Microsoft Email Integration Privacy Policy

Depending on the permissions you grant, HillzDealer CRM may access the following information from your Microsoft account.

Microsoft account information

• Name
• Email address
• Microsoft account identifier
• Basic profile information

Email information

When email integration is enabled, we may access:

• Sender and recipient information, including email addresses
• Subject lines and message bodies
• Timestamps
• Folders
• Message status and other metadata
• Attachments, when required for CRM functionality
• Draft and sent messages

Email content may be stored within HillzDealer CRM so authorized dealership users can view, manage, and communicate with their customers through the CRM. Microsoft's mail permissions apply to the connected mailbox as a whole and cannot be limited to customer conversations.

What we do not access

The permissions we request do not give HillzDealer access to your Microsoft calendar, contacts, OneDrive files, or Teams chats. They apply only to the mailbox of the account that signs in, not to other people's mailboxes in your organization.

HillzDealer CRM may request the following Microsoft OAuth permissions. We use them only to provide the email-related CRM functionality you request.

• openid

  What it allows

  Sign you in and verify your Microsoft identity.

  How we use it

  Authenticates the Microsoft account you connect.

• profile

  What it allows

  Read basic profile information, such as your name.

  How we use it

  Shows which Microsoft account is connected.

• offline_access

  What it allows

  Keep the connection active without asking you to sign in again each time.

  How we use it

  Lets email sync and sending keep working between sign-ins. You can revoke it at any time.

• User.Read

  What it allows

  Read basic information about the signed-in Microsoft user.

  How we use it

  Identifies your account and email address within the CRM.

• Mail.ReadWrite

  What it allows

  Read, create, update and organize email messages in the connected mailbox.

  How we use it

  Displays conversations in the CRM, links them to customers and leads, keeps messages, drafts and folders in sync, and saves drafts you write.

• Mail.Send

  What it allows

  Send email on behalf of the connected Microsoft account.

  How we use it

  Sends the messages you write or initiate in the CRM.

These are delegated permissions: HillzDealer acts only on behalf of the user who signs in, and only within that user's own mailbox. We do not use application permissions that would give access to every mailbox in a Microsoft 365 organization. If your organization requires administrator approval for apps, your Microsoft 365 administrator may need to approve the connection before you can complete it.

We use Microsoft account and email information to provide the features you ask for, including to:

• Connect a user's Microsoft mailbox to HillzDealer CRM
• Synchronize emails with CRM records
• Display customer communications within the CRM
• Allow authorized users to read and manage email
• Allow authorized users to compose and send email
• Associate email conversations with customers, leads, or other CRM records
• Maintain synchronization between Microsoft and HillzDealer CRM
• Troubleshoot technical issues
• Protect the security and integrity of the service

We do not use Microsoft email data for advertising, sell it, or use it to build profiles unrelated to these CRM features. If our Privacy Policy or User Agreement would permit broader use of information, this policy governs how we handle data obtained from your Microsoft account.

Email that is synchronized into HillzDealer is associated with the connected user's account and with the customer, lead, or other CRM records it relates to. Other authorized users in the same dealership account may be able to see those conversations, depending on the roles and permissions the dealership has configured.

HillzDealer personnel do not read the content of Microsoft email except with the user's explicit agreement to view specific content for support, when necessary to investigate security or abuse issues, or when required by law. Any such access is limited to what is necessary for that purpose.

You sign in on Microsoft's own sign-in page. We do not request or store your Microsoft account password.

HillzDealer CRM stores the Microsoft OAuth access token and refresh token issued for your account so the connection can be maintained. These tokens are used solely to access Microsoft services within the permissions you granted, and are stored securely. When you disconnect your account, HillzDealer stops using the tokens for that connection.

Information retrieved from Microsoft may be stored in HillzDealer CRM when necessary to provide CRM functionality. This may include email message content and related metadata.

We retain Microsoft-related information only for as long as necessary to:

• Provide the requested services
• Maintain CRM records
• Meet contractual requirements
• Meet applicable legal or regulatory requirements

When information is no longer required, it may be deleted or anonymized in accordance with our data-retention policies. Deleted information may remain temporarily in system backups until the applicable backup retention cycle ends.

We do not sell Microsoft account or email data, and we do not transfer it to advertising platforms or data brokers. Microsoft data may be disclosed only:

• To authorized users of the relevant dealership account
• To service providers necessary to operate HillzDealer CRM, such as hosting providers
• When required by applicable law or legal process
• When necessary to investigate fraud, abuse, or security incidents

Service providers that process information on our behalf are expected to handle it only for the purposes necessary to provide their services.

We use reasonable administrative, technical, and organizational safeguards, including encrypted connections, authentication, access controls, and role-based permissions, designed to protect Microsoft account and email information against:

• Unauthorized access
• Unauthorized disclosure
• Loss
• Misuse
• Modification
• Destruction

Access to Microsoft-related data within HillzDealer CRM is limited to authorized users and systems where appropriate.

You can end the connection at any time in either place:

• In HillzDealer. Disconnect your Microsoft account from your CRM account or integration settings.
• In Microsoft. Revoke HillzDealer's access from your Microsoft account. For personal accounts (Outlook.com, Hotmail), use your Microsoft account app permissions. For work or school accounts, use My Apps or ask your Microsoft 365 administrator.

After access is revoked:

• HillzDealer CRM can no longer retrieve new Microsoft email data using the revoked authorization.
• Information previously stored in the CRM may remain, subject to applicable retention requirements and dealership account policies.

Revoking access does not by itself delete information already stored in the CRM. To request deletion of eligible personal information, contact us using the details in the Contact us section.

Depending on applicable privacy laws, you may have the right to request:

• Access to your personal information
• Correction of inaccurate information
• Deletion of eligible information
• Restriction of certain processing
• Information about how your data is used

Submit requests using the contact details below. We may need to verify your identity, and we will respond within a reasonable timeframe. We may retain information where the law or a contractual obligation requires it.

If you are a customer of a dealership and your correspondence is stored in that dealership's HillzDealer account, please contact the dealership first. It decides how its customer communications are handled, and we will assist it with your request.

The Microsoft email integration uses the Microsoft identity platform (Microsoft Entra ID) for OAuth authentication and the Microsoft Graph API for mailbox access. Microsoft's processing of information is governed separately by Microsoft's own terms and privacy policies, and Hillz Holdings Corp. does not control Microsoft's independent processing of personal information.

See the Microsoft Privacy Statement and the Microsoft APIs Terms of Use. Our use of Microsoft APIs is subject to those terms.

We may update this policy periodically to reflect changes to:

• HillzDealer CRM
• Microsoft integrations
• Legal requirements
• Privacy or security practices

The updated version will be posted on this page with a revised effective date. If a change materially affects how we use data from your Microsoft account, we will provide notice where required by law.

For questions about this policy, the Microsoft integration, or your personal information, contact: