PRIVACY NOTICE

We are committed to protecting the privacy and security of personal data collected and processed by Us through CARA mobile application (hereinafter referred to as the “Application” or “CARA”).

This Privacy Notice describes how We collect, use, store, disclose, transfer and otherwise process personal data.

By installing, accessing or using CARA or by otherwise providing personal data to Us, you acknowledge that you have read and understood this Privacy Notice. If you do not agree to or are not satisfied with any of the terms or conditions of this Privacy Notice, please discontinue accessing or using the website, applications or services.

CARA is available on Android, iOS, Wear OS, WatchOS, and Apple CarPlay platforms and currently supports the Citroën and Jeep brands in India. This Privacy Notice applies to all versions and interfaces of the Application.

ELIGIBILITY

CARA is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under the age of 18.

WHAT PERSONAL DATA WE COLLECT AND PROCESS

• Data provided by you

  When you use CARA you may provide Us with Personal Data. For example,

  • Account information / login credentials: Email address and/or phone number.
  • User preferences: Home and/or office addresses, travel and food preferences, saved locations such as a friend’s home address, and other preferences you choose to store.
  • Reminders: Date, time, location, and priority details for reminders you create within the Application.

  If you provide Us with third party data, you will be held responsible for having shared such information. You must be legally authorized to share it (i.e. authorized by a third party to share their information, or for any other legitimate reason).

• Data collected by CARA and the Device

  When you access or use CARA We collect information on the Application and device you are using. This information includes:

  • Voice data: When you interact with CARA using voice commands, your voice input is captured and transmitted in real time to OpenAI’s servers for automatic speech recognition (ASR) and processing. Voice recordings are processed in real time and are used solely for the purpose of understanding and responding to your commands.
  • Location data: With your permission, CARA collects your precise GPS location to provide navigation, point-of-interest (POI) suggestions, proximity-based reminders, and location-based services. Location data is collected only when the Application is actively in use.
  • Vehicle telemetry data: CARA may collect vehicle status information including fuel level, door lock status, mileage, and engine status etc. This data is collected to enable accessing vehicle information remotely and making remote commands operational.
  • Conversation data: Your text and voice conversations with CARA, including contextual memory of relationships and preferences, are retained for up to 30 days to enable personalised and contextual responses. After 30 days, conversation data is automatically deleted.
  • Device information: Device type, operating system version, and unique device identifiers.
• Information from third-party services

  When you use features that rely on third-party services (such as navigation via Google Maps, music via Spotify or YouTube Music, or flight information via FlightAware), those services may collect data in accordance with their own privacy policies. We encourage you to review their respective policies.

PURPOSE OF COLLECTING AND PROCESSING PERSONAL DATA

Personal data is collected and processed by Us for purposes including:

a. Provide Our services and related support

• Core services: Voice-based interaction, navigation, vehicle status monitoring, remote vehicle operations, reminders, media playback, and real-time information (weather, flights, stocks, news).
• Personalisation: Remembering your preferences, explicitly asked information, and past conversations to deliver a contextual and human-like experience.
• Vehicle expert support: Answering questions from brand-specific user manuals and providing troubleshooting guidance.
• Safety features: Enabling SOS and roadside assistance functionality to facilitate communication and assistance requests. However, it is not to be relied upon as a substitute for emergency services.
• Smartwatch integration: Sending alerts and enabling commands via Wear OS and WatchOS.
• Service improvement: Understanding usage patterns to improve Application performance and features.

b. Statistical purposes

For statistical purposes, without it being possible to trace your identity (“Statistics”).

c. Complying with legal obligations

We may use your personal data to comply with legal obligations and orders to which We are subject to, which are the legal basis for the processing of your personal data.

Some legislations may require Us to share your personal data with public authorities. If this sharing is not required by law of your country, we may still send your data, as explained in more detail in the following purpose “Protecting of our interests and your interests”.

d. Protection of our interests and your interests

To the extent permissible under applicable data protection law, We may need to use your personal data to detect, react to and prevent fraudulent and illegal behavior or activities which could compromise the security of Our services and Application. This may occur when you use CARA in ways other than as permitted, or if you engage in inappropriate behavior. These purposes also include audits and assessments of our business operations, security audits, financial controls, records and information management program, and otherwise related to the administration of our general business, accounting, record keeping and legal functions.

These activities are undertaken for business, security, fraud prevention and legal compliance purposes and safeguards our interests and protects Our users, including you.

