Privacy Policy

Effective Date: April 20, 2026
Last Updated: April 19, 2026

1. Introduction

Welcome to VRUM (“VRUM,” the “Platform,” “we,” “us,” or “our”).

This Privacy Policy explains how VRUM GLOBAL, the operator of VRUM, collects, uses, stores, discloses, transfers, and otherwise processes personal data when you access or use our website, booking flows, listing tools, customer support channels, identity verification flows, and related digital services.

Controller / Responsible Party

The controller and responsible party for the processing of personal data described in this Privacy Policy is:

VRUM GLOBAL
Legal address / domicile: Calle Cortez Blanco Pasaje L 13, Antiguo Cuscatlan, La Libertad
Contact email: contacto@vrum.autos
Country of operation: El Salvador

This Privacy Policy should be read together with our Terms of Service and any additional platform rules, booking terms, host terms, renter terms, cookie notice, or verification disclosures presented within the Platform.

By accessing or using VRUM, you acknowledge that you have read and understood this Privacy Policy.

2. Categories of Personal Data We Collect

We may collect the following categories of personal data, depending on how you use VRUM.

2.1 Account and Contact Data

Full name
Email address
Telephone number
Residential or mailing address
Date of birth, where required
Username, profile details, ratings, reviews, and communications

2.2 Identity and Verification Data

Government-issued identification, including DUI, passport, or driver’s license
Driver’s license details and driving eligibility information
Selfies, liveness captures, facial scans, biometric verification-related data, document images, verification session data, fraud-prevention signals, and verification outcomes, where applicable and permitted by law
Device and technical data collected during verification or fraud screening

2.3 Vehicle and Host Data

If you act as a host, owner, or vehicle provider, we may collect:

Vehicle make, model, and year
License plate number
Vehicle registration and related documentation
Vehicle condition, features, photos, videos, and listing content
Insurance-related information
Availability, pricing, and booking-related listing data

2.4 Payment, Billing, and Payout Data

Billing details
Partial payment method information
Transaction amounts, dates, status, refunds, disputes, and chargeback data
Payout-related information for hosts, where applicable
Tax or compliance-related payment records, where required

Payment processing and related financial operations may be handled by Stripe and other regulated financial or payment service providers acting on our behalf or under their own legal obligations.

2.5 Automatically Collected Data

When you use VRUM, we may automatically collect:

IP address
Browser type and version
Device type, operating system, and identifiers
Approximate geolocation
Log data
Session data, navigation behavior, pages viewed, clicks, and platform activity
Fraud, risk, abuse, and security indicators

2.6 Sensitive Personal Data

Some of the data processed through VRUM may be considered sensitive personal data, including:

Biometric or biometric-related verification data
Identity document data
Driver eligibility or compliance-related data, where applicable

We identify these categories as sensitive and treat them with additional safeguards and, where required by law, based on express consent or another valid legal basis.

3. Sources of Personal Data

We may collect personal data:

Directly from you
From your use of the Platform
From other users involved in a booking or listing
From payment processors such as Stripe
From identity verification providers such as Didit
From fraud prevention, security, technical infrastructure, communications, and analytics providers
From legal or regulatory authorities where required by law

4. Purposes of Processing and Legal Bases

We process personal data for the following purposes.

4.1 Performance of a Contract or Pre-Contractual Measures

We process personal data as necessary to:

Create and manage your account
Publish listings
Facilitate bookings, rentals, and booking-related communications
Process payments, refunds, and, where applicable, payouts
Provide customer support
Enforce platform rules and resolve operational issues

4.2 Compliance with Legal Obligations

We may process personal data to:

Comply with legal, regulatory, tax, accounting, anti-fraud, law enforcement, or court obligations
Maintain records required by applicable law
Respond to valid legal requests
Protect against illegal activity, abuse, fraud, or misuse

4.3 Legitimate Interests

Where permitted by law, we may process personal data for our legitimate interests, including to:

Protect the security and integrity of VRUM
Prevent fraud, account abuse, unauthorized access, and platform misuse
Investigate disputes, incidents, claims, and safety matters
Improve the performance, usability, reliability, and security of the Platform
Maintain internal business records and service continuity

4.4 Consent

Where required by law or where we rely on consent, we may process personal data based on your consent, including for:

Certain identity verification, biometric, or liveness steps
Non-essential cookies or similar technologies
Optional promotional communications, if used
Any other processing activity that legally requires consent

Where consent is the legal basis, you may revoke it as described in Section 10 of this Privacy Policy. Revocation will not affect processing that was lawful before the revocation or processing that remains justified on another legal basis.

