Privacy Policy

1. Information We Collect

We collect information in several ways when you use our Service:

Information You Provide Directly:

• Account Information: Name, email address, phone number, profile photo, and password when you create an account.
• Identity Verification: Driver's license information, date of birth, and government-issued ID for verification purposes.
• Payment Information: Credit/debit card details, billing address, and banking information for transactions (processed securely by Stripe).
• Vehicle Information: Make, model, year, VIN, registration details, photos, and specifications for vehicles listed on the Platform.
• Event Information: Event details, track information, schedules, and participant lists for event organizers.
• Communications: Messages, reviews, ratings, and other content you share through the Platform.
• Community Content: Threads and replies you post in the Paddock and on discussion boards, the photos and videos attached to them, honks, the rooms and threads you follow, mentions, and reports you submit.
• Marketplace Content: Listings you create (title, description, price, condition, photos, the car the item fits, the venue, area, or event you name), items you save, the sellers you contact and the messages you exchange, and the deal ratings and vouches you give. When you list a vehicle, the listing draws on that vehicle's garage record (its photos, specifications, safety equipment, modifications, and history on Kerbz) and on the mileage, title status, and any documents — such as a vehicle history report, dyno sheet, or build sheet — you add. Documents you attach are published as part of the listing; review them for information you do not want public, such as an address or a name. If you enter a VIN, it is published on the listing. The location you give a listing is a track you choose or a city or area chosen from Google Places suggestions, not your address.
• Listing Fees: When you pay the fee to list a vehicle, Stripe processes the payment and we keep the payment reference, the amount, and when it was paid against the listing. Kerbz does not see or store your card number.
• Garage: The cars you add to your garage (make, model, year, generation, photos). Kerbz uses your garage to match you with discussions and listings about your cars, and to show an owner mark beside your name on threads about a car you own.
• Signed Agreements: Electronic signatures, waivers, and consent forms.
• Proof of Acceptance: When you accept the release and waiver of liability before renting or driving a car, or confirm the safety statement as a car's host, we record which version you accepted, when, your IP address, and your device and browser details. We keep this record as proof of your acceptance, including for any claim or dispute, and it cannot be changed afterwards.

Information Collected Automatically:

• Device Information: Device type, operating system, unique device identifiers, browser type, and mobile network information.
• Log Data: IP address, access times, pages viewed, app crashes, and other system activity.
• Location Data: GPS location, with your permission, to show nearby events and tracks.
• Usage Data: How you interact with our Service, features used, and preferences.

Information from Third Parties:

• Social Login: If you sign in with Google, Facebook, or Apple, we receive basic profile information.
• Background Checks: Where permitted, verification results from identity verification services.
• Payment Processors: Transaction confirmations and fraud prevention data from Stripe.

2. How We Use Your Information

Beyond the purposes below, we use the cars in your garage to show you discussions and listings about them and to tell you when someone posts about one; and we use your event history, deal ratings, vouches, and reports to decide whether an account may sell, message, or post in the Marketplace and Paddock, so that other users can rely on the people they deal with.

We use the information we collect for the following purposes:

• Provide and Improve Services: To operate the Platform, process bookings, facilitate vehicle sharing, and manage events.
• Identity Verification: To verify your identity, driver's license validity, and eligibility to use the Service.
• Payment Processing: To process payments, refunds, and payouts to hosts and organizers.
• Communications: To send booking confirmations, event updates, customer support responses, and important notices.
• Safety and Security: To detect and prevent fraud, abuse, and security incidents; to enforce our Terms.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Analytics: To understand how users interact with our Service and to improve user experience.
• Marketing: With your consent, to send promotional communications about our services.

3. Information Sharing and Disclosure

We may share your information in the following circumstances:

With Other Users:

• Drivers and Hosts: When you request a vehicle, the host sees your name and profile photo, so they can decide whether to accept your request, and you can message each other on Kerbz. Once the booking is confirmed, the host can also see your phone number and both sides of your driver's license, to arrange and complete the handover. Hosts share vehicle details and pickup information with drivers.
• Cars Rented for an Event: If you rent a vehicle for an event, the vehicle's host can see which event the booking is for, and the event's organizer can see the vehicle you rented for it and whether that booking is waiting for the host, confirmed, or cancelled.
• Event Participants: Event organizers may see participant information for event management and safety purposes.
• Public Profile: Your profile name, photo, and reviews may be visible to other users.
• Public Content: Paddock threads and replies, and Marketplace listings and the questions under them, are public. A vehicle listing shows the vehicle's make, model, year, mileage, title status, specifications, safety equipment, modifications, photos, history on Kerbz, the VIN if you entered one, and the track or city and area you named. They can be read by anyone, including people who are not signed in, and may be indexed by search engines. They show your name, profile photo, the car the post is about, and, on a thread about a car you own, an owner mark derived from your garage. Discussions that an event host has kept to its registrants are shown only to that event's host, crew, and registrants.
• Seller Profile: On a Marketplace listing, other users can see how many events you have attended, how many cars are in your garage, how long you have been on Kerbz, how many deals you have completed, and who vouches for you. Deal ratings are private: the other party is not told what you said, and Kerbz uses them only to determine standing on the Platform.
• Buyers and Sellers: When you message a seller about a listing, the seller sees your profile and, if the sale completes, may name you as the buyer so that both of you can rate the deal. If a seller hands a sold vehicle's Kerbz record to your garage, the record and its history on Kerbz move to you, and the seller's name is kept in that vehicle's ownership history. Kerbz does not share payment details between users, because it does not collect them for Marketplace sales.
• Reports: If you report content or a user, we do not tell them who reported them.

