the Service.

The duration of processing is the term of Customer’s subscription to the Service, plus any retention period described in Section 10 of this DPA and in the AutoStream Privacy Policy.

3. Categories of Data Subjects and Data

3.1 Data subjects

• Customer’s employees and contractors who are Authorized Users of the Service (dealership staff, salespeople, managers, and administrators).

3.2 Categories of personal data

• Account and identity data: name, email address, role, and dealership association.
• Authentication data: hashed passwords and session/authentication tokens.
• Usage data: posting activity logs, timestamps, and vehicle-listing history associated with an Authorized User’s account.

Vehicle inventory data (year, make, model, VIN, price, mileage, photos, features, and similar fields) processed through the Service is generally dealership business data and not personal data about an identifiable individual, except where a dealership chooses to include personal information in listing content, which is discouraged.

4. Processor Obligations

AutoStream will:

• Process only on instructions. Process personal data only on Customer’s documented instructions, including those reflected in the Terms of Service and Customer’s configuration of the Service, unless required to do otherwise by law (in which case AutoStream will inform Customer unless legally prohibited from doing so).
• Confidentiality. Ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations.
• Security measures. Implement appropriate technical and organizational measures to protect personal data, including encryption of data in transit (HTTPS), hashed password storage, per-dealership data isolation, and access controls limiting staff access to production data to authorized personnel.
• Assistance with data subject requests. Provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights (access, correction, deletion, objection), taking into account the nature of the processing.
• Breach notification. Notify Customer without undue delay, and in any event within 72 hours of becoming aware, after confirming a personal data breach affecting Customer’s data, and provide reasonably available information to help Customer meet its own notification obligations.
• Deletion or return. Delete or return personal data upon termination of the Service, as described in Section 9 below.

5. Sub-processors

• Customer authorizes AutoStream to engage the sub-processors listed in AutoStream’s Sub-processor List, which is incorporated into this DPA by reference and may be updated by AutoStream from time to time in accordance with its terms.
• AutoStream will impose data protection obligations on each sub-processor that are materially no less protective than those in this DPA, to the extent applicable to the services that sub-processor provides.
• AutoStream remains responsible for each sub-processor’s performance of its data protection obligations under this DPA.
• If AutoStream adds or replaces a sub-processor that has, or will have, access to Customer’s personal data, AutoStream will provide reasonable advance notice as described on the Sub-processor List page. Customer may object on reasonable data-protection grounds within a reasonable period after notice; if the parties cannot resolve the objection, Customer’s remedy is to terminate the affected portion of the Service in accordance with the Terms of Service.

6. International Data Transfers

AutoStream and its sub-processors primarily operate infrastructure located in the United States. To the extent any processing of personal data involves a transfer across borders, AutoStream will use commercially reasonable measures designed to ensure such transfers comply with applicable data protection law, which may include standard contractual clauses or equivalent transfer mechanisms where required. Customer should confirm with AutoStream whether specific transfer safeguards are needed for its jurisdiction before relying on this section for a regulated deployment.

7. Data Return and Deletion

• During the term of the subscription, Customer may export or request a copy of its data as described in the AutoStream Privacy Policy.
• Upon termination or expiration of the Service, and upon Customer’s written request made within 30 days of termination, AutoStream will delete or return Customer’s personal data, except to the extent AutoStream is required to retain copies under applicable law or for legitimate backup/archival purposes, in which case such retained data remains subject to the confidentiality and security obligations of this DPA until deleted.
• Absent a timely request, AutoStream may delete Customer’s data following the retention periods described in the AutoStream Privacy Policy.

8. Audit Rights

AutoStream will make available information reasonably necessary to demonstrate compliance with this DPA upon Customer’s written request, no more than once per 12-month period (or more frequently if required following a confirmed security incident). Where reasonably requested and subject to reasonable advance notice, confidentiality protections, and scheduling, AutoStream will support an audit of the relevant processing activities, which may be satisfied through a written questionnaire, a summary of relevant security documentation, or a mutually agreed third-party audit report, rather than an on-site audit, given AutoStream’s size as a small SaaS provider.

9. Liability

Each party’s liability arising out of or related to this DPA, including any liability for a breach of applicable data protection law, is subject to the limitations of liability set out in the AutoStream Terms of Service. Nothing in this DPA is intended to expand either party’s liability beyond what is set out in the Terms of Service, except where such limitation is not permitted by applicable law.

10. Term

This DPA takes effect on the effective date above and remains in effect for as long as AutoStream processes personal data on Customer’s behalf under the Terms of Service.

11. Contact

Questions about this DPA or data protection matters generally:

• Email: hello@getautostream.com

This DPA applies to personal data processed through the AutoStream dashboard and the AutoStream Chrome extension. AutoStream is operated by AutoStream, LLC.