Privacy Policy

1. Who We Are

This Privacy Policy applies to GigWheels Private Rental Car Agency ("GigWheels," "we," "us," or "our"), a Georgia-based rental car company operating the website gogigwheels.com and the sub-brands Daily Rentals and Drive Elite.

We rent vehicles to gig workers, short-term renters, and luxury clients throughout the State of Georgia. We are the data controller for the personal information collected through our website, application forms, and rental contracts.

2. Information We Collect

2.1 Information You Provide Directly

When you submit a form, apply to drive, or rent a vehicle, we collect:

• Identity information: full legal name, date of birth, home address (street, city, state, ZIP)
• Contact information: email address, phone number
• Driving credentials: driver's license number, license state, license expiration date
• Driving history: self-reported accident history within the last 3 years, prior gig-platform removal/deactivation history, currently approved gig platforms
• Employment information: which gig platforms you plan to drive for (Uber, Lyft, DoorDash, Instacart, Amazon Flex, Grubhub, Shipt, Uber Eats, and others), your rideshare/delivery experience level
• Rental preferences: vehicle class interest, pickup timing, notes to onboarding
• Additional driver information: if you add a second driver, their name, email, phone, driver's license number and state
• Insurance information: your auto insurance provider name and policy number (either self-reported on the rental agreement or verified through our insurance partner — see Section 5)
• Uploaded document images: photos or scans you upload of your driver's license (front and back), insurance card (front and back), motor-vehicle report (MVR), income / pay report, insurance declaration page, and any other documents you attach during the application, portal, or check-in flow
• Customer-portal account credentials: if you create an account on our customer portal, we store your email address, a password you set (never in plain text — see Section 7), and a session token to keep you signed in
• E-signature data: a drawn signature image, typed legal name, drawn initials, the exact consent text you agreed to, and the timestamp, IP address, and browser user-agent at the moment you signed
• Consent records: your explicit consent choices for SMS marketing, email marketing, background check authorization, and rental agreement, each stored with the timestamp, IP address, and user-agent captured at the moment you consented, plus the exact wording of the disclosure shown to you
• Vehicle pickup / return data: odometer readings, fuel level, condition notes, and any damage photos captured at check-in or check-out
• Support and change-request messages: tickets you open, follow-up questions, and messages you send us through the customer portal

2.2 Information Collected Automatically

• Technical data: IP address, browser type, operating system, device type, referring URL, timestamps
• Usage data: pages visited, form fields interacted with, submission attempts, agreement view timestamps (when you opened your signing link)
• Security data: failed login attempts, admin-audit-log entries (for staff activity), Cloudflare network security signals (bot detection, DDoS filtering)
• Cookies & similar technologies: see Section 9 below

2.3 Information from Third Parties

• Background check results from our background-check vendor (see Section 11)
• Motor Vehicle Records (MVR) from the Georgia Department of Driver Services or comparable state authority (obtained directly by us or supplied by our background-check vendor)
• Insurance verification results from our insurance-verification partner Canopy — see Section 5.1
• Payment confirmations and 1099-K reports from Stripe, Cash App (Block, Inc.), Zelle, PayPal, or Venmo when applicable — we do not receive full card or bank credentials
• CRM data imported from GoHighLevel if you were contacted through one of our marketing campaigns before applying

3. How We Use Your Information

We use your information only for the purposes below:

• To evaluate your driver application and determine rental eligibility
• To verify your driver's license, run background checks, and confirm your driving record
• To contact you about your application, rental, vehicle swap, roadside assistance, or account matters
• To generate, deliver, and store your rental agreement and e-signature
• To process rental payments, deposits, and any incidental charges
• To provide customer support and respond to inquiries
• To send transactional messages (rental reminders, return notices, receipt emails)
• To detect and prevent fraud, unauthorized access, and misuse of our vehicles
• To comply with our legal, tax, insurance, and regulatory obligations under Georgia and U.S. law
• To improve our website and services in aggregate (anonymized analytics)

We do not:

• Sell your personal information to third parties
• Rent, trade, or lease your data to marketers
• Share your data with social media platforms for advertising
• Use your data for automated decisions that legally deny you a rental (see Section 12)

4. Legal Basis for Processing

We process your personal information based on one or more of the following legal grounds:

• Consent — you check the consent box on our application form authorizing background checks and contact
• Contract — processing is necessary to enter into or perform under a rental agreement with you
• Legal obligation — retention of rental records required by Georgia motor vehicle rental law, IRS/tax authorities, and our commercial insurance carrier
• Legitimate interest — fraud prevention, network security, and improving our services

5. Who We Share Your Information With

We share your data only with the specific service providers and parties below, and only to the extent necessary:

5.1 Service providers (data processors)

We share only the data each provider needs, and only to deliver the specific service listed:

