Drivway Privacy Policy

Drivway is a discovery and listing service launching only in Minnesota. Mechanics pay a subscription to publish a profile; Customers browse those profiles and send inquiries. We are not a party to any repair. We do not collect or process Customer payment-card information for repair work. All payment for repairs happens directly between the Customer and the Mechanic, away from the Platform.

We do not collect Social Security numbers, driver’s-license numbers, financial-account numbers, precise geolocation, or other sensitive data as defined by Minnesota law. We do not knowingly process sensitive data without consent.

We use personal data to create and manage accounts; connect Customers with Mechanics and route inquiries; verify Mechanic credentials and display badges; publish and moderate reviews; show Mechanics their profile-view and inquiry activity; process Mechanic subscription payments; provide support; prevent fraud and abuse; comply with law; and improve the Platform.

With Mechanics you contact: when a Customer submits an inquiry, we share that request and the Customer’s contact details with the selected Mechanic so they can respond. The Mechanic then handles that data as an independent business and is responsible for its own compliance.

With service providers: hosting, database, analytics, email/messaging, credential-verification, and subscription-billing vendors, under contracts limiting their use of the data to providing services to us.

For legal reasons: to comply with law or legal process, enforce our Terms, or protect rights, property, and safety.

Business transfer: if Drivway is involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction.

Drivway does not sell personal data, does not use personal data for targeted advertising, and does not profile individuals in furtherance of decisions that produce legal or similarly significant effects.

To the extent the Minnesota Consumer Data Privacy Act (Minn. Stat. §§ 325M.10–325M.21) applies to Drivway and your personal data, Minnesota residents may have the right to:

• Confirm whether we process your personal data, and access it;
• Correct inaccuracies in your personal data;
• Delete personal data we hold about you;
• Obtain a portable copy of your data in a readily usable format;
• Obtain a list of the specific third parties to which we have disclosed personal data;
• Opt out, if applicable, of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• Appeal a denial of any of the above.

How to submit a request

Submit a request by emailing [email protected]. We will verify your identity before acting. Requests are free of charge up to twice per year. For a manifestly unfounded or excessive request, we may charge a reasonable administrative fee or decline to act, and we bear the burden of showing that the request was unfounded or excessive.

Our response times

• We respond to a verified request as soon as feasible and no later than 45 days after receipt.
• We may extend that period once by an additional 45 days when reasonably necessary; if we do, we will tell you within the first 45 days and explain why.
• If we decline to act, we will tell you why within 45 days and explain how to appeal.

Appeals

If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal.” The appeal process is designed to be easy to use. We will inform you of the outcome of your appeal, with a written explanation of our reasons, within 45 days after receiving it. We may extend that period by 60 additional days where reasonably necessary and will notify you of the extension within the first 45 days. If we deny your appeal, we will provide information about how to file a complaint with the Minnesota Attorney General. We retain records of appeals and our responses for at least 24 months and will provide them to the Attorney General upon written request as part of an investigation.

We use cookies and similar technologies for sign-in, security, basic analytics, and remembering preferences. You can control cookies through your browser settings. We do not use cookies or similar technologies for targeted advertising. If our practices materially change, we will update this Policy and provide any notices, choices, or opt-out mechanisms required by applicable law. Our Cookie Policy lists what we actually store in your browser.

We keep personal data only as long as needed for the purposes described in this Policy, then delete or de-identify it. Our standard periods:

We may keep data longer where required by law, necessary to resolve a dispute, or necessary to establish, exercise, or defend legal claims.

We use reasonable administrative, technical, and physical safeguards to protect personal data, including encryption in transit, access controls, and a maintained data inventory. We keep an incident-response plan and will notify affected individuals and regulators of a breach as required by law. No system is perfectly secure; because we do not hold Customer repair-payment card data, that category of risk does not apply to Drivway.

Drivway is intended for adults and is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If we learn we have, we will delete it. If you believe a child has provided us data, contact [email protected].

We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, provide notice by email to registered users or through a notice on the Platform before the changes take effect, as appropriate.

For privacy questions or requests, email [email protected] or write to: Drivway, 622 Sutcliff Circle, Mendota Heights, MN 55118.