Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Valletto LLC ("Valletto," "Company," "we," "our," or "us") collects, uses, stores, protects, and shares information when you access or interact with our technology platform. For purposes of this Policy, the term "Platform" includes:

• The primary domain valletto.io,
• Any valet-company subdomain such as yourcompany.valletto.io,
• Digital check-in and SMS intake pages,
• Valet retrieval, status-update, and payment pages,
• The Valletto mobile applications used by valet staff and by residents,
• Custom valet websites that Valletto hosts for valet companies,
• Operational dashboards and employee tools, and
• Administrative and support systems used by participating valet companies.

This Policy applies to all guests, visitors, employees of valet companies, administrative users, and any individual who accesses or uses the Platform ("users," "you," or "your"). By using the Platform, you acknowledge and agree that your information will be handled in accordance with this Policy.

Valletto provides technological tools, workflow automation, SMS communications, and data processing functionality used by independent valet companies to manage their operations. These companies are responsible for delivering physical valet services, while Valletto provides the digital infrastructure that enables those services. This Policy explains how data flows between these roles, how it is stored, and how we safeguard your privacy.

If you do not agree with the terms of this Policy, you should discontinue use of the Platform. The legal terms that govern your use of the Platform depend on who you are: valet companies are bound by the Master Service Agreement at valletto.io/terms; guests by the Guest Terms at valletto.io/guest-terms and by the terms the valet company posts at yourcompany.valletto.io/terms; valet staff, managers, and partner contacts by the Platform User Terms at valletto.io/user-terms; and residents by the Resident Terms shown in the resident application.

2. Children's Privacy

3. Roles & Responsibility Structure

Understanding the roles of Valletto and each valet company is essential in determining who is responsible for which parts of your data. Valletto provides the technological infrastructure that enables valet companies to manage their daily operations, communicate with guests, record vehicle handling events, and maintain accountability. The valet company you interact with - identified by its unique subdomain - is the party responsible for performing physical valet services, such as checking in your vehicle, parking it, moving it, storing keys, and retrieving it. Valletto, on the other hand, acts as the processor and custodian of the digital data required to support these services.

For purposes of applicable data protection laws, valet companies act as data controllers and Valletto acts as a data processor with respect to guest and operational data.

Valletto processes data strictly on documented instructions from valet companies and does not independently determine the purposes or means of processing guest data.

3.1 Valet Company Responsibilities

The valet company associated with the subdomain is responsible for:

• Performing all physical valet operations
• Employing and managing staff
• Conducting safety and damage inspections
• Handling customer service and support
• Complying with property access rules and local regulations
• Maintaining accuracy of their business information on the Platform

3.2 Valletto Responsibilities

Valletto functions as:

• Technology Provider
• Data Processor on behalf of each valet company
• SMS communications operator
• Operational workflow and data handler
• Provider of operational and financial analysis, proposals, and presentation materials to valet companies at their request (Section 5.6)

Valletto does not touch vehicles, make valet decisions, or employ valet staff.

4. Subdomain & Multi-Company Structure

Each valet company on our platform is provided its own dedicated subdomain (e.g., yourcompany.valletto.io) that uniquely identifies that business. All operational data captured through that subdomain belongs to and is processed on behalf of that specific valet company. This ensures clarity regarding which business is providing your service and which entity is responsible for operational decisions.

Valletto handles only the technology; valet companies handle the service.

5. Categories of Information We Collect

This section provides a detailed breakdown of the information collected through the Platform, how it is generated, and why it is necessary. We process both guest-submitted information and operational data generated through valet workflows. Each category is collected for specific operational purposes - primarily accuracy, accountability, communication, and safety. We do not collect information that is not required to provide or support the valet service.

5.1 Information You Provide

• Name
• Email address
• Mobile phone number
• Vehicle details (make, model, color, license plate)
• Notes or instructions
• Voluntary photos (vehicle condition, personal notes)
• Payment information (processed securely through PCI-compliant partners)

Your mobile number is used exclusively for the account, valet, and platform SMS messaging described in this Policy.

Your contact number will not be shared with third parties for their marketing or other purposes.

5.2 Operational Valet Data

Automatically collected to ensure accurate documentation and operational accountability:

• Check-in timestamps and workflow events
• Parking timestamps and parking location metadata
• Vehicle movement logs
• Retrieval requests and completion timestamps
• Damage photos captured by staff
• Key handoff logs
• Employee accountability logs
• Audit trails with detailed event history

5.2A Vehicle Images & License Plates

Valet staff use the Platform's mobile application to photograph vehicles at check-in and during service, including the license plate and the vehicle's condition. The Platform may use automated image processing, including computer vision and optical character recognition, to read the license plate and identify the vehicle's make, model, or color from those images. This processing may run on the staff device or through service providers acting on our instructions, and it exists to identify the right vehicle, reduce typing errors, and document condition.

