Privacy Policy

1. Who This Policy Applies To

This policy applies to all users of Drivesome.com and its associated websites, applications, and services, regardless of location. Jurisdiction-specific rights are set out in Sections 13 (Australia), 14 (EU/EEA/UK), 15 (California), and 16 (New Zealand).

2. Information We Collect

Account and profile information: name, username, email address, password (stored hashed), and any phone number, date of birth, profile and cover photo, bio, tagline, location (city/region), website, linked social accounts, and referral information you choose to provide.

Content and activity: posts, photos, videos, comments, reactions, reposts, saves, messages, cars added to your garage, car tags, event RSVPs and registrations, articles, poll responses, giveaway entries, and DCred and rewards activity.

Payment information: when you take out a paid membership or contribute to the Creator Fund, your card and billing details are collected and processed directly by our payment provider (Stripe). We do not store full card numbers; we retain limited records such as a transaction reference, amount, membership tier, and status.

Location information: the city or region on your profile, and, where you use location features (such as events "near you"), approximate coordinates derived from the location you provide. We do not collect continuous or background GPS location.

Information collected automatically: device and browser type, IP address, approximate geographic location, pages visited, time spent, referring source, and interactions, collected through cookies and analytics (see Sections 4 and 5).

Communications: emails and support messages you send us, and your email and notification preferences.

3. How We Use Your Information

• Create and manage your account and profile
• Provide the timeline, garage, events, articles, messaging, and other features
• Process memberships, payments, and Creator Fund contributions and payouts
• Operate DCred, DTix, ranks, draws, and giveaways
• Personalise your experience and recommendations
• Provide AI features such as car identification and content tools (see Section 6)
• Understand usage through analytics and improve the platform
• Send transactional emails and, where permitted, marketing communications
• Detect, prevent, and investigate fraud, abuse, and manipulation
• Comply with our legal obligations and enforce our Terms

4. Cookies and Tracking

• Strictly necessary cookies — session management, authentication, and security. These cannot be disabled.
• Functional cookies — remembering preferences such as display settings. Optional.
• Analytics cookies — Google Analytics 4. Optional. Consent is requested before these are set for users in the EU, EEA, and UK.
• Marketing cookies — reserved for future use and off by default.

You can manage cookies through the Cookie Preference Centre or your browser settings.

5. Analytics

We use Google Analytics 4, provided by Google LLC, to understand how the platform is used. It collects pages visited, time spent, traffic sources, device and browser information, approximate location, and events such as sign-ups and posts, using cookies and similar identifiers. Google may process this data on servers in the United States. You can opt out via the Cookie Preference Centre or the Google Analytics opt-out browser add-on.

6. Artificial Intelligence Features

Drivesome offers AI-assisted features, including car identification from photos, content suggestions, and AI-generated articles and images. To provide these, content you submit (such as photos you upload for car identification, or text prompts) may be sent to and processed by third-party AI providers, including Anthropic and OpenAI, which may process the data overseas (including in the United States).

AI outputs may be inaccurate or incomplete and should not be relied upon as professional advice. We do not use your private account information to train third-party AI models, and our providers process this data to return a result, not to train their models on it under our arrangements with them.

7. Payment Processing

Payments for memberships and Creator Fund contributions are processed by Stripe. Stripe collects and processes your payment details under its own privacy policy and may process or store data overseas. We receive confirmation and limited transaction details from Stripe but do not receive or store your full card number.

8. The Creator Fund

If you participate in the Creator Fund, we additionally process: engagement your content receives (including a record that a signed-in user viewed or read a piece of your content, used to measure genuine engagement); your rank and balance; and, where you request a payout, the identity, contact, payout, and any tax information needed to verify and pay you. Sponsor and donor contributions are processed through Stripe as described in Section 7. See the Creator Fund Terms for more detail.

9. How We Share Your Information

We do not sell your personal information. We share it only as follows:

• Service providers who help us run the platform — hosting and storage (DigitalOcean), analytics (Google), payments (Stripe), email delivery (Resend), and AI providers (Anthropic, OpenAI) — under contractual obligations to protect your data and use it only to provide their service to us.
• Other users and the public — your public profile, posts, and activity are visible to others. Information you keep private (such as your email, payout details, and date of birth) is not made public.
• Legal and safety — where required by law, or to protect the rights, safety, or property of Drivesome, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

10. Hosting and International Transfers

Drivesome's primary infrastructure, including the database and uploaded media, is hosted in Australia (DigitalOcean, Sydney region). Certain service providers, including Google, Stripe, Anthropic, and OpenAI, may process your data in the United States or other countries. Where we transfer data internationally, we take reasonable steps to ensure it is handled consistently with this policy and applicable law, including Standard Contractual Clauses where required under the GDPR.

11. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide the platform and comply with our legal, tax, and accounting obligations and to resolve disputes. When you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required or permitted by law to retain it (for example, transaction records).

12. Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Your Rights and Australian Privacy Act

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. You have the right to access the personal information we hold about you, request correction of inaccurate information, request deletion of your account and associated personal information, and request a machine-readable copy of your data.

To exercise any of these rights, email [email protected]. We aim to respond within 30 days. If you are not satisfied with how we handle a privacy matter, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Additional Rights — EU / EEA / UK (GDPR)

If you are in the EU, EEA, or UK, you also have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. Our lawful bases for processing are performance of our contract with you, your consent, our legitimate interests in operating and improving the platform, and compliance with legal obligations.

15. Additional Rights — California (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to request access and deletion, and to not be discriminated against for exercising your rights. We do not sell your personal information. To make a request, email [email protected].

16. New Zealand

If you are in New Zealand, we handle your personal information consistently with the New Zealand Privacy Act 2020 and its information privacy principles. You may access and request correction of your information using the contact details below.

17. Children

The minimum age to use Drivesome is 13. We do not knowingly collect personal information from children under 13. Users aged 13 to 17 require verified parent or guardian consent for prize draws, giveaways, and any reward redemption, including Creator Fund withdrawals. If you believe a child under 13 has provided us information, contact us and we will delete it.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the date above and, where changes are material, take reasonable steps to notify you. Continued use of the platform after an update constitutes acceptance of the revised policy.

19. Contact

For privacy enquiries and data requests:

Response time target: 30 days.