• Cloudflare, Inc. — hosts gogigwheels.com, serves the customer portal and admin dashboard, stores our operational database (Cloudflare D1), and provides network-level DDoS and bot protection. All information you submit through our site is stored in Cloudflare's U.S. data centers. Cloudflare Privacy Policy
• Netlify, Inc. — auxiliary receiver for our marketing lead forms (Contact, Daily Rentals, Drive Elite inquiry forms on the homepage) and the leads-sync scheduled function that pulls from GoHighLevel. Netlify Privacy Policy
• Canopy Insurance (Canopy Connect, Inc.) — verifies your active auto-insurance coverage. You may either upload a photo of your insurance card or connect your carrier account through Canopy's secure portal at app.usecanopy.com/c/gig-wheels. When you use the carrier connect option, your insurance-carrier login credentials are handled entirely by Canopy — GigWheels never sees them. Canopy returns to us only the confirmation of active coverage, coverage limits, and policy dates. Canopy Privacy Policy
• GoHighLevel (LeadConnector) — customer relationship management (CRM), lead follow-up pipeline, marketing-message delivery. GHL Privacy Policy
• EmailJS + Hostinger — transactional email delivery for invitations, approvals, account-setup links, agreement links, and rental notifications. EmailJS relays the message content to Hostinger's SMTP servers, which deliver the email to your inbox. EmailJS Privacy Policy · Hostinger Privacy Policy
• SMS delivery provider — transactional SMS messages about your application and rental. The specific carrier is configured in our admin settings; content is sent through a secure webhook and includes only the fields required to identify your rental (name, reservation number, event context).
• Stripe, Inc. — credit/debit card payment processing when you choose to pay by card. Card numbers, CVV, and expiration dates are entered directly on Stripe's hosted payment page. GigWheels never receives or stores your full card number. We receive only the confirmation, last-four digits, and payment intent ID. Stripe Privacy Policy
• Cash App (Block, Inc.) and Zelle (Early Warning Services, LLC) — alternative payment methods when you choose to send funds directly. These platforms operate outside our systems; we receive only your confirmation reference number to record the payment.
• Background-check vendor — driver-history verification, MVR, criminal-record check, and identity verification (specific vendor disclosed at the time of your application under the Fair Credit Reporting Act — see Section 11).
• Google LLC — Google Fonts (loads Inter and Playfair Display webfonts; Google may log your IP address when it serves the font file, per their standard font-serving practice). Google Privacy Policy
• Font Awesome / jsDelivr / cdnjs — content delivery networks that serve icons and JavaScript libraries used by our site. These CDNs may log the IP address of your browser when it downloads a shared asset.
• Insurance carrier — if a claim, incident, or accident occurs during your rental, we share the relevant rental and driver information with our commercial auto insurance carrier for claims handling.
• Roadside-assistance provider — 24/7 tow, lockout, and jump-start services if you request roadside assistance during your rental. We share your name, phone number, vehicle description, and location.

Each of these providers is bound either by a data-processing agreement with us or by their own published privacy terms and is permitted to use your data only to provide services to us.

5.1a In-house e-signature

Our rental agreements are signed on our own site at gogigwheels.com/sign-agreement.html — we do not route your agreement through a third-party e-sign provider like DocuSign, HelloSign, or Adobe Sign. Your drawn signature, typed legal name, drawn initials, timestamp, IP address, and browser user-agent are stored directly in our Cloudflare D1 database, and a completed, non-editable copy of the signed agreement is retained in your customer-portal file for the retention period described in Section 6.

5.2 Legal disclosures

We may disclose your information when required by law, including:

• In response to a valid subpoena, court order, or law enforcement request
• To Georgia Department of Driver Services or law enforcement in the event of a vehicle-related incident, accident, or theft
• To toll-road authorities if your rental incurs unpaid tolls or citations
• To protect the rights, property, or safety of GigWheels, our customers, or the public

5.3 Business transfers

If GigWheels is involved in a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will notify you before your information becomes subject to a different privacy policy.

6. How Long We Keep Your Information

• Active renters: for the duration of your rental relationship, plus 7 years after your last rental (to satisfy IRS, insurance, and Georgia motor vehicle rental law requirements)
• Declined applicants: up to 2 years, so we don't re-run background checks on the same person and can defend an adverse-action decision if challenged
• Website form submissions (contact, daily-rental, drive-elite inquiries): up to 3 years
• Marketing emails / SMS opt-ins: until you unsubscribe, plus 60 days for suppression list
• Cookies & analytics: 13 months maximum

After the applicable retention period, your data is securely deleted or anonymized.

