Privacy Policy

1. Information We Collect

DriveDrop ("we," "us," or "our") collects the following categories of information to provide and improve our vehicle shipping marketplace:

• Personal Information: Name, email address, phone number, physical address, date of birth
• Driver Information: Driver's license number, Social Security Number (for background checks and 1099 tax reporting), commercial insurance details, vehicle registration
• Vehicle Information: Make, model, year, VIN, vehicle condition, photos taken before and after transport
• Location & GPS Data: Pickup and delivery addresses; real-time GPS coordinates of drivers during active assignments; route history for completed deliveries
• Payment Information: Payment card details are tokenized and processed securely through Stripe. DriveDrop does not store full card numbers, CVVs, or raw banking credentials
• Usage Data: Pages visited, features used, search queries, session timestamps, device type, IP address, browser type
• AI Conversation Data: Messages you send to and receive from the Benji AI assistant, including booking requests, status inquiries, and support conversations
• Uploaded Documents & Images: Driver's license scans, insurance certificates, vehicle condition photos, and any other files you upload to the platform
• Communications: SMS messages sent or received via Twilio, in-app chat messages between clients and drivers, email correspondence with support

2. How We Use Your Information

We use collected information for the following purposes:

• Facilitate vehicle shipping quotes, bookings, and deliveries
• Process payments, hold deposits, capture final charges, and issue refunds via Stripe
• Verify driver identities and conduct criminal and driving record background checks
• Power the Benji AI assistant to answer questions, generate quotes, and assist with bookings
• Send booking confirmations, status updates, delivery notifications, and support responses via email and SMS
• Share real-time driver location with clients during active deliveries
• Detect and prevent fraud, abuse, and unauthorized account access
• Comply with legal obligations including IRS reporting, FCRA, and state transportation regulations
• Analyze platform usage to improve features and user experience
• Send promotional materials only with your explicit consent (you can opt out at any time)

3. Information Sharing

We share your information only as described below:

• Drivers: Client contact information and shipment details shared with the assigned driver only
• Clients: Driver name, photo, vehicle, and real-time GPS location shared with the client during active deliveries
• Payment Processor (Stripe): Payment card data processed under Stripe's PCI-DSS Level 1 environment
• Background Check Providers: Driver SSN and identifying information for screening purposes only
• Email Provider (Brevo / Gmail): Email address and message content for transactional and notification emails
• SMS Provider (Twilio): Phone number and message content for delivery notifications and booking updates. Your SMS opt-in consent and phone number are never shared with third parties for marketing purposes.
• AI Provider (OpenAI): Conversation messages sent to Benji are processed by OpenAI's API. See Section 4 for details
• Legal Authorities: When required by law, court order, or to protect the rights, property, or safety of DriveDrop, our users, or the public
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity

We do NOT sell your personal information to third parties for advertising or marketing purposes.

4. Benji AI Assistant — Data Processing

Our AI assistant "Benji" is powered by OpenAI's API (GPT-4o and GPT-4o-mini models). When you interact with Benji, the following applies:

• Data Sent to OpenAI: The content of your conversation messages, including any shipment details, addresses, or vehicle information you provide, is transmitted to OpenAI's API for processing
• Document Extraction: If you upload documents (e.g., vehicle titles, insurance cards), Benji may process the text content of those documents to assist with your request
• Conversation Logs: AI conversation histories are stored on our servers for up to 1 year to support continuity, dispute resolution, and service improvement
• No Training on Your Data: We use OpenAI's API in a manner that does not permit OpenAI to use your conversations to train their models (as per OpenAI's API data usage policies)
• Limitations: Benji is an AI and may make mistakes. Do not rely solely on Benji for legal, financial, or safety-critical decisions. Final booking terms are always confirmed in writing

5. Payment Data & Stripe

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor.