THIRD-PARTY SERVICES AND DATA SHARING

CARA integrates with the following third-party services to deliver its features. Data shared with these providers is limited to what is necessary for the specific functionality:

Service Provider	Data Shared	Purpose
OpenAI	Voice input, text queries	Speech recognition, language processing, text-to-speech, and conversational AI
Google Maps / Google Services	Location coordinates, search queries	Navigation, location information, and grounding search for real-time web information
Spotify / YouTube Music	Search queries (no user account login)	Music and podcast playback initiation
Livekit	Voice session data	Voice agent and room creation for real-time voice interaction
FlightAware	Flight numbers / queries	Real-time flight status information
OpenWeather	Location coordinates	Weather forecasts, UV index, and weather-related information

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes. We do not use any analytics or advertising SDKs within the Application.

CARA does not log into your Spotify or YouTube Music accounts. Media playback is initiated through natural voice commands without accessing your personal account data on those platforms.

HOW TO MANAGE YOUR CHOICES AND REPORTING

At any time, you can ask to:

• Access your Personal Data: depending on your use of Our services, we will provide the personal data we have about you;
• Correct your personal Data: for example, you can ask us to modify your e-mail address or telephone number if they are incorrect;
• Erase your Data: subject to applicable legal obligations.
• Withdraw your consent: for example, when you do not want to use your services any longer.

For any questions, grievances or requests relating to your personal data, please contact our Data Protection Officer directly at:

Brand	Company	Contact
Jeep	Stellantis India Private Limited	dataprotectionofficer@stellantis.com
Citroën	Stellantis Automobiles India Private Limited	dataprotectionofficer@stellantis.com

WHO DO WE DISCLOSE YOUR PERSONAL DATA

We may disclose your personal data to the following recipients and/or categories of recipients (“Recipients”):

• Persons authorized by Us to perform any of data-related activities described in this document e.g. Our employees and collaborators
• Our Data Processors: external subjects to whom We delegate some processing activities and ensure that your Data is processed with appropriate safeguards.
• System administrators: Our employees or those of Data Processors to whom We have delegated the management of Our IT systems and are therefore able to access, modify, suspend or limit the processing of your Data.
• Law enforcement or any other authority whose provisions are binding on us: this is the case when We have to comply with a judicial order or the law or defend ourselves in legal proceedings.

HOW YOUR DATA IS STORED

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols.
• Secure API communication with all third-party service providers.
• Bluetooth-secured communication between the Application and your vehicle.
• Access controls and authentication through OEM backend systems.

While we take reasonable steps to safeguard your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your information.

WHERE YOUR DATA IS LOCATED

We are a global company and Our services are available in multiple jurisdictions around the world. This means that your personal data may be stored, accessed, used, processed and disclosed outside your jurisdiction where Our data processors and sub-processors are located, or where their servers or cloud computing infrastructure may be hosted. We take steps to ensure that the processing of your personal data by our Recipients is compliant with applicable data protection laws.

HOW LONG IS YOUR PERSONAL DATA STORED

Personal data shall be retained only for as long as necessary to fulfil the purposes described in this Notice or until your exercise of the right to withdraw consent. However, the data might be stored for a longer period if required by law or for legitimate business or legal purposes.

• Voice recordings & Conversation data: Voice recordings are not retained. However, conversation transcripts and contextual interaction history may be retained for up to 30 days.
• Location data and Vehicle telemetry: Used in real time. Not stored beyond the active session.
• Account information: Retained as long as your account is active with the OEM backend. Upon account deletion, your data will be removed in accordance with OEM retention policies.
• User preferences and reminders: Retained as long as your account is active. Deleted upon account deletion or user request.

APPLICATION PERMISSIONS

CARA requires the following device permissions to function. All permissions are requested with your explicit consent:

• Microphone: for voice-based interaction with the AI assistant.
• Location (precise): for navigation, POI suggestions, proximity-based reminders, and location-aware services.
• Bluetooth: for connecting to your vehicle and smartwatch.
• Notifications: for delivering reminders.
• Phone / Contacts: for Bluetooth-integrated voice calling functionality. Not stored on CARA servers.
• Internet access: for all cloud-based AI processing, third-party service integrations, and real-time data retrieval.

You may manage or revoke device permissions any time through your device settings. Revoking certain permissions may limit the functionality of the Application.

CHANGES TO THE NOTICE

We may amend any of the terms and conditions mentioned in this Notice from time to time, and We will publish the latest and amended Notice on the date such amendments take effect. You are advised to check from time to time should there be any amendment made by Us towards this Notice. Access to Our website and applications on and after the date of the latest and amended Notice being published by Us signifies your agreement towards such amendments.

DISCLAIMER

Users should operate CARA responsibly and in compliance with applicable driving and road safety laws. CARA should not be used in a manner that distracts from safe driving.

Responses generated by CARA may be AI-generated and may not always be accurate, complete, or up to date. Users should independently verify critical information.

This Privacy Notice was last updated on May 25, 2026.