Privacy Policy

DriveXP ("DriveXP", "we", "us") is a peer-to-peer car rental marketplace operating in the Philippines. We connect independent car owners and registered car rental operators ("hosts") with people who want to rent a car ("customers").

This Privacy Policy explains what personal information we collect from hosts and customers, how we use that information, and the choices you have. It is governed by the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.

We collect the following information directly from you when you sign up and use DriveXP:

Account information

• Full name
• Email address
• Password (hashed by our authentication provider — never stored in plaintext)
• If you sign in with Google: your Google profile name and profile picture, plus the email associated with your Google account

Profile + contact information

• Contact number
• Mailing or pickup address
• Profile bio (hosts only; visible on your public host profile once verified)
• For fleet operators: company name, business registration number, and service area

Identity verification documents

• A scan or photo of a government-issued ID (both hosts and customers)
• A scan or photo of your driver's license (customers and individual hosts)
• A scan or photo of your business registration certificate, such as a DTI or SEC certificate (fleet operators only)

Verification documents are stored in a private encrypted bucket with our infrastructure provider (Supabase). They are accessible only via short-lived signed links generated server-side, and only by you, our admin verification team, and (in the case of a confirmed booking) the host you are renting from so they can confirm your identity at handover.

Booking and transaction information

• Listings you view, favorite, and inquire about
• Bookings you create, including pickup and return dates, prices, and payment status (we record whether cash was paid at pickup; we do not store credit-card or banking credentials)
• Messages you exchange with the other party in a booking (one chat thread per booking)
• Reviews you leave after a completed trip

Technical information

• Authentication session cookies issued by our authentication provider (Supabase) to keep you signed in
• Server-side logs of requests you make to DriveXP for security and debugging (IP address, user agent, request path, timestamp)

DriveXP does not currently use third-party advertising trackers, analytics cookies, or social-media share pixels.

We use the information we collect to:

• Create and manage your account
• Verify your identity before allowing you to book or list a car on the marketplace
• Match hosts with customers, facilitate bookings, and let hosts and customers communicate about an active booking
• Display your public host profile (hosts only, after admin verification) so customers can browse cars and decide who to rent from
• Calculate platform commissions and payouts
• Respond to questions, complaints, and disputes you raise with our admin team
• Detect and prevent fraud, abuse, and misuse of the platform
• Comply with legal obligations under Philippine law

We share information only as needed to operate the marketplace:

The other party in a booking

When a booking is confirmed, the host can see the customer's name, contact number, and verification documents (so they can confirm identity at pickup); the customer can see the host's name, public profile, and contact number. We do not share your identity documents with anyone outside this need-to-know scope.

Our admin team

DriveXP staff with administrator privileges can access your account and verification documents to approve verifications, review disputes, manage suspended accounts, and provide support.

Service providers

• Supabase — hosts our authentication, database, and file-storage infrastructure
• Vercel — hosts the DriveXP application servers and serves the website
• Google — for users who choose to sign in via Google, Google receives the authentication request and returns your email and basic profile information to us

These providers process your information solely on our behalf and are bound by their own data-protection commitments. They do not have rights to use your data for their own purposes.

Legal disclosures

We may disclose your information to law enforcement or regulatory authorities if required by Philippine law, a valid subpoena, or a comparable legal process. We will notify you when permitted to do so.

We do not sell your personal information.

We keep your account information and verification documents for as long as your account is active. If you delete your account, we will delete your verification documents within 30 days, except where we are required to retain certain records under Philippine tax or business law (typically a 10-year retention period for transaction records).

Booking and review history may be retained longer in aggregate or anonymized form for marketplace integrity (so that a customer's past trip with a host is preserved in the host's aggregate rating, for example).

Under the Philippines Data Privacy Act, you have the right to:

• Be informed about how we process your personal data
• Access the personal data we hold about you
• Object to or restrict the processing of your data
• Correct inaccurate or outdated information
• Request that we delete data we no longer need
• Receive a copy of your data in a portable format
• Withdraw consent for processing that depends on your consent
• File a complaint with the National Privacy Commission

To exercise any of these rights, email support@drivexp.com. We will respond within a reasonable time (and within any applicable statutory deadlines).

DriveXP uses a small number of strictly-necessary cookies and browser-storage entries to keep you signed in and to remember your in-session preferences. These cookies are set by our authentication provider (Supabase) and are essential for the site to function. We do not use marketing or third-party tracking cookies.

We protect your data using industry-standard practices: encrypted connections (HTTPS) between your browser and our servers, encryption at rest for stored documents, server-side authorization checks on every request, role-based access controls in our admin tooling, and least-privilege access for our staff. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

DriveXP is not intended for users under the age of 18. To rent or list a vehicle, you must be at least 18 years old and hold a valid Philippine driver's license (customers, individual hosts). We do not knowingly collect personal information from minors. If you believe a minor has signed up, contact us and we will delete the account.

We may update this Privacy Policy from time to time. If we make a material change, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of DriveXP after a change means you accept the updated policy.

This Privacy Policy forms part of our Terms of Service. Capitalized terms not defined here have the meanings given to them in the Terms of Service.

For questions about this Privacy Policy or about how we handle your personal data, email support@drivexp.com.