Privacy Policy

1. Introduction and Scope

Veyra Inc. ("Veyra," "we," "us," or "our") operates the Veyra luxury vehicle marketplace platform, accessible at driveveyra.com and via related mobile and web applications (collectively, the "Platform"). This Privacy Policy describes how we collect, use, disclose, store, and protect personal information when you use the Platform, and explains your rights and choices with respect to that information.

This Policy applies to all users of the Platform, including owners and providers who list vehicles ("Owners"), individuals who rent vehicles ("Renters"), and visitors who browse without registering. By using the Platform, you agree to the practices described in this Policy. If you do not agree, you must stop using the Platform.

This Policy does not apply to information collected by third-party websites, applications, or services that are linked from the Platform. We are not responsible for the privacy practices of third parties.

2. Information We Collect

2.1 Information You Provide Directly

We collect the following categories of information that you provide when using the Platform:

• Account information: Your full name, email address, and password when you create an account.
• Profile information: Phone number, profile photo, and any other information you add to your profile.
• Identity verification data: Government-issued photo ID (such as a driver's license or passport), date of birth, and liveness or biometric data collected as part of identity verification conducted by Persona Identities, Inc. ("Persona"). We receive a verification status result from Persona; raw document images and biometric data are handled by Persona pursuant to their terms and privacy policy.
• Vehicle listing information: Vehicle make, model, year, VIN, registration documents, insurance certificates, inspection certificates, photos, location, availability, and pricing.
• Payment information: Billing address and payment method data. Payment card numbers and bank account details are processed and stored by Stripe, Inc. Veyra does not receive or store full payment card numbers, CVV codes, or complete bank account numbers.
• Payout information (Owners): Bank account or debit card information provided to Stripe Connect for the receipt of payouts. This is handled by Stripe and not stored by Veyra.
• Communications: Messages sent through the in-app chat system between Owners and Renters. These messages are stored on our servers and visible to both parties.
• Trip-related content: Condition photos uploaded before and after a rental, return reports, deposit claim submissions and supporting evidence, and renter dispute responses.
• Reviews and ratings: Reviews and star ratings you submit about other users or vehicles.
• Support communications: Information you provide when you contact Veyra support.
• Waitlist and marketing: Email address and name if you join a waitlist or subscribe to marketing communications.

2.2 Information Collected Automatically

When you use the Platform, we and our service providers may automatically collect:

• Log data: IP address, date and time of access, pages and features visited, referring URL, browser type and version, operating system.
• Device information: Device type, model, operating system version, screen resolution, unique device identifiers, mobile network information.
• Usage data: Features used, search queries entered within the Platform, listing views, click patterns, and session duration.
• Location data: General location derived from IP address. We do not require or persistently collect precise GPS location, though vehicle locations and the listing's general location are used to power map features (via Mapbox, see Section 6).
• Cookies and similar technologies: See Section 9 for full details.

2.3 Information From Third Parties

• Identity verification results from Persona: Verification outcome (pass/fail/pending), verification ID, and risk signals. We do not receive raw biometric or document data from Persona.
• Payment and transaction data from Stripe: Transaction IDs, payment status, last four digits of card, card brand, payout status, and fraud signals.
• Authentication providers: If you use a third-party single sign-on service in the future, we may receive basic profile information (name, email) from that provider.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Operating the Platform

• Create and manage your account;
• Process bookings, payments, and refunds;
• Place, manage, and release security deposit authorization holds;
• Facilitate communications between Owners and Renters;
• Display listings and enable search and filtering;
• Show vehicle locations and maps via Mapbox;
• Process deposit claims and disputes;
• Distribute payouts to Owners via Stripe Connect.

3.2 Verification and Safety

• Verify your identity through Persona;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Review and approve vehicle listings and associated documents;
• Enforce our Terms of Service and community standards.

3.3 Communications

• Send transactional notifications (booking confirmations, payment receipts, deposit updates, cancellation notices, claim notifications);
• Respond to your support requests;
• Send operational updates about the Platform (such as changes to Terms or Policy);
• With your consent, send marketing communications about Veyra offerings.

3.4 Improvement and Analytics

• Analyze how the Platform is used to improve features and user experience;
• Track listing view counts and engagement for Owner analytics;
• Debug errors and improve performance and stability;
• Conduct research and develop new features or services.

3.5 Legal and Compliance

• Comply with applicable laws, regulations, court orders, and legal process;
• Respond to lawful requests from governmental authorities;
• Establish, exercise, or defend legal claims;
• Issue tax forms as required (e.g., 1099-K for Owners).

