Privacy Policy

Effective October 5, 2026

This policy explains how DriveIt (“DriveIt,” “we,” “us”) collects, uses, shares and protects personal information when you use driveit.ai, the booking websites we host for car-rental businesses, and our related apps and services (together, the “Services”).

1. Who we are

DriveIt is a platform for car-rental businesses and independent hosts (“Operators”) to list vehicles, take bookings, verify renters, manage their fleet and run their business. People who book or rent vehicles (“Renters”) use the Services to search, book, verify their identity and manage trips. Operators may also invite team members, such as mechanics, to help manage their vehicles.

When an Operator uses DriveIt to run its rental business, the Operator decides how its customers’ information is used for its rentals, and DriveIt processes that information on the Operator’s behalf. Operators have their own privacy practices, and you may contact the Operator you rented from with questions about them.

2. Information we collect

Information you give us

Account information: name, email address, phone number, password or one-time sign-in codes, and profile details. If you sign in with Google or Facebook, we receive your name, email address and profile picture from that service.
Driver and identity information: driver’s license images and the details on them (such as name, date of birth, address, license number, expiration date and license class), selfies, and the results of identity and license checks. See section 3.
Insurance information: if you connect an insurance policy to verify coverage, the policy details your insurer shares (such as carrier, policy number, coverage, covered drivers and vehicles, and effective dates).
Booking and trip information: trip dates, pickup and return locations, additional drivers, messages, signed rental agreements, check-in and check-out photos, mileage and fuel levels, damage reports, tolls, tickets and related charges.
Payment information: payments are processed by Stripe. We receive limited details such as card brand, last four digits, billing postal code and payment status. We do not store full card numbers. Operators who receive payouts give Stripe their business and payout details directly.
Operator business information: business name, contact details, website content, vehicle listings and photos, pricing, policies, locations, maintenance and repair records, receipts, income and expense records, and team member invitations.
Communications: messages you send through the Services, support requests and survey responses.

Information from connected services (Operators)

Vehicle telematics (MooveTrax): if an Operator connects a MooveTrax device, we receive vehicle location, speed, mileage, battery and fuel levels, and lock status. We also send commands such as lock and unlock when the Operator or an authorized team member asks us to. Location is collected from the vehicle, including while it is on a trip.
Turo: if an Operator connects Turo through TuroVA or forwards Turo emails to a DriveIt address, we receive the Operator’s Turo listings, trips, guest names, trip photos, license verification status, and earnings and payout details contained in those emails.
Google Calendar: if an Operator connects it, we read and write calendar events for bookings.
Bank accounts: if an Operator links a bank account, we receive account and transaction data through Stripe Financial Connections. See section 4.

Information collected automatically

Device and usage information, such as IP address, browser type, device type, pages viewed, and dates and times of access.
Approximate location from your IP address, and precise location if you allow it in your browser (for example, to find cars near you).
Push notification tokens if you turn on notifications.

3. Identity verification and biometric information

To prevent fraud and confirm that the person renting a vehicle is the licensed driver, Operators may require Renters to verify their identity before a trip. When you verify:

We read the details on your driver’s license using Amazon Textract and an AI model (Anthropic Claude).
We ask you to take a live selfie. Amazon Rekognition checks that the selfie is of a live person (a “liveness” check) and compares your face with the photo on your license to produce a similarity score. This comparison uses facial geometry, which some laws treat as biometric information.

We use this information only to verify your identity and license for rentals, to prevent fraud, and to keep a record of the verification in case of a dispute. We do not use it to identify you for any other purpose, we do not sell it, and we do not build a database of face templates. Amazon processes the images to return the result. We keep the license images, selfie and verification result with your booking records, and we permanently delete the selfie and face comparison data when the purpose for collecting them has been met, and in any case within three years of your last interaction with DriveIt, unless the law requires us to keep them longer. By completing verification you consent to this collection and use. You can choose not to verify, but some Operators will not rent to you without it.

4. Linked bank accounts (Stripe Financial Connections)

DriveIt lets Operators link their business bank accounts so they can view and download their bank transactions inside DriveIt. We use Stripe Financial Connections, a service from Stripe, Inc., to make these connections.

What we collect. When an Operator links an account, we receive the account type, the institution name, the last four digits of the account number, and transaction details such as date, amount, description and merchant. We do not receive or store online banking usernames or passwords. Those are entered directly with Stripe or the bank.

How we use it. We use this data only to show Operators their own bank transactions and let them download those transactions for bookkeeping, reconciliation and reporting. We do not sell this data or use it for advertising, and we do not use it for credit decisions.