Your license plate is the identifier that links your vehicle to your valet session, to any receipt or validation applied to it, to a parking permit or program you enrolled in, and to the check that prevents the same vehicle from being checked in twice at one location. Plate lookups are performed within the records of the valet company operating the location; we do not use your plate to look you up across unrelated valet companies. We do not use facial recognition or any other biometric identification, and images are not used to train models offered to the public.

Plate readings and vehicle images are retained with the session record under the schedule in Section 10.

5.3 Technical & Device Data

Collected automatically for security and performance:

• IP address
• Browser type and version
• Device identifiers
• Operating system
• Session identifiers
• Error logs
• Navigation patterns
• Performance analytics

5.4 Cookies & Tracking Technologies

What Are Cookies? Cookies are small text files stored on your device when you use the Platform. We use cookies and similar tracking technologies to maintain login sessions, secure workflows, optimize performance, and detect misuse.

Types of Cookies We Use:

Essential Cookies (Required):

• Session management: Keep you logged in during your visit
• Security: Prevent unauthorized access and detect suspicious activity
• Core functionality: Enable basic platform features

Analytics:

• The valletto.io marketing site uses a privacy-focused, cookieless page analytics service that records page views and performance and does not track visitors across other sites.
• Error logging on the Platform identifies and fixes technical issues.
• We do not use advertising pixels, remarketing tags, or cross-site tracking on any part of the Platform.

Third-Party Cookies: Some embedded services set their own cookies under their own privacy policies: the meeting-scheduling widget on the marketing site, the payment processor on payment pages (used for fraud prevention), and the authentication provider that keeps you signed in. We do not place third-party cookies for advertising.

Cookie Lifespan: Session cookies are deleted when you close your browser. Persistent cookies remain for up to 1 year.

How to Manage Cookies: You may adjust cookie settings through your browser (e.g., Chrome: Settings → Privacy and Security → Cookies; Firefox: Settings → Privacy & Security → Cookies; Safari: Preferences → Privacy → Cookies).

Impact of Disabling Cookies: Disabling essential cookies may prevent you from using certain Platform features, including login and secure transactions.

For questions about cookies, contact privacy@valletto.io.

5.5 Information About Valet Company Staff

If you work for a valet company that uses the Platform, your employer creates your account and the Platform records information needed to run the operation and to keep time and payroll records:

• Your name, mobile phone number, email address, role, and the profile photograph your employer asks you to provide
• Time-clock punches, shift assignments, schedule changes, and time-card records
• Device location at the moment you clock in or out, only where your employer has enabled a clock-in radius for the location, and only while the application is in use. The Platform does not track your location continuously or in the background.
• Activity logs: which sessions you handled, the actions you took, and when
• Photographs you take with the application, which are stored with the session they document

Your employer is the controller of this information and decides how it is used for scheduling, payroll, and accountability. Valletto processes it on your employer's instructions. Questions about pay, hours, or employment records go to your employer; you may also contact us at privacy@valletto.io. The Platform User Terms at valletto.io/user-terms describe this in more detail.

5.6 Records Supplied for Analysis

At a valet company's request, Valletto prepares operational and financial analysis, staffing plans, pricing scenarios, and proposals for the properties that company serves or bids to serve. To do that, the valet company or the property may supply Valletto with exports from other parking, payment, payroll, or accounting systems. Those records may contain personal information about guests or staff, such as ticket numbers, phone numbers, approver names, or payment amounts.

• We use those records only to prepare the analysis that was requested.
• Analysis reports shared with a property are aggregated: they describe volumes, revenue, timing, staffing, and pricing. They do not list guests' names, phone numbers, or plates.
• We keep the supplied records for the duration of the engagement and delete them within 90 days after delivering the analysis, unless the valet company asks us in writing to keep them or the law requires retention.
• We do not sell, share, or reuse those records for any other purpose.

6. How We Use Your Information

We use the information collected strictly for operational, security, compliance, and service-related purposes. We do not use personal information for advertising, behavioral profiling, or marketing of any kind. Every use of data is tied directly to valet operations or system stability.

Primary Uses Include:

• Managing check-in, parking, and retrieval workflows
• Sending required SMS updates
• Maintaining operational accuracy and logs
• Supporting employee accountability
• Processing payments and issuing digital receipts
• Enhancing performance and preventing fraud
• Investigating damage claims or safety concerns
• Responding to payment disputes, including providing session records to the valet company, the payment processor, and the card issuer
• Preparing operational and financial analysis and proposals for valet companies at their request (Section 5.6)
• Meeting carrier, regulatory, or legal requirements
• Ensuring system reliability and uptime

We do not use guests' or staff members' personal information for advertising or marketing, and we do not sell it.

