← drv.club

Privacy Policy

Effective June 2026 · Last updated 2026-06-07

This Privacy Policy explains how DRV.club (the "App", "Service") collects, uses, shares, and protects your personal data. It applies to your use of the DRV.club mobile applications (iOS and Android), the website at drv.club, and all related services (together, the "Services").

The Services are operated by Prestigia Ltd ("DRV.club", "we", "us", "our"), an Israeli company (company number 513992214), with offices at 34 Burla St., Tel Aviv-Jaffa, Israel.

We are the data controller for the personal data we process about you, except where this policy says otherwise.

Contact: privacy@drv.club

1. Summary

If you only read one section, read §3 (what we collect) and §7 (how long we keep it).

  • We collect only what we need to run drives, convoys, the community, and rentals.
  • We do not sell your personal data — ever.
  • Precise location is shared only inside an active drive, with people in that drive.
  • Voice chat in convoys is transmitted peer-to-peer in real time and is not stored.
  • We use trusted processors (listed in §5) under written data processing agreements.
  • You can delete your account at any time in-app or by email — see §10.

2. Who this applies to

This Policy applies to anyone who uses DRV.club — drivers, club members, renters, and visitors to drv.club.

The App is not intended for children under 13. If you are between 13 and 16 (or the age of digital consent in your country), you may use DRV.club only with verifiable consent from a parent or legal guardian. If we learn that we have collected data from a child below the applicable minimum age without that consent, we will delete it.

3. What we collect

3.1 Information you give us directly

  • Account info — name, email, phone number, profile photo, password.
  • Authentication identifiers — Apple ID token, Google ID token (when you use Sign in with Apple / Google). We do not see your Apple or Google password.
  • Vehicle info — make, model, year, photos of your cars.
  • Drive content — routes you plan, drives you post, drive titles, RSVPs.
  • Posts and media — photos, captions, comments, club posts, drive moments.
  • Support content — messages you send to hello@drv.club or in-app support.
  • Rental requests — pickup city, dates, ID/license documents required to rent.

3.2 Information collected automatically

  • Precise location (GPS) — only when a drive/convoy is live, or when you actively report a hazard. Never silently in the background outside of an active drive.
  • Approximate location — city-level, when you open the discover map.
  • Device data — device model, OS version, app version, language, time zone.
  • Identifiers — DRV user ID, anonymized device identifier, push notification token.
  • Usage analytics — screens viewed, features used, taps, session duration. Aggregated; not used to build a profile of you.
  • Crash and performance data — stack traces, performance metrics, network errors. Diagnosed via Sentry.
  • Voice in convoy — real-time audio when you press the push-to-talk button. Not recorded. Not stored. Routed peer-to-peer through our voice partner (LiveKit).
  • In-app purchase events — subscription tier, transaction ID, renewal status. Card details handled by Apple, never seen by us.

3.3 Information from third parties

  • Apple and Google — Sign in identifiers and (with your permission) your name and email.
  • Apple StoreKit / Google Play Billing — payment confirmation and entitlement status. Not card details.
  • Map providers — Mapbox receives your approximate location to render tiles.
  • Rental partners — pickup confirmation, condition reports, and damage logs (if any).

4. How we use your data

We process your data on the following legal bases (GDPR Art. 6):

  • Contract performance — operate your account, run drives and convoys, process payments and rentals, send transactional messages.
  • Consent — precise location, optional marketing emails. You can withdraw any time.
  • Legitimate interest — detect fraud and abuse, protect the community, improve the Service via aggregated analytics.
  • Legal obligation — comply with tax, accounting, and legal requests.

We do not make automated decisions that significantly affect you. We do not use your data for advertising profiling and do not share data with ad networks.

5. Who we share data with

5.1 Service providers (data processors)

Each provider is bound by a Data Processing Agreement and processes data only on our instructions.

  • Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions) — account auth, database, file storage, server logic.
  • LiveKit — real-time voice transport for convoy walkie-talkie.
  • Mapbox — map tile rendering and geocoding.
  • RevenueCat — subscription entitlement management.
  • Sentry — crash and performance monitoring.
  • Expo / EAS — app build and over-the-air updates.
  • Apple Push Notification Service & Firebase Cloud Messaging — push notification delivery.
  • Resend — transactional email delivery.

5.2 Other DRV.club users

Content you choose to post in the community feed, in club posts, or on your public profile is visible to other DRV.club members. Your privacy settings (in-app) control who sees what. Inside an active convoy, your live location, position on the route, and voice are shared only with members of that convoy and only while it is live.