• DriveDrop does not store, log, or transmit full card numbers, CVV codes, or raw bank account numbers
• Stripe tokenizes your payment method and provides DriveDrop with a token and last-4-digit reference only
• A 20% deposit is authorized at booking using Stripe's manual capture method; the remaining 80% is captured upon delivery confirmation
• Refunds are processed back to your original payment method through Stripe per our cancellation policy
• For questions about Stripe's data practices, see stripe.com/privacy

6. GPS & Location Data

• Driver Location: When a driver accepts an assignment, their real-time GPS coordinates are collected and transmitted to our servers and shared with the corresponding client
• Active Delivery Only: GPS tracking is active only during accepted assignments. Location data is not continuously collected when a driver is offline
• Route History: Completed delivery routes are retained for 90 days for dispute resolution and service quality purposes
• Client Addresses: Pickup and delivery addresses are stored as part of the shipment record for the duration of data retention (see Section 10)

7. Cookies, Analytics & Logs

• Essential Cookies: Required for authentication, session management, and core platform functionality. Cannot be disabled
• Analytics: We collect anonymized usage logs (page views, feature interactions, error logs) to improve the platform. These do not identify you personally
• Server Logs: IP addresses, request timestamps, and browser/device information are logged for security monitoring and retained for 90 days
• No Third-Party Ad Tracking: We do not use third-party advertising cookies or cross-site tracking technologies
• You can manage cookie preferences in your browser settings, though disabling essential cookies may impair platform functionality

8. SMS Communications & Twilio

DriveDrop uses Twilio to send SMS notifications related to your bookings and deliveries.

• Consent: By providing your phone number and using our Services, you consent to receive transactional SMS messages (booking confirmations, driver assignments, delivery updates, support responses)
• Message Frequency: Message frequency varies depending on your activity. You may receive multiple messages per active shipment
• Opt-Out: Reply STOP to any SMS message to unsubscribe from all future messages. Reply HELP for assistance
• Message & Data Rates: Standard message and data rates from your mobile carrier may apply
• No Third-Party Marketing: Your phone number and SMS opt-in consent are never sold or shared with third parties for marketing or promotional purposes
• Program Support: For SMS support, contact support@drivedrop.us.com or call +1 (704) 266-2317

9. Data Security

We implement industry-standard technical and organizational measures to protect your information:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for sensitive data at rest (SSN, background check data)
• Row-level security policies on our database to ensure users can only access their own data
• Access controls and role-based permissions for internal staff
• Secure cloud infrastructure hosted on Supabase and Railway

Despite these measures, no internet transmission or electronic storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@drivedrop.us.com.

10. Data Retention

We retain your information for the following periods:

• Account Data: Retained until you request deletion or 7 years of inactivity, whichever comes first
• Transaction Records: 7 years (required by IRS regulations)
• Driver Background Check Data: 7 years (required by FCRA)
• Communication Logs (email, SMS, in-app chat): 2 years
• AI Conversation History: 1 year from last message
• Server & Access Logs: 90 days
• GPS Route History: 90 days post-delivery

After retention periods expire, data is securely deleted or anonymized. Certain data may be retained longer if required by an ongoing legal proceeding or regulatory obligation.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal data, subject to legal retention requirements — Submit a deletion request
• Opt-Out of Marketing: Unsubscribe from promotional emails at any time via the unsubscribe link in any email, or by contacting us
• SMS Opt-Out: Reply STOP to any SMS message
• Data Portability: Request your data in a machine-readable format (JSON/CSV)
• Object to Processing: Object to certain processing activities such as profiling

To exercise any of these rights, contact us at privacy@drivedrop.us.com. We will respond within 30 days.

12. Children's Privacy

DriveDrop Services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@drivedrop.us.com and we will delete it promptly.

13. International Users

Our Services are offered primarily within the United States. If you access our platform from outside the US, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our Services, you consent to this transfer and processing.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and/or a prominent notice within the platform at least 30 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of our Services after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For privacy-related questions, requests, or concerns, please contact us:

• Email: privacy@drivedrop.us.com
• Phone: +1 (704) 266-2317
• Mail: DriveDrop, Inc. — Privacy Team, Charlotte, North Carolina, USA