Privacy Policy

Effective Date: March 26, 2026  |  Applies to: drivnby.me and chat.drivnby.me

DRIVN ("we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights — including under the TCPA and CAN-SPAM Act (United States), CASL and PIPEDA (Canada).

1. Information We Collect

Information You Provide

• Name — to personalize your experience and dealer handoff
• Mobile phone number — for identity verification and advisor contact
• Email address — optional; for follow-up communications
• Vehicle preferences — make, model, budget, timeline

Information Collected Automatically

• IP address — recorded at the time of consent for legal compliance
• Browser locale / language — to detect your preferred language
• Session identifiers — temporary ID stored in sessionStorage to maintain conversation context; never persisted beyond your session
• Cookies — see Section 8

Consent Records

When you provide consent to receive communications, we record: the exact consent language presented to you, the date and time, and your IP address. This record is stored in our CRM and retained as required by TCPA (USA) and CASL/PIPEDA (Canada).

2. How We Use Your Information

• To match you with vehicles and authorized dealerships
• To send SMS or email communications you have consented to
• To verify your phone number via one-time code
• To comply with legal obligations (consent recordkeeping, opt-out processing)
• To improve the AI concierge service

We do not use your data for automated decision-making that produces legal effects, nor do we sell your personal information to third parties.

3. Third-Party Services

• Twilio — phone verification (OTP) and SMS delivery. Twilio Privacy Policy
• GoHighLevel (GHL) — CRM platform where lead records (including consent data) are stored. GHL Privacy Policy
• Anthropic — AI model provider (Claude Haiku) that processes chat messages. Conversations are processed but not used to train Anthropic's models under our API agreement. Anthropic Privacy Policy

Each provider acts as a data processor under our instructions and maintains their own security and compliance programs.

4. Data Retention

• Lead and consent records: retained for a minimum of 4 years (TCPA) / 3 years (CASL) from the date of consent
• Chat conversation logs: stored in-memory only during your session; not persisted server-side beyond the session
• Session identifiers: stored in your browser's sessionStorage; cleared when you close the tab

5. USA TCPA & CAN-SPAM Compliance

We obtain prior express written consent before sending any marketing SMS or email under the Telephone Consumer Protection Act (TCPA). You may revoke consent at any time by replying STOP to any text message or using the unsubscribe link in any email. We honor opt-out requests within 10 business days. All commercial emails include our physical mailing address and a functional unsubscribe mechanism per CAN-SPAM.

6. Canada CASL & PIPEDA Compliance

For Canadian residents, we obtain express consent separately for SMS and email communications as required by Canada's Anti-Spam Legislation (CASL). The sender identity (DRIVN) is clearly disclosed at the point of consent. Every commercial electronic message includes an unsubscribe mechanism. Consent records — including the exact language shown, timestamp, and IP — are retained as required.

Under PIPEDA, you have the right to: access the personal information we hold about you; correct inaccurate information; withdraw consent; and file a complaint with the Office of the Privacy Commissioner of Canada.

International Data Transfers: If you are located in Canada and your data is processed by US-based service providers (Twilio, GoHighLevel, Anthropic), it may be subject to US law. We take contractual steps to ensure equivalent protection.

7. Your Rights

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your data (subject to legal retention requirements)
• Opt-out — withdraw consent for communications at any time

To exercise any right, contact us at the address below.

8. Cookies

Our chat widget uses sessionStorage (not cookies) to maintain conversation state. This data is never transmitted to advertising networks and is cleared when you close your browser tab. We do not use third-party tracking cookies on the chat service. If you visit drivnby.me, standard website cookies may apply per that site's cookie policy.

9. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via the website. Continued use after changes constitutes acceptance.

11. Contact Us