Drivvo Privacy Policy

1. Data Controller

The controller responsible for processing your personal data is:

• Legal name: CRISTIAN CARDOSO DESENVOLVIMENTO - ME
• Trade name: CTN CARDOSO
• Company registration (CNPJ): 23.188.714/0001-70
• Address: R. Cunha Gago, 198 — Pinheiros — São Paulo/SP — CEP 05421-000, Brazil
• Data Protection Officer (DPO) contact: support@drivvo.com

2. Data We Collect

We collect the following categories of data, matching the declarations made in the app stores' data safety forms:

3. Purposes and Legal Bases

We process personal data for the purposes below, each supported by a legal basis under the LGPD (art. 7) and the GDPR (art. 6):

• Performance of a contract — account data, vehicle records, and subscription management, to deliver the Service you request.
• Legitimate interest — diagnostics, fraud prevention, and usage analysis to keep the Service secure and to improve it.
• Consent — personalized advertising for users in the European Economic Area (EEA), collected through the UMP SDK.
• Legal obligation — retention of tax and transactional records as required by law.

4. Sharing with Third Parties

We share data only with the following parties, for the stated purposes:

• Google (AdMob / Google Mobile Ads SDK) — receives IP address, device identifiers, interactions, and diagnostic data, for advertising, analytics, and fraud prevention.
• Google (Firebase Analytics and Crashlytics) — user identifier, usage events, and crash reports.
• Google Play and Apple App Store — payment processing and subscription validation.
• Stripe — processing of payments and subscriptions made through the web version, including payment and transaction data, acting as a data processor.
• Amazon Web Services (S3) — storage of attached files, acting as a data processor (operador), without any use of the data for its own purposes.

Coordinates of places saved by the user, attached files, and the records you enter are not shared with any third party for that third party's own purposes.

5. International Data Transfer

Some data is stored on servers located outside Brazil, on Amazon Web Services (AWS) infrastructure in the us-east-1 (Northern Virginia, United States) region. When personal data is transferred internationally, we apply the safeguards required by the LGPD and, where applicable, the GDPR, such as contractual clauses and providers that maintain adequate security standards.

6. Data Retention

We retain data only for as long as necessary for each purpose:

• Account data, vehicle records, and other data entered into the platform: until account deletion, then deleted within 30 days
• Diagnostics and crash logs: 30 days
• Security logs: 30 days

After the applicable period, data is deleted or irreversibly anonymized.

Tax invoices issued in connection with payments are kept in our accounting records, separately from the platform, for the period required by applicable tax law. These documents are not part of the data stored on the platform, nor are they reconstructed from it after account deletion.

7. Your Rights

As a data subject, you may exercise the following rights, subject to applicable law:

• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Deletion of your data and account
• Data portability
• Withdrawal of consent
• Objection to processing based on legitimate interest

You can delete your account or specific data directly in the app — see the Account and Data Deletion page. To exercise any other right, contact us at support@drivvo.com. We will respond within 30 days.

The rights of access and portability cover your personal data and are fulfilled free of charge through the channel indicated above, within the legal deadline. Exporting, generating reports, and structured or formatted delivery of that data directly in the app are product features that may depend on the version in use or on a paid plan; this does not limit your right to obtain your personal data, at no cost, through the channel above.

8. Security

We adopt technical and organizational measures to protect personal data, including encryption in transit (TLS/HTTPS), access control on a need-to-know basis, and storage on managed, monitored infrastructure. No method of transmission or storage is completely secure, but we work continuously to protect your information.

9. Advertising and Tracking

Drivvo may display advertising and, for that purpose, uses advertising identifiers:

• On Android, the Advertising ID is used to serve ads. You can reset or delete it in your device system settings.
• On iOS, the IDFA is collected only with your explicit authorization through the App Tracking Transparency (ATT) prompt. Declining does not prevent you from using the app — it only makes the ads non-personalized.
• For users in the European Economic Area (EEA), consent is collected through the UMP SDK and can be revoked at any time.

On iOS, tracking authorization is requested only once, the first time the app is opened, and can be changed at any time in the system settings, under Settings → Privacy & Security → Tracking. On Android, the Advertising ID can be reset in your device settings.

10. Children

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Changes and Contact

We may update this Privacy Policy from time to time. The latest version will always be available on this page, identified by its version number. For any questions about this policy or your personal data, contact us at support@drivvo.com.