7. SMS Messaging & 10DLC Compliance

SMS communication is a core functional requirement of valet operations, and Valletto adheres strictly to CTIA and carrier compliance rules. Messages are limited exclusively to operational content and are never used to promote offers, market services, or send unrelated content. This section outlines how SMS is used, how consent is obtained, and how STOP/HELP commands function.

7.1 Purpose of SMS Messages

Valletto sends transactional SMS messages tied to a valet session, an account, or a service relationship. Depending on how you use the Platform, these may include:

• Guest parking session updates: check-in confirmation, vehicle status, approaching and retrieval notifications, timing updates, and urgent or required service information
• Employee and staff onboarding: account invitations, sign-in links, and operational notifications
• Partner onboarding: account invitations and payment (Stripe) setup for property and business partners
• Account verification and security alerts
• Operational notifications related to use of the Platform

Guest numbers are collected through the opt-in flow described below. Employee and partner numbers are provided by the employer or business for use of the Service; the messages sent to them are transactional account messages needed to use the Platform for work, not marketing. All recipients may reply STOP to opt out and HELP for assistance at any time.

7.2 Required Intake Disclosure

Displayed directly above the opt-in checkbox:

"I agree to receive SMS updates about my valet service. Message and data rates may apply. Message frequency varies. Reply STOP to unsubscribe or HELP for assistance."

7.3 STOP & HELP

• STOP immediately ends all SMS communications for the session
• HELP provides support contact details

7.4 Required No-Sharing Clause

Your contact number will not be shared with third parties for their marketing or other purposes.

8. Information Sharing & Disclosure

Valletto does not sell, rent, trade, or share personal information for marketing or unrelated purposes. Information is only shared when essential to providing valet services, ensuring safety, complying with legal requirements, or supporting system infrastructure.

8.1 Service Providers

We work with vetted third-party processors for:

• Cloud hosting
• SMS delivery
• Security monitoring
• Payment processing
• System analytics

8.2 Property or Building Management

Limited data may be shared for:

• Security checks
• Gate or garage access
• Incident review
• Identity confirmation
• Operational analysis reports and proposals prepared at the valet company's request (Section 5.6), which summarize activity at the property and do not include guests' names, phone numbers, or plates

8.2A Payment Disputes

If you dispute a charge with your card issuer, the records of the session in question, which may include vehicle photos, plate readings, timestamps, staff activity, and the text messages sent to your phone, may be provided to the valet company, the payment processor, the card networks, and your card issuer as evidence in the dispute.

8.2B Between Valet Companies

Each valet company's records are kept separate on the Platform. We do not share your session history, plate, or phone number between unrelated valet companies. If Valletto introduces a program under which a phone number or vehicle associated with a payment dispute of an authorized charge is restricted at more than one participating valet company, as described in the Guest Terms, we will update this Policy before that program begins, and the only information shared would be the phone number, plate, and dispute reference needed to apply it.

8.3 Legal Obligations

We may disclose information to:

• Law enforcement
• Government authorities
• Courts and legal processes
• Investigators responding to fraud, threats, or safety issues

8.4 Business Transfers

In a merger or acquisition, data may be transferred to the successor entity under this same policy.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect personal and operational data. Our infrastructure runs on industry-standard cloud providers, and we review who has access to what on a regular basis.

Security measures include:

• Encryption in transit and at rest, provided by our cloud infrastructure
• Role-based access controls and separation of each valet company's records
• Audit logging and monitoring of access and infrastructure
• Dependency and vulnerability monitoring of the Platform's software, with periodic security reviews
• Encrypted backups that roll off on a fixed cycle
• Security training for personnel with access to personal information

9.1 Data Breach Notification

In the event of a data security breach involving unauthorized access to or disclosure of personal information, we will:

Notification to Affected Individuals:

• Notify affected users without unreasonable delay, typically within 30–60 days of discovering the breach, or as required by applicable law
• Provide notification via email, SMS, or prominent website notice
• Include information about the nature of the breach, types of information affected, steps we are taking to address the breach, and steps you can take to protect yourself

Notification to Authorities:

• Notify applicable regulatory authorities as required by law (e.g., state attorneys general, data protection authorities)
• Comply with GDPR's 72-hour notification requirement where applicable

Cooperation: We will cooperate with law enforcement and regulatory investigations.

Limitation of Liability: To the maximum extent permitted by law, we are not liable for data breaches caused by factors outside our reasonable control, including third-party service provider failures, sophisticated cyberattacks, or employee errors despite reasonable security training.