5.3 Rental partners

When you reserve a rental, the fleet operator in that city receives your name, contact info, pickup/return dates, and any ID/license documents required by local law. They process this data as an independent controller for the rental transaction.

5.4 Legal and safety

We may disclose data when we have a good-faith belief it is required by law, court order, or government request, or when needed to protect the safety of users or the public.

5.5 Business transfers

If DRV.club is acquired, merged, or undergoes a corporate change, your data may transfer to the successor entity, which will be bound by the commitments in this Policy.

We do not sell your personal data. Under the California Consumer Privacy Act (CCPA), the term "sale" is broad — DRV.club does not engage in sales as defined by the CCPA.

6. International transfers

DRV.club operates globally. Your data may be processed in Israel (our headquarters), the United States, and the European Union. When we transfer EU/EEA personal data to other countries, we rely on Standard Contractual Clauses approved by the European Commission, or on Israel's EU adequacy decision under GDPR Art. 45 (which simplifies transfers between the EU and Israel).

7. How long we keep your data

  • Active account data — while your account is active.
  • Posts, photos, drive plans — until you delete them or your account.
  • Convoy live tracking + voice — voice is not stored; tracking history kept for 30 days unless tied to a saved drive summary.
  • Authentication tokens — until you sign out or revoke them.
  • Aggregated, anonymized analytics — indefinitely (cannot be linked back to you).
  • Transaction records (rentals, subscriptions) — up to 7 years as required by tax and accounting law.
  • Safety-related logs (crash detection events you triggered) — up to 12 months.
  • Abuse and fraud signals — up to 24 months to prevent banned users from re-registering.
  • Support emails — up to 3 years from last contact.

When you delete your account (see §10), data is removed within 14 days, subject to the retention exceptions above.

8. Security

We use industry-standard technical and organizational measures, including encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, role-based access controls inside our team, audit logging, and a vetted incident response plan. No system is perfectly secure; we do not promise absolute security and recommend you also protect your account with a strong password or Sign in with Apple's hide-my-email option.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and supervisory authorities as required by GDPR Art. 33–34 and equivalent laws. Report suspected vulnerabilities to security@drv.club.

9. Your rights

Depending on where you live, you may have the following rights:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — delete your data and account.
  • Restriction — limit how we use your data.
  • Portability — receive your data in a machine-readable format.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — revoke optional consents (location, marketing).
  • Opt-out of marketing — unsubscribe link in any email.
  • Complaint — lodge a complaint with a supervisory authority (EU: your local DPA; Israel: Privacy Protection Authority; UK: ICO; California: California AG).

California (CCPA / CPRA) specific rights

  • Right to know the categories and specific pieces of personal data we collect.
  • Right to delete personal data, subject to legal retention.
  • Right to correct inaccurate data.
  • Right to limit use of sensitive personal data.
  • Right to non-discrimination for exercising your rights.
  • Right to opt-out of "sale" or "sharing" — we do not sell or share personal data as defined under the CPRA.

To exercise California rights, email privacy@drv.club with subject "California Privacy Request". We will verify your identity using account credentials.

We aim to respond to all requests within 30 days, with one possible 30-day extension for complex requests.

10. Deleting your account

You can delete your account at any time:

  • In-app: Settings → Delete account → Confirm. You will be signed out immediately and all data is removed within 14 days (subject to the retention exceptions in §7).
  • By email: send a request from your account email to privacy@drv.club with subject "Delete my DRV.club account".

Full details and what gets retained: see drv.club/delete-account.

11. Cookies and similar technologies

The DRV.club mobile App does not use browser cookies. The drv.club website uses:

  • Strictly necessary cookies — required for login and security.
  • Analytics cookies (if enabled) — to measure aggregated traffic. Opt-in only in EU/UK.

We do not use third-party advertising cookies.

12. Third-party links

DRV.club may link to third-party sites (e.g., Google Maps when sharing routes externally). Once you leave DRV.club, this Policy no longer applies.

13. Changes to this Policy

We may update this Policy as the Service evolves. When we make material changes, we will:

  • Update the "Last updated" date at the top.
  • Show an in-app notice the next time you open the App.
  • Send an email to your account address if changes affect your rights.

Continued use of the Service after a change means you accept the updated Policy.

14. Contact

Privacy questions and requests: privacy@drv.club

Data Protection Officer:
Prestigia Ltd — Data Protection Officer
34 Burla St., Tel Aviv-Jaffa 6936434, Israel

EU representative (Art. 27 GDPR): to be appointed. Until appointment, EU users may contact us directly at privacy@drv.club.

Israeli database registration: as required under the Israeli Privacy Protection Law 5741-1981.

General contact: hello@drv.club