7. How We Protect Your Information

We use industry-standard safeguards, including:

• HTTPS / TLS encryption for all data submitted through our website — enforced site-wide via Cloudflare's managed TLS certificates
• Encryption at rest for stored personal information in our Cloudflare D1 database (managed by Cloudflare in their U.S. data centers)
• Password hashing — customer-portal and admin-user passwords are never stored in plain text. We hash them using SHA-256 combined with a randomly generated per-account salt. Even our own staff cannot read the plaintext password of an account.
• Session tokens — you stay signed in via time-limited session tokens that can be revoked at any time; we log the time, IP, and user-agent of each successful login
• Admin allowlist — access to the internal admin dashboard is restricted to a small list of authorized staff email addresses and enforced with hashed-password authentication plus role-based permissions (owner, manager, bookkeeper, read-only)
• Failed-login lockout — repeated failed sign-in attempts on an admin account trigger a temporary lockout to prevent brute-force attacks
• Audit log — every meaningful staff action (record creation, edit, delete, payment logged, agreement sent, document verified) is written to an append-only audit log with the staff member's identity, timestamp, and a summary of the change
• Network-level security — Cloudflare provides DDoS protection, bot detection, and web application firewall (WAF) filtering in front of our site
• Access controls limiting employee and vendor access to a need-to-know basis
• Vendor due diligence on all third-party processors
• Regular review of security practices

8. Your Rights & Choices

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the information we hold about you
• Correction — ask us to fix inaccurate or incomplete information
• Deletion — ask us to delete your information (subject to legal retention obligations)
• Portability — receive your data in a machine-readable format
• Opt-out of marketing — stop promotional emails or SMS at any time (transactional rental messages will continue as long as you have an active rental)
• Withdraw consent — where we rely on consent, you may withdraw it at any time
• Non-discrimination — we will not refuse service, charge a different price, or provide different quality to you because you exercised a privacy right

To exercise any of these rights, email rent@gogigwheels.com with the subject line "Privacy Request". We will verify your identity and respond within 30 days (or 45 days if we notify you of an extension).

8.1 California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know the specific categories of personal information collected in the last 12 months, and the right to opt out of "sale" or "sharing" of your data. GigWheels does not sell your personal information.

9. Cookies & Tracking Technologies

Our website uses the following types of cookies and browser-storage items:

• Strictly necessary — required for the site to function. Includes the Cloudflare __cf_bm cookie (bot-management), the session token that keeps you signed in to the customer portal or admin dashboard, and short-lived browser localStorage entries used to keep application form data safe if your browser reloads mid-application.
• Functional — remember your preferences (e.g., which brand tab or filter you were on).
• Analytics — aggregate, anonymized statistics on how visitors use the site. We currently rely primarily on Cloudflare's built-in analytics, which is cookie-free and IP-anonymized. If we add a client-side analytics tool later (such as Google Analytics or Plausible), this policy will be updated first.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the site — such as signing in to your customer portal or completing an e-signature — from working correctly.

We do not use advertising cookies, cross-site tracking pixels, Meta / Facebook Pixel, TikTok Pixel, or session-replay tools that record your keystrokes or screen contents.

10. Children's Privacy

Our services are intended for adults age 25 or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a minor under 18, we will delete it. If you believe we have collected such information, please contact us at rent@gogigwheels.com.

11. Background Checks & FCRA Notice

As part of the rental application process, we may obtain a consumer report or investigative consumer report from a third-party background check provider. This report may include:

• Driving record (motor vehicle report / MVR)
• Criminal history
• Identity verification
• Prior rental history from cooperating databases

By submitting the application and checking the consent box, you authorize GigWheels to obtain these reports under the federal Fair Credit Reporting Act (FCRA) and applicable Georgia law.

Your rights under the FCRA include:

• The right to know what information the report contains
• The right to receive a copy of the report at no cost within 60 days if we take adverse action based on it
• The right to dispute inaccurate information directly with the consumer reporting agency
• A copy of the "Summary of Your Rights Under the Fair Credit Reporting Act" — available at consumerfinance.gov

If we deny your application based in whole or in part on information contained in the report, we will provide you with an adverse action notice including the name and contact information of the reporting agency, so you can obtain and dispute the report.

12. Automated Applicant Scoring

GigWheels uses an internal risk-scoring tool that generates a numeric score (0–100) based on the information you provide in your application. This score is used solely as a guide to help our team prioritize follow-up. It does not, by itself, determine whether your application is approved or denied.

All approval and denial decisions are made by a human after reviewing the full application, background check, and any additional context. If we deny your application, we will provide the reason(s) upon request as required by the FCRA and Equal Credit Opportunity Act (ECOA).

The scoring factors we use include: self-reported accident history (last 3 years), removal / deactivation history from prior gig platforms, currently-approved gig platforms, driver's-license state, the specific gig platforms you plan to drive for, and rideshare / delivery experience level. We do not use your ZIP code, home address, name, email, phone number, or any other factor known to correlate with a protected characteristic (race, color, religion, national origin, sex, familial status, disability, or age above 25). We do collect your address for rental-agreement, background-check, and legal-notice delivery purposes — but the scoring engine does not receive it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• We update the "Last updated" date at the top
• For material changes, we email active renters and applicants at their address on file at least 30 days before the change takes effect
• Your continued use of our services after the effective date constitutes acceptance of the updated policy

Prior versions of this policy are available upon request.

14. How to Reach Us

Questions, requests, or complaints about this Privacy Policy or your personal information: