Privacy Policy

1. Who we are

DrivAPI is a platform that lets a dealer launch a ready-made car site under their own name and logo. We are responsible for processing the data described in this policy.

For privacy questions or to exercise your rights: hello@drivapi.com.

2. What we collect

Account details when you sign up: site name, your short site address, email and password. We never store the password as readable text, only in an irreversible encrypted form.

Site setup details you enter yourself: name, logo and colour, WhatsApp and phone numbers, address, business type, your markup on prices, and how you heard about DrivAPI.

Payment details when you subscribe to a paid plan: these are handled by our payment provider, and card numbers are not stored on our systems.

Technical data generated automatically: IP address, browser and device type, pages visited and access times (server logs).

Essential files in your browser: we use session cookies to keep you signed in and protect your account, which the service needs to work. We also keep a single local-storage key, drivapi.region, to remember the pricing region you chose; it holds no personal data.

We do not collect or request sensitive data such as health, religious or biometric information.

3. Why we use it

To create your account, and set up, run and keep your site and its inventory up to date.

To reply to you and communicate about your request or subscription, including email confirmation and password-reset messages.

To operate and protect the service against misuse, and to improve performance through aggregated statistics.

To meet legal and accounting obligations.

4. Legal basis

Your explicit consent when you create an account and submit your details, which you may withdraw at any time.

Performance of the contract when you subscribe to a paid plan.

Legitimate interest in securing the service and preventing fraud, where it does not override your rights.

5. Sharing

We do not sell or rent your personal data.

We share it only with service providers acting on our behalf and only as far as the service requires: hosting and infrastructure, email delivery, and payment processing.

We may disclose data where a competent authority lawfully requires it.

6. Transfers outside the Kingdom

Some data may be processed on servers outside Saudi Arabia depending on where our hosting and service providers operate. Where that happens we apply the transfer safeguards required by the PDPL and its regulations.

7. Retention

We keep your account data for as long as your account or subscription is active, then for the period required by accounting and tax rules.

We keep technical server logs only as long as needed to run and secure the service.

You may ask us to delete your account and data at any time, subject to what we must legally retain.

8. Your rights

You have the right to know how your data is processed, to access it and obtain a copy, to correct or update it, to request its destruction, and to withdraw consent.

To exercise any of these, write to hello@drivapi.com and we will respond within the statutory period.

If our response does not satisfy you, you may complain to the competent supervisory authority in the Kingdom (the Saudi Data and AI Authority — SDAIA).

9. Security

We use encrypted connections, restricted access and backups. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

10. Children

The service is aimed at businesses and people aged 18 or over. We do not knowingly collect children’s data, and will delete it if received.

11. Google Analytics connection and Google user data

If you choose to connect your Google account on the "Website visitors" page, DrivAPI accesses the following Google user data, only with your consent and only for the purposes described here.

What we access: your Google account email address, to show you which account is connected; your Google Analytics accounts, properties and web data streams (names and IDs), so you can choose the one that belongs to your store; and aggregated Google Analytics reports for the one property you connect: visitors, sessions, page views, average visit duration, countries, device types and traffic sources.

What we do on your behalf: if you ask us to, we create a Google Analytics account request, one Google Analytics property and one web data stream for your store. We do not change or delete any existing Google Analytics account, property or setting. We place that stream's measurement ID on your own storefront so Google Analytics can count your visitors.

How we use it: only to show you your own visitor numbers in your DrivAPI dashboard and to keep the tracking code on your storefront working. We do not use this data for advertising, do not sell it, and do not use it to develop or train AI or machine-learning models. DrivAPI staff do not view your Google Analytics data, except when you ask us for support and give permission, or when the law requires it.

What we store: an access credential issued by Google (a refresh token), encrypted, plus your Google email, the Analytics account and property identifiers, and the measurement ID. We do not store your Analytics reports: they are fetched when you open the page and kept in a temporary cache for up to five minutes.

Sharing: we do not share Google user data with third parties. It is processed only by DrivAPI and the hosting providers that run our service on our behalf.

Removing access: press "Disconnect" on the Website visitors page at any time. We revoke our access at Google, delete the stored connection and remove the tracking code from your storefront. The Analytics property remains in your Google account. You can also remove DrivAPI's access at https://myaccount.google.com/permissions. The connection is removed automatically if your DrivAPI account or store is deleted.

DrivAPI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes

We may update this policy; the last-updated date at the top will change. We will notify you of material changes by email or through the site.