For questions about our data breach procedures, contact privacy@valletto.io.

10. Data Retention

We retain information only as long as necessary to support valet services, protect against disputes, meet legal obligations, and maintain operational records. Retention periods may vary depending on the type of information and may also vary depending on legal and operational requirements.

Retention schedule:

• Valet session records, including vehicle photos, plate readings, timestamps, and activity logs: 24 months after the session ends, and longer while a damage claim, payment dispute, investigation, or legal hold is open
• Payment records and receipts: 7 years, as required by tax and financial recordkeeping rules
• SMS consent records and message logs: 4 years, as required to demonstrate messaging compliance
• Staff time-clock and time-card records: as long as wage and hour law requires the employer to keep them, and as the employer instructs
• Records supplied for analysis (Section 5.6): 90 days after the analysis is delivered
• Account information for valet companies, staff, partners, and residents: for the life of the account and 90 days after it closes
• A valet company's data after its agreement with Valletto ends: deleted or anonymized within 90 days, except backups, which roll off on their fixed cycle

11. Your Privacy Rights

Depending on your jurisdiction, you may have the right to request access to your personal data, correction of inaccurate information, deletion of certain data, restrictions on processing, or copies of your information. We honor all rights as required under applicable laws.

11A. State-Specific Privacy Rights

Depending on your state of residence, you may have additional privacy rights under applicable state laws. This section describes the rights available to residents of certain U.S. states.

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose categories of personal information we collected about you, categories of sources, business or commercial purpose, categories of third parties with whom we share your personal information, and specific pieces of personal information we collected about you.
• Right to Delete: You have the right to request that we delete personal information we collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. We do not sell or share personal information as defined by the CCPA.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide valet services.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA rights.

How to Exercise Your Rights: Submit requests to privacy@valletto.io. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf. We may require verification of your identity before processing requests.

Virginia Residents (VCDPA)

If you are a Virginia resident, you have the following rights under the Virginia Consumer Data Protection Act (VCDPA):

• Right to Access: Confirm whether we process your personal data and access such data
• Right to Correction: Correct inaccuracies in your personal data
• Right to Deletion: Delete personal data you provided
• Right to Data Portability: Obtain a copy of your personal data in a portable format
• Right to Opt-Out: Opt out of processing for targeted advertising, sale of personal data, or profiling (we do not engage in these activities)

Submit requests to privacy@valletto.io. We will respond within 45 days. If we deny your request, you may appeal by contacting privacy@valletto.io.

Colorado Residents (CPA)

If you are a Colorado resident, you have rights under the Colorado Privacy Act (CPA) similar to those described for Virginia residents above, including right to access, correct, delete, and obtain a copy of your personal data; right to opt out of targeted advertising, sale of personal data, and profiling; and right to appeal denials of requests. Submit requests to privacy@valletto.io.

Connecticut, Montana, Oregon, Texas, and Utah Residents

Residents of Connecticut, Montana, Oregon, Texas, and Utah have similar rights to those described above under their respective state privacy laws. To exercise your rights, contact privacy@valletto.io.

Other States

If you reside in a state with privacy laws not listed above, you may still have rights under those laws. Contact privacy@valletto.io for information about exercising your rights.

12. International Data Transfers

Your information may be processed in the United States or other regions where our infrastructure or vendors operate. We ensure that any international transfers comply with applicable data protection laws and include appropriate safeguards.

For customers subject to GDPR, we execute a Data Processing Addendum (DPA) available upon request at privacy@valletto.io or at the URL provided in your Master Service Agreement.

13. Changes to This Privacy Policy

We may update this Privacy Policy as our Platform evolves or as legal requirements change. When updates occur, the "Last Updated" date will be modified. Significant changes may be presented through notifications or informational banners.

14. Terms of Service Reference

The terms that govern your use of the Platform depend on who you are:

• Valet companies: the Master Service Agreement at valletto.io/terms
• Guests: the Guest Terms at valletto.io/guest-terms and the terms posted by the valet company at yourcompany.valletto.io/terms
• Valet staff, managers, and partner contacts: the Platform User Terms at valletto.io/user-terms
• Residents: the Resident Terms shown in the resident application
• Everyone who receives text messages: the SMS terms at valletto.io/sms-consent

15. Contact Information

For questions, privacy requests, or concerns regarding this Policy:

Valletto LLC
1111 Brickell Avenue
Suite 1000, 10th Floor
Miami, FL 33131

Email:

• Privacy inquiries: privacy@valletto.io
• General inquiries: info@valletto.io
• Legal notices: legal@valletto.io
• Technical support: support@valletto.io

Website: https://valletto.io

Acceptance

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your information as described in this Privacy Policy.