4. Legal Bases for Processing

To the extent that applicable law (including the laws of the European Economic Area, the United Kingdom, or other jurisdictions with similar requirements) requires a legal basis for processing personal data, we rely on the following:

• Performance of a contract: Processing necessary to create your account, process bookings, facilitate rental transactions, manage deposits, and distribute payouts. Without this processing, we cannot provide the Platform to you.
• Legitimate interests: Processing necessary for our legitimate interests in operating a safe, fraud-free marketplace, including fraud prevention, security monitoring, usage analytics, improvement of the Platform, and enforcement of our Terms, where those interests are not overridden by your rights.
• Legal obligation: Processing necessary to comply with applicable law, including tax reporting, anti-money laundering requirements, and responses to lawful government requests.
• Consent: Marketing communications and any processing for which we have asked for your specific consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Share Your Information

We do not sell your personal information to third parties for their own marketing purposes. We share information only as described below.

5.1 Between Users on the Platform

When a Renter books a vehicle, both the Renter and the Owner can see: the other party's name, verified status, and profile photo; and communications sent in the booking chat thread. Listing information, including the Owner's general location, is visible to any logged-in user. Detailed personal contact information (such as phone number or address) is not displayed to other users unless you choose to share it in a message.

5.2 Service Providers

We share information with the third-party service providers listed in Section 6 to enable the Platform to function. These providers are contractually required to: (a) use data only for services performed on our behalf; (b) implement appropriate security measures; and (c) not sell or further disclose your data except as directed by Veyra or required by law.

5.3 Compliance and Legal Process

We may disclose your information if we believe in good faith that doing so is necessary to: (a) comply with a subpoena, court order, legal process, or government request; (b) enforce our Terms of Service or investigate potential violations; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Veyra, our users, or the public.

5.4 Business Transfers

If Veyra undergoes a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, your information may be transferred to the successor entity. We will notify you (via email or prominent notice on the Platform) before your personal information becomes subject to a materially different privacy policy.

5.5 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you (such as aggregate statistics about Platform usage) with third parties for research, analytics, or business purposes.

6. Third-Party Service Providers

The following third-party providers process personal data in connection with the Platform. We encourage you to review their privacy policies to understand their data practices:

Veyra may add, remove, or change service providers from time to time. We will update this Policy when we make material changes to our service provider relationships. Each provider is bound by contractual data processing terms consistent with applicable law.

7. Data Retention

We retain your personal information for as long as necessary to: (a) provide the Platform and fulfill the purposes described in this Policy; (b) comply with our legal obligations; (c) resolve disputes; and (d) enforce our agreements. The following general retention practices apply:

• Account and profile data: Retained while your account is active and for a reasonable period after deletion to comply with legal obligations and resolve outstanding disputes.
• Booking and financial records: Retained for a minimum of seven (7) years after the relevant transaction for tax, regulatory, and legal compliance purposes.
• Identity verification records: Persona retains identity data per their own retention policy. Veyra retains the verification outcome (pass/fail) and Persona inquiry ID for the life of your account plus a compliance period.
• Trip photos and claim records: Retained for the duration of any potential claim window and, if a claim is filed, until final resolution plus a compliance period.
• Communications: In-app chat messages are retained while the relevant booking or chat thread is active and for a period thereafter to support dispute resolution.
• Log and analytics data: Typically retained for 90 days to 2 years depending on the data type and business need.

When personal data is no longer required for the purposes for which it was collected and no legal obligation requires retention, we will delete or anonymize it in accordance with our data lifecycle procedures.

8. Data Security

We implement technical and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security);
• Encryption of sensitive data at rest;
• Row-level security on our database, restricting access to data based on user identity;
• Role-based access controls limiting internal access to personal data;
• Use of server-side-only API keys for sensitive third-party services (Stripe, Persona, Supabase service role). These keys are never exposed in client-side code.
• Regular review of security practices as the Platform matures.

Identity verification documents and biometric data are processed by Persona and are not stored on Veyra's servers. Payment card data is processed and stored by Stripe.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. In the event of a data breach that requires notification under applicable law, we will notify affected users as required.

You are responsible for maintaining the security of your account credentials. Do not share your password. If you suspect unauthorized access to your account, contact us immediately.

9. Cookies and Tracking Technologies

9.1 What We Use

The Platform uses cookies (small text files stored in your browser) and similar client-side storage mechanisms (such as localStorage) to operate core features, maintain your session, and analyze usage.

9.2 Types of Cookies

• Strictly necessary cookies: Required for the Platform to function. These include authentication session tokens (managed by Supabase) that keep you logged in. You cannot opt out of these without losing core functionality.
• Functional cookies / localStorage: Used to remember preferences such as remembered email, saved vehicles, and theme settings. These are stored locally in your browser and not transmitted to our servers.
• Analytics: We may use analytics tools to understand how users interact with the Platform (such as page views and feature usage). Where analytics tools use cookies or similar tracking, this is noted in our cookie settings.