Who we share it with. The data is visible only to the Operator who linked the account and to the users that Operator authorizes. We share it with service providers, such as Stripe and our hosting provider, only as needed to run these features. We may also disclose it when required by law.

Storage and security. This data is stored in the United States and protected with encryption in transit and at rest, along with access controls.

Retention and disconnecting. Operators can disconnect a linked account at any time from their DriveIt settings or by contacting us. When an account is disconnected, we stop collecting new data from it. Transaction data already collected stays in the Operator’s DriveIt account until the Operator chooses to delete it. Operators can delete it at any time from their DriveIt settings, or by emailing [email protected], and we will delete it within 30 days of the request unless the law requires us to keep it longer.

Stripe’s role. Stripe’s handling of your data is covered by the Stripe Privacy Policy at https://stripe.com/privacy.

5. How we use information

To provide the Services: create accounts, list vehicles, process bookings and payments, and run trips.
To verify identity, driver’s licenses and insurance, and to prevent fraud, theft and misuse.
To help Operators manage their fleet, including vehicle location, lock control, maintenance, tolls and tickets, and finances.
To communicate with you by email, text message, WhatsApp and push notification about bookings, verification, payments, security and your account.
To use AI features: for example, reading documents and receipts, drafting listing descriptions and website content, and answering questions. These features send the relevant content to our AI provider for processing.
To provide support, improve and secure the Services, and fix problems.
To comply with law, enforce our terms, and resolve disputes, damage claims and chargebacks.

We do not sell personal information, and we do not use it for third-party advertising.

Between Renters and Operators: when you book, the Operator receives your name, contact details, driver and verification information, and trip details so it can rent you the vehicle. Renters see the Operator’s business and pickup details.
Operator team members: Operators can give team members, such as mechanics, access to some vehicle and maintenance information.
Service providers who process information for us under contract (see section 7).
Legal and safety: when required by law or legal process, or to protect the rights, property or safety of DriveIt, our users or others (for example, to report a stolen vehicle or respond to a toll authority or law enforcement).
Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.
With your direction: when you ask us to connect to another service or share information.

7. Service providers we use

Amazon Web Services: hosting, database, file storage, email delivery, and identity and face verification.
Stripe: payments, payouts and linked bank accounts.
Anthropic (Claude): AI processing of documents, receipts and text.
Twilio: text messages and WhatsApp.
Google: sign-in, maps and places, and calendar sync.
Facebook (Meta): sign-in.
Axle: insurance verification.
MooveTrax: vehicle telematics and remote lock control.
TuroVA: Turo data for Operators who connect it.

8. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Services. After that, we keep booking, payment, rental agreement, verification and tax records for as long as needed to meet legal, accounting and dispute-resolution obligations, and then delete or de-identify them. Biometric information is handled as described in section 3. Linked bank data stays until the Operator deletes it, as described in section 4. Operators control the business records they keep in DriveIt and can delete them.

9. Security and storage

We protect information with encryption in transit (HTTPS/TLS), encryption at rest, access controls and limited staff access. No system is perfectly secure, so we cannot guarantee absolute security. Our servers and databases are located in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States.

10. Your choices and rights

You can view and update your account information in your profile.
You can ask us to access, correct, download or delete your personal information by emailing [email protected]. We will verify your request and respond within the time required by law. We may keep information we are legally required to keep, or that is needed to complete a rental, resolve a dispute or prevent fraud.
You can opt out of marketing emails using the unsubscribe link. Reply STOP to opt out of text messages. You will still receive messages about active bookings and your account.
You can turn off push notifications and location access in your browser or device settings.
Operators can disconnect integrations (Stripe, Turo, MooveTrax, Google Calendar and bank accounts) at any time.

Depending on where you live, including California and other US states, you may have additional rights, such as the right to know what we collect, to delete it, to correct it, to opt out of its sale or sharing (we do not sell or share it for advertising), and not to be discriminated against for using these rights. You may use an authorized agent to make a request.

11. Cookies and similar technologies

We use cookies and browser storage that are needed to keep you signed in, remember your preferences and keep the Services secure. We do not use third-party advertising cookies. Google Maps may set its own cookies when a map is shown.

12. Children

The Services are not directed to children under 18, and you must be old enough to hold a driver’s license and meet the Operator’s age requirements to rent. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If we make material changes, we will notify you by email or in the Services before they take effect. The effective date at the top shows when it was last updated.

14. Contact us

For privacy questions or requests, including deletion requests, email [email protected].