Privacy Policy
1. Scope
1.1 This Privacy Policy describes how Carprix, LLC ("Carprix", "we") collects, uses, shares and protects personal information when you visit carprixapp.com (the "Site"), apply for a membership, sign the Vehicle Subscription Agreement (the "Agreement"), pay, and possess and use a vehicle under the Agreement. It applies to Subscribers, Co-Responsible Parties, Authorized Drivers, Vehicle Owners and visitors to the Site. Capitalized terms have the meanings given in the Agreement.
1.2 Carprix is the business responsible for the personal information described here (the "controller"). Our service providers — including Stripe (payments), DocuSign (electronic signature and identity verification) and Amazon Web Services (hosting) — process information on our instructions, and Stripe and DocuSign also act as independent controllers for the parts of the process they operate, under their own privacy notices.
1.3 This Policy forms part of the Terms of Use and the Agreement. Carprix complies with the Florida Information Protection Act (section 501.171, Florida Statutes) and, where you are located outside the United States, with the additional commitments in Section 11.
2. Information we collect
2.1 Application and account. For the Subscriber and the Co-Responsible Party: name, e-mail address, telephone number, residential and billing address, date of birth, nationality, the Tier chosen, the Application ID, the version of the Terms and policies accepted, and the date, time, IP address and browser identifier of each acceptance (kept as evidence of consent and payment authorization).
2.2 Identity verification and driver eligibility. Government-issued identity document (type, number, issuing country, expiry, image), driving licence (number, category, issue and expiry dates, issuing authority, image), proof of address, and the results of identity verification performed by DocuSign Identity Verification (including document authenticity checks and, where used, a facial comparison with a live image). Carprix receives the verification result, the document data and the images made available by the provider; the provider retains the raw verification data under its own policy.
2.3 Compliance. Sanctions and watch-list screening results, information requested to satisfy anti-fraud and legal obligations, and correspondence about your application.
2.4 Payments. Stripe collects your card or bank account details directly on its pages; Carprix never receives or stores full card or account numbers. We receive the payment method type, brand, last four digits, expiry, country, billing address, tax identification number (if you provide one), payment status, invoices, receipts, dispute and refund records, and Stripe's risk assessment of each payment.
2.5 Signatures and agreements. The signed Agreement and related documents, DocuSign's certificate of completion (signer names, e-mail addresses, IP addresses, time stamps, authentication events) and envelope status.
2.6 Vehicle and telematics. Vehicle identifiers; Handover and Return Reports with photographs, odometer, fuel or charge, condition and damage records; and, where the vehicle is equipped, Telematics Data — the vehicle's precise location and movements, speed, direction, trip start and end times, distance and mileage, driving events (harsh acceleration, braking, cornering and impacts), battery, fuel or charge, diagnostic and fault data, immobilizer status, alerts generated when the vehicle leaves the Vehicle Jurisdiction or a set zone, and the vehicle and device identifiers. Telematics Data is collected continuously while the vehicle is in the Subscriber's possession and relates to whoever is driving or travelling in it. Section 8 describes this data, Guardian Monitoring and your choices in detail.
2.7 Operations. Fines, tolls, notices and claims relating to the vehicle; accident and insurance information; insurance certificates you provide; maintenance and repair records; communications with our concierge, billing and legal teams, including recordings or transcripts where notified.
2.8 Site usage. Server logs (IP address, date and time, pages requested, referrer, browser and device type) collected for security and to operate the Site. See Section 9 regarding cookies.
2.9 Vehicle Owners. For Vehicle Owners, their beneficial owners, directors and personnel: identity and identity-document data, business registration and beneficial-ownership information, tax residence and tax forms (IRS Form W-8BEN or W-8BEN-E), sanctions-screening results, payout bank account details and the onboarding and verification information collected by our payout provider (Stripe) for payments in USD to the Vehicle Owner's country, vehicle, permit and insurance documents, Handover and Return Reports, and communications.
3. How we use information
We use personal information to: assess and decide on applications, including identity verification, driver eligibility, sanctions screening and risk assessment; prepare, execute and administer the Agreement; process payments, invoices, renewals, refunds and collections, and respond to billing questions and payment disputes; schedule delivery, maintenance and return, and document the vehicle's condition; record the vehicle's location and use to protect it, verify compliance with the Agreement (territory and permitted use), calculate mileage, detect impacts and safety events, respond to accidents and theft, and recover it when the Agreement so provides; where the Subscriber has elected Guardian Monitoring, make location, speed and usage data and event alerts available to the Co-Responsible Party (Section 8); handle fines, tolls, claims and incidents, including identifying the driver to the competent authorities and insurers; send service communications (confirmations, reminders, receipts, notices); prevent, detect and investigate fraud, misuse and security incidents; comply with law, court orders and regulatory requests; establish, exercise and defend legal claims, including as evidence of consent and authorization; and improve the Site and our services. We send marketing communications only with your consent or where otherwise permitted by law, and you may opt out at any time.