9.3 Your Choices

You may disable cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using most Platform features. Disabling analytics cookies will not prevent you from using the Platform but will limit our ability to improve the user experience.

Most browsers allow you to view and delete cookies stored by websites. Refer to your browser's help documentation for instructions on managing cookies.

10. Your Privacy Rights

Depending on where you are located, you may have the following rights with respect to your personal information:

• Right to access: Request a copy of the personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete personal information.
• Right to deletion: Request deletion of your personal information, subject to our legal retention obligations and legitimate business needs.
• Right to restrict processing: In certain circumstances, request that we limit the ways in which we use your data.
• Right to data portability: Request your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to object: Object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: Where processing is based on consent, withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.
• Right not to receive discriminatory treatment: We will not discriminate against you for exercising any privacy rights.

To exercise any of these rights, contact us as described in Section 16. We will respond within thirty (30) days of receiving a verifiable request, or within any shorter time period required by applicable law. We may need to verify your identity before processing your request.

Some rights are subject to exceptions. For example, we may need to retain certain data to comply with our legal obligations, complete a transaction, or support a pending claim even if you request deletion. We will inform you if we are unable to fulfill your request and explain why.

11. California Privacy Rights (CCPA / CPRA)

This Section applies to California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA/CPRA"), California residents have specific rights regarding their personal information.

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, IP address, device identifiers);
• Personal information under Cal. Civ. Code § 1798.80 (name, address, phone number);
• Protected classification characteristics (age, where required for eligibility);
• Commercial information (rental transactions, payment history);
• Internet or other electronic network activity information (usage data, log data);
• Geolocation data (general location from IP address);
• Professional or employment-related information (for Owner onboarding where applicable);
• Inferences drawn from the above to create a profile about a user's preferences.

11.2 Purposes of Collection

We collect personal information for the business and commercial purposes described in Section 3.

11.3 Sale or Sharing of Personal Information

We do not sell your personal information as defined under CCPA/CPRA. We do not share your personal information with third parties for cross-context behavioral advertising.

11.4 Sensitive Personal Information

We collect certain "sensitive personal information" as defined by the CPRA, including government ID data (processed by Persona) and payment card data (processed by Stripe). We use this data only to provide the Platform's core services (identity verification and payment processing) and do not use it to infer characteristics about you beyond what is necessary for those functions.

11.5 California Rights

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell;
• Request deletion of personal information we hold;
• Request correction of inaccurate personal information;
• Opt out of the sale or sharing of personal information (we do not currently sell or share);
• Limit the use of sensitive personal information;
• Non-discrimination for exercising CCPA rights.

To exercise your California rights, contact us as described in Section 16. Requests may be made by the consumer or by an authorized agent with proof of authorization. We will verify your identity before processing requests.

12. Other U.S. State Privacy Rights

Residents of certain other U.S. states, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states that have enacted comprehensive privacy laws, may have rights similar to those described in Sections 10 and 11 above, including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

The New York SHIELD Act and other New York laws govern our data security obligations with respect to New York residents. We comply with applicable notification requirements in the event of a data security breach.

To exercise rights under applicable state law, contact us as described in Section 16. We will respond in accordance with the applicable state's required response time. Verification of identity will be required.

13. Children's Privacy

The Platform is not directed to or intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a person under 18 has created an account or submitted personal information to the Platform, please contact us immediately at the address in Section 16 so that we can take appropriate action, including deletion of the information and account.

Consistent with the Children's Online Privacy Protection Act (COPPA) and analogous state laws, we will delete information collected from children under 13 promptly upon discovery.

14. International Data Transfers

Veyra is based in the United States. If you are accessing the Platform from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country.

Our service providers, including Supabase, Stripe, Persona, and Vercel, may process data in the United States and other countries. We take steps to ensure that such transfers comply with applicable law, including using providers who implement appropriate safeguards such as Standard Contractual Clauses where required by the European Union's GDPR or equivalent mechanisms.

At present, Veyra's primary market is the United States, and we are not specifically targeting EU or EEA residents. If that changes, we will update this Policy and implement additional safeguards as required.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. We will notify you of material changes by:

• Posting the updated Policy on the Platform with an updated "Last updated" date; and/or
• Sending an email notification to the address on file for your account.

Your continued use of the Platform following the effective date of the updated Policy constitutes your acceptance of the changes. If you do not agree, you must discontinue using the Platform and may request account deletion as described in our Terms of Service.

16. Contact Us

For privacy inquiries, data access or deletion requests, to report a security concern, or to exercise any rights described in this Policy, contact us at:

We will acknowledge your request promptly and respond within the time period required by applicable law (generally 30 days, or 45 days with a one-time extension for complex requests). We may need to verify your identity before processing requests relating to specific personal information.

If you have a complaint about our data practices, you also have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.