Drivvo Privacy Policy

1. Data Controller

The controller responsible for processing your personal data is:

• Legal name: CRISTIAN CARDOSO DESENVOLVIMENTO - ME
• Trade name: CTN CARDOSO
• Company registration (CNPJ): 23.188.714/0001-70
• Address: R. Cunha Gago, 198 — Pinheiros — São Paulo/SP — CEP 05421-000, Brazil
• Data Protection Officer (DPO) contact: support@drivvo.com

2. Data We Collect

We collect the following categories of data, matching the declarations made in the app stores' data safety forms:

3. Purposes and Legal Bases

We process personal data for the purposes below, each supported by a legal basis under the LGPD (art. 7) and the GDPR (art. 6):

• Performance of a contract — account data, vehicle records, and subscription management, to deliver the Service you request; and device location, when you use Where to refuel or enter a fuel-up, to show nearby stations and identify the station, and when you record a trip, to save the route in the trip.
• Legitimate interest — diagnostics, fraud prevention, and usage analysis to keep the Service secure and to improve it; and use of fuel prices from fuel-ups and of the prices and suggestions submitted about stations, without identifying you, to keep station prices and details in Where to refuel up to date for the whole community.
• Consent — personalized advertising for users in the European Economic Area (EEA), collected through the UMP SDK.
• Legal obligation — retention of tax and transactional records as required by law.

4. Sharing with Third Parties

We share data only with the following parties, for the stated purposes:

• Google (AdMob / Google Mobile Ads SDK) — receives IP address, device identifiers, interactions, and diagnostic data, for advertising, analytics, and fraud prevention.
• Google (Firebase Analytics and Crashlytics) — user identifier, usage events, and crash reports.
• Google (Maps SDK) — display of maps in the app; receives technical device data and the map area being shown, in order to load the map.
• Google Play and Apple App Store — payment processing and subscription validation.
• Stripe — processing of payments and subscriptions made through the web version, including payment and transaction data, acting as a data processor.
• Amazon Web Services (S3) — storage of attached files, acting as a data processor (operador), without any use of the data for its own purposes.
• Google (Google Analytics) and Microsoft (Clarity), only on the drivvo.com website: with your consent, IP address, technical browser data and page navigation, to measure how the site is used; without your consent, Google Analytics receives only cookieless signals with no identifier, and Clarity is not loaded.

Your location, coordinates of places saved by the user, attached files, and the records you enter are not shared with any third party for that third party's own purposes.

5. Where to Refuel: Station Prices and Suggestions

Where to refuel shows fuel stations and prices kept up to date with the help of the user community. To do so:

• Fuel-up prices. When you enter a fuel-up with the station selected, the fuel, the unit price, and the date become part of the price shown for that station and of the price statistics for the region. No other user sees your name, your vehicle, or any other fuel-up data.
• Submitted prices and suggestions. The prices you update at a station and the change suggestions you send (such as brand, services, closure, or duplicate station) are linked to your account, so that each account counts once and abuse is prevented. Other users see only the result, such as the updated price or the change applied to the station, without knowing who contributed.
• Location. With your permission, the device location is used while the app is in use to show nearby stations and to identify the station when you enter a fuel-up, and it is saved with the fuel-up. When you send a change suggestion, we record your position at that moment to check the distance to the station. During trip recording, the location keeps being used with the screen off or with another app open, only between tapping Start recording and tapping Stop recording (or the automatic stop after 2 hours without movement), with the system notice visible while recording; the route, with speed and time along the way, the stops and the driving indicators are saved in the trip and, in a fleet account, are shown to whoever already sees the vehicle's trips. Outside recording, Drivvo does not use your location in the background. You can deny or revoke the permission at any time in your device settings, and the rest of the app keeps working.
• Deletion. When you delete your account, your change suggestions are deleted, and the prices you contributed remain in the stations' price history with no link to you. Deleting a single fuel-up does not remove a price already added to the station's history; to request that removal, write to support@drivvo.com.

6. International Data Transfer

Some data is stored on servers located outside Brazil, on Amazon Web Services (AWS) infrastructure in the us-east-1 (Northern Virginia, United States) region. When personal data is transferred internationally, we apply the safeguards required by the LGPD and, where applicable, the GDPR, such as contractual clauses and providers that maintain adequate security standards.

7. Data Retention

We retain data only for as long as necessary for each purpose:

• Account data, vehicle records, and other data entered into the platform: until account deletion, then deleted within 30 days
• Fuel prices from fuel-ups and prices submitted to Where to refuel: kept in the stations' price history and unlinked from the account when it is deleted
• Diagnostics and crash logs: 30 days
• Security logs: 30 days

After the applicable period, data is deleted or irreversibly anonymized.

Tax invoices issued in connection with payments are kept in our accounting records, separately from the platform, for the period required by applicable tax law. These documents are not part of the data stored on the platform, nor are they reconstructed from it after account deletion.

8. Your Rights

You have the rights provided by applicable data protection law, such as the LGPD and the GDPR: access, correction, deletion, portability, restriction of processing, objection, withdrawal of consent, and complaint to the competent authority.

You can delete your account or specific data directly in the app: see the Account and Data Deletion page. To exercise the other rights, write to support@drivvo.com, preferably from your account email. We may ask you to confirm your identity before fulfilling a request, and the response follows the deadline set by applicable law.

9. Security

We adopt technical and organizational measures to protect personal data, including encryption in transit (TLS/HTTPS), access control on a need-to-know basis, and storage on managed, monitored infrastructure. No method of transmission or storage is completely secure, but we work continuously to protect your information.

10. Advertising and Tracking

Drivvo may display advertising and, for that purpose, uses advertising identifiers:

• On Android, the Advertising ID is used to serve ads. You can reset or delete it in your device system settings.
• On iOS, the IDFA is collected only with your explicit authorization through the App Tracking Transparency (ATT) prompt. Declining does not prevent you from using the app — it only makes the ads non-personalized.
• For users in the European Economic Area (EEA), consent is collected through the UMP SDK and can be revoked at any time.

On iOS, tracking authorization is requested only once, the first time the app is opened, and can be changed at any time in the system settings, under Settings → Privacy & Security → Tracking. On Android, the Advertising ID can be reset in your device settings.

On the drivvo.com website, we use Google Analytics and Microsoft Clarity to understand how the pages are used (pages viewed, clicks, scrolling and technical browser data). Cookies from these services are only used if you accept in the cookie notice. If you decline, Clarity is not loaded and Google Analytics works without cookies or identifiers: it receives only anonymous visit signals (page, time, browser type and country), used in aggregate statistics. You can change your choice at any time under Cookie preferences, in the site footer.

11. Children

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes and Contact

We may update this Privacy Policy from time to time. The latest version will always be available on this page, identified by its version number. For any questions about this policy or your personal data, contact us at support@drivvo.com.