5. Retention
- Agreement, Schedules, Handover and Return Reports, DocuSign certificates, Checkout acceptance records — Term of the Agreement plus five (5) years, or longer while a claim or dispute is pending
- Identity and licence document data and images — Until the application is declined or the Agreement ends, then deleted within ninety (90) days, except the verification result, document type, issuing country and expiry date, kept with the Agreement
- Payment, invoice, refund and dispute records — Seven (7) years for tax and accounting purposes
- Vehicle Owner onboarding, tax forms, sanctions-screening and payout records — Seven (7) years after the last payment to the Vehicle Owner, for tax, anti-money-laundering and sanctions compliance
- Telematics Data, including Guardian Monitoring reports and alerts — Twelve (12) months after the Return Date, or longer while needed for a fine, claim, investigation or dispute; the Co-Responsible Party's Guardian Monitoring access is closed on the Return Date
- Fines, claims and incident files — Until closed, plus five (5) years
- Applications not completed — Twelve (12) months after the last activity
- Site server logs — Twelve (12) months
- Marketing preferences — Until you opt out, then the fact of the opt-out
Information is deleted or anonymized at the end of the applicable period unless a longer period is required by law or by a legal hold.
6. Security
Carprix maintains reasonable administrative, technical and physical measures appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls and logging, least-privilege access for personnel, multi-factor authentication on administrative systems, and contractual security obligations on providers. Card and bank details are handled exclusively by Stripe, a PCI DSS Level 1 service provider. No system is completely secure; if a breach of security affecting your personal information occurs, Carprix will notify you and the competent authorities as required by section 501.171, Florida Statutes, and any other applicable law.
7. Your choices and rights
7.1 You may access and update your contact and billing details in the billing portal at carprixapp.com/billing/manage.html. For any other request — access to the information we hold about you, correction, deletion, restriction, portability, objection, withdrawal of consent, or a copy of your records — write to legal@carprixapp.com. We verify your identity before acting and respond within thirty (30) days (or within the shorter period required by applicable law). Some information cannot be deleted while the Agreement is in force or while we are required or permitted by law to keep it; we will explain any refusal.
7.2 You may opt out of marketing e-mails through the unsubscribe link in each message or by writing to legal@carprixapp.com. Service communications required to administer the Agreement cannot be opted out of while it is in force.
7.3 You may withdraw your consent to electronic records and signatures as described in the Electronic Signature and Communications Consent; withdrawal does not affect the validity of documents already signed.
7.4 Telematics collection is a condition of the Agreement and cannot be disabled while the vehicle is in your possession. The Subscriber is responsible for informing every Authorized Driver and passenger of this collection. Guardian Monitoring, by contrast, is optional: it exists only if the Subscriber requests it, and it is changed or withdrawn as described in Section 8.3.
7.5 You may lodge a complaint with the Florida Department of Legal Affairs or with the data-protection authority of your country of residence.
8. Vehicle location, telematics and Guardian Monitoring
8.1 What the equipment records. Vehicles may be equipped — before delivery or at any time during the membership — with GPS and telematics equipment and, where lawful in the Vehicle Jurisdiction, remote immobilization. While the vehicle is in the Subscriber's possession the equipment records continuously the Telematics Data listed in Section 2.6: precise location and movements, speed, direction, trip times, distance and mileage, driving events, diagnostic and fault data, immobilizer status, zone and border alerts, and vehicle and device identifiers. The data relates to whoever is driving or travelling in the vehicle. Both the Subscriber and the Co-Responsible Party consent to this collection when they sign the Agreement, and the Subscriber must inform every Authorized Driver and passenger before they first use the vehicle.
8.2 Why Carprix uses it. To protect the vehicle and locate and recover it in case of theft, non-return, default or misuse; to verify compliance with the Agreement, including that the vehicle stays within the Vehicle Jurisdiction and is not put to a prohibited use; to measure mileage and calculate excess-mileage charges; to identify the driver, time, place and circumstances of fines, tolls, incidents and accidents and handle them with authorities and insurers; to monitor the vehicle's condition and schedule maintenance; to detect impacts and safety events; to document amounts invoiced; to provide Guardian Monitoring where elected; and to establish, exercise and defend legal claims. Carprix does not use Telematics Data for marketing or advertising, does not build profiles for those purposes, does not take automated decisions producing legal effects on the basis of it, and does not sell it. Carprix does not undertake to review Telematics Data in real time or to intervene in the use of the vehicle.
8.3 Guardian Monitoring. Only at the Subscriber's request — made in the Vehicle Schedule at signature or later by notice from the Subscriber's e-mail on file — Carprix makes the vehicle's current and historical location, speed, trip and mileage data and event alerts (speed above set thresholds, leaving the Vehicle Jurisdiction or a set zone, night-time use, harsh driving, impacts, loss of signal) available to the Co-Responsible Party who signed the Agreement, through a portal or application, periodic reports or both. Diagnostic data and any function acting on the vehicle are never made available to the Co-Responsible Party. The Co-Responsible Party is contractually bound to keep the data confidential and to use it only to follow the whereabouts, use and safety of the vehicle and its drivers. Guardian Monitoring is informational; it is not supervision by Carprix. The Co-Responsible Party's access ends on the Return Date or when the Agreement ends. Because the Co-Responsible Party is liable with the Subscriber for the vehicle and relies on the election, Guardian Monitoring is changed or withdrawn by a notice from both the Subscriber and the Co-Responsible Party, as Section 19.7 of the Agreement provides; where the law of your country gives you a right to withdraw unilaterally that cannot be excluded, you may exercise it by writing to legal@carprixapp.com, and Carprix will end the Co-Responsible Party's access and inform the Co-Responsible Party (Section 11).