With Service Providers:

• Payment Processing: Stripe processes all payment transactions.
• Cloud Services: We use cloud providers to host and store data.
• Analytics: We use analytics services to understand usage patterns.
• Communications: Email and push notification service providers.
• Identity Verification: Third-party services that verify driver's licenses and identities.

For Legal and Safety Reasons:

• To comply with applicable laws, regulations, or legal processes.
• To respond to lawful requests from law enforcement or government authorities.
• To protect the rights, property, or safety of Kerbz, our users, or the public.
• To investigate potential violations of our Terms or fraudulent activity.
• In connection with insurance claims or disputes.

Business Transfers:

If Kerbz is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We Do Not Sell Your Personal Information:

Kerbz does not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Third-Party Services

Our Service uses third-party services that may collect information about you. These services have their own privacy policies:

• Stripe - Payment processing
• Firebase (Google) - Authentication, push notifications, analytics
• Google - Maps, analytics, sign-in
• Facebook/Meta - Social login
• Apple - Sign in with Apple
• Expo - Mobile app services

5. Data Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account.
• Comply with legal obligations (e.g., tax records, dispute resolution).
• Resolve disputes and enforce our agreements.
• Meet legitimate business purposes.

Retention Periods:

• Account Data: Retained while your account is active and for 3 years after deletion request.
• Transaction Records: Retained for 7 years for tax and legal compliance.
• Signed Waivers/Agreements: Retained for 7 years or as required by law.
• Communications: Retained for 2 years after the conversation ends.
• Community and Marketplace Content: Retained until you delete it, or your account is deleted. Content you remove, and content removed by moderation, is kept out of view and retained for up to 90 days so that reports can be investigated and appeals handled, then deleted. A vehicle listing Kerbz removes is kept on your account, visible only to you, until the review is closed; records of a paid listing fee are kept for as long as our tax and accounting obligations require. Replies by other users that quote your content remain theirs.
• Deal Ratings, Vouches, and Reports: Retained for 3 years, as they inform standing on the Platform and the investigation of abuse.
• Log Data: Retained for 1 year.

When data is no longer needed, we securely delete or anonymize it.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request your data in a portable format.
• Opt-Out of Marketing: Unsubscribe from promotional emails at any time.
• Notification Preferences: Manage push notification settings in the app or your device settings. Room follows, thread follows, and pushes about your cars can each be turned off individually in the Paddock.
• Your Content: Delete any thread, reply, or listing you posted at any time from the content itself. Deleting your account deletes or anonymizes your content as described in Data Retention; content quoted by others may remain.

To exercise these rights, contact us at privacy@kerbz.app. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

7. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: Kerbz does not sell personal information. However, you may still exercise this right.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email privacy@kerbz.app with the subject line "CCPA Request." You may also designate an authorized agent to make a request on your behalf.

Categories of Personal Information Collected (last 12 months):

• Identifiers (name, email, phone, IP address)
• Personal information under California Civil Code Section 1798.80 (driver's license, payment information)
• Commercial information (booking history, transactions)
• Internet or network activity (browsing history, app usage)
• Geolocation data
• Professional information (for hosts and organizers)
• Inferences drawn from the above categories

8. Location Data

We collect location data to provide location-based features:

• Show nearby events, tracks, and available vehicles.
• Provide navigation and directions to event locations.
• Display relevant content based on your region.

Your Choices: You can disable location services in your device settings. However, some features may not work properly without location access.

9. Payment Information

All payment processing is handled by Stripe, a PCI-DSS compliant payment processor. We do not store your full credit card number or CVV on our servers.

We may store:

• Last four digits of your card for identification purposes.
• Card type (Visa, Mastercard, etc.) and expiration date.
• Billing address for fraud prevention.
• Transaction history for your records and dispute resolution.
• The amount and status of any temporary hold placed on your card for a booking request.

For hosts and organizers receiving payouts, we collect bank account information which is securely stored and processed by Stripe.

10. Driver's License Information

To ensure safety and verify driving eligibility, we collect driver's license information:

• License number, state of issuance, and expiration date.
• Photo of your driver's license for identity verification.
• Date of birth to confirm age eligibility.

How We Protect This Data:

• Driver's license images are encrypted at rest and in transit.
• Access is restricted to authorized personnel only.
• We use third-party verification services that are SOC 2 compliant.
• License information is retained only as long as necessary for verification and legal compliance.

11. Cookies and Tracking Technologies

Cookies are small data files stored on your device. We use cookies and similar technologies for:

• Essential Cookies: Required for the Platform to function (authentication, security).
• Analytics Cookies: Help us understand how users interact with our Service.
• Preference Cookies: Remember your settings and preferences.

Your Choices: You can manage cookie preferences in your browser settings. Disabling certain cookies may affect Platform functionality.

12. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. There is currently no uniform standard for how companies should respond to DNT signals.

At this time, our Platform does not respond to DNT signals. However, you can manage your privacy preferences through our Platform settings and your browser's cookie controls.

13. Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (TLS/SSL) and at rest.
• Secure authentication with password hashing.
• Regular security audits and vulnerability assessments.
• Access controls limiting who can view sensitive data.
• PCI-DSS compliant payment processing through Stripe.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

14. Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a child under 18, please contact us immediately at privacy@kerbz.app.

15. Links to Other Sites

Our Service may contain links to third-party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policy of every site you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last revised" date. For significant changes, we may also send you a notification via email or through the Platform.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@kerbz.app
General Inquiries: hello@kerbz.app

We will respond to your inquiry within 30 days.