8.4 Who else receives Telematics Data. The Vehicle Owner, limited to what it needs to maintain, recover, insure the vehicle and handle fines, or that it receives because it operates the equipment, and bound by contract to use it for nothing else; the telematics provider, as a service provider; insurers and claims handlers; and police, traffic and toll authorities, courts and collection agents where necessary to handle an incident, fine or claim, to recover the vehicle, to enforce the Agreement or to comply with law. No other third party has access to Telematics Data, live or otherwise.
8.5 Retention. Telematics Data, including Guardian Monitoring reports and alerts, is kept for twelve (12) months after the Return Date — because authorities in many countries notify traffic fines for a vehicle months after the event — or longer while needed for a fine, claim, investigation or dispute, and is then deleted or anonymized.
8.6 Sensitivity and safeguards. Precise location data can reveal patterns of daily life. Carprix restricts access to Telematics Data to personnel who need it for the purposes above, logs access, and applies the security measures in Section 6. Some laws treat precise geolocation as sensitive information that requires your consent; Section 11 explains how Carprix meets those requirements.
10. Children
The Site and the membership are not directed to anyone under eighteen (18). The Subscriber and every Authorized Driver must be at least twenty-one (21) years old and the Co-Responsible Party at least twenty-five (25). Carprix does not knowingly collect information from minors; if you believe a minor has provided information, contact legal@carprixapp.com and we will delete it.
11. Users outside the United States
11.1 Carprix is established in Florida and processes personal information in the United States. By applying for a membership from another country you understand that your information is transferred to and processed in the United States, where privacy laws may differ from those of your country.
11.2 European Economic Area, United Kingdom and Switzerland. Where the EU or UK General Data Protection Regulation or Swiss law applies, our legal bases are: performance of the Agreement and steps at your request before entering into it (application, verification, payments, delivery, the Telematics Data necessary to administer and enforce the Agreement, and Guardian Monitoring as a service the Subscriber has requested); compliance with legal obligations (sanctions screening, tax records, responding to authorities); legitimate interests (fraud prevention, security, protecting and recovering the vehicle, handling fines and incidents, establishing and defending claims, improving the Site, and — for Guardian Monitoring — the interest of the Co-Responsible Party, who is liable with the Subscriber for the vehicle, in following its whereabouts and use), balanced against your rights; and consent, where requested (marketing, optional communications). Location data is not a special category of data under those laws, but continuous location tracking is intrusive; Carprix therefore limits the data, its recipients and its retention as described in Section 8. Transfers to the United States are made under the standard contractual clauses adopted by the European Commission or the UK International Data Transfer Addendum, or to providers certified under the EU-U.S. Data Privacy Framework. You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to your supervisory authority; an objection to Guardian Monitoring by the Subscriber is handled as described in Section 8.3.
11.3 Brazil. Where the Lei Geral de Proteção de Dados (Law 13.709/2018) applies, the legal bases are performance of the contract and preliminary procedures (including Telematics Data necessary to administer the Agreement and Guardian Monitoring requested by the Subscriber), compliance with legal and regulatory obligations, the regular exercise of rights in judicial and administrative proceedings, the legitimate interests of Carprix and of the Co-Responsible Party, and consent where requested. International transfers to the United States are made on the basis of contractual clauses and the other mechanisms recognized by the Autoridade Nacional de Proteção de Dados. You may exercise the rights in article 18 of that law, including confirmation, access, correction, anonymization, portability, deletion, information on sharing and revocation of consent, by writing to legal@carprixapp.com, which is the contact point of Carprix's person in charge (encarregado).
11.4 Other countries and U.S. states. Where the law of your country or state grants you additional rights — including where it treats precise geolocation as sensitive information requiring your express consent, or restricts the tracking of a vehicle used by you — Carprix relies on the consent you give in the Agreement, honours the rights that law grants you to the extent it requires, and processes Telematics Data only as described in Section 8. You may exercise those rights by writing to legal@carprixapp.com.
12. Changes to this Policy
Carprix may update this Policy by publishing a new version on the Site with a new version number and effective date. Material changes are notified by e-mail to members at least thirty (30) days before they take effect. Previous versions are available on request.
13. Contact
Carprix, LLC · 251 Valencia Avenue, #143167, Coral Gables, FL 33134, United States, Coral Gables, Florida, USA · legal@carprixapp.com (privacy requests and notices) · concierge@carprixapp.com (memberships).