5. Identity Verification, Biometric Data, and Didit

To support identity verification, fraud prevention, trust and safety, eligibility checks, and platform integrity, VRUM may use Didit as an external identity verification and related risk-assessment service provider.

Where verification is required or offered on VRUM:

You may be asked to provide identity documents, selfies, liveness captures, video or image-based verification inputs, and related information.
Verification-related data may be processed by VRUM and/or Didit in order to confirm identity, detect fraud, assess document authenticity, verify driver eligibility, and determine whether verification requirements have been satisfied.
Certain verification data may qualify as sensitive personal data.
Where required by applicable law, VRUM will request your express consent or equivalent affirmative authorization before processing sensitive verification or biometric-related data.
Refusal to complete mandatory verification may prevent you from booking, listing, receiving payouts, or accessing certain features where verification is required for compliance, safety, fraud prevention, or platform eligibility.

Didit may also present its own end-user disclosures, terms, or privacy notice during the verification flow. Where verification is initiated through VRUM, VRUM remains responsible for the controller-side disclosures presented inside the VRUM experience and for handling privacy requests addressed to VRUM in relation to the verification flow.

Processor contact details currently used by VRUM for verification:
Didit
Contact: hello@didit.me

Additional legal/privacy materials may be made available during the verification flow.

6. Disclosure and Sharing of Personal Data

We may disclose personal data in the following situations.

6.1 With Other Users

In connection with bookings and rentals, certain information may be shared between hosts and renters where reasonably necessary to facilitate a transaction, trust and safety, or post-booking coordination. This may include:

Profile information
Ratings and reviews
Booking-related information
Limited contact or transaction details where operationally necessary

6.2 With Service Providers and Processors

We may share personal data with third-party vendors, service providers, contractors, and processors who provide services for or on behalf of VRUM, including:

Stripe for payment processing, refunds, disputes, fraud prevention, and, where applicable, payouts
Didit for identity verification and fraud-prevention services
Hosting, cloud storage, and infrastructure providers
Customer support and communications providers
Security, logging, fraud, and abuse prevention tools
Analytics and performance providers
Mapping, location, technical integration, and email/SMS delivery providers

These providers may process personal data only to the extent reasonably necessary to perform services for VRUM, to comply with their own legal obligations, or as otherwise permitted by law and contract.

Processor / service provider contact details currently used by VRUM:
Stripe
Privacy resources: Stripe Privacy Center
Data protection contact: dpo@stripe.com

Didit
Contact: hello@didit.me

VRUM may update this list from time to time as our service provider relationships change.

6.3 For Legal Compliance and Protection

We may disclose personal data when required or permitted by law, regulation, subpoena, court order, legal process, or government request, or where reasonably necessary to:

Comply with legal obligations
Enforce our terms, rules, and policies
Detect, investigate, or prevent fraud, abuse, unlawful activity, or security incidents
Protect the rights, safety, security, property, or legitimate interests of VRUM, our users, or third parties

6.4 Business Transactions

We may disclose or transfer personal data in connection with a merger, reorganization, restructuring, financing, sale of assets, acquisition, or similar business transaction, subject to applicable law.

7. International Transfers of Personal Data

Your personal data may be stored, accessed, processed, or transferred outside El Salvador, including in countries where VRUM or its service providers maintain infrastructure, operations, affiliates, or personnel.

Where such transfers occur, VRUM will take reasonable and appropriate steps to ensure that transferred personal data receives protection consistent with applicable law, including contractual safeguards, access controls, vendor due diligence, and other appropriate measures.

Where required by law, we will obtain your consent for such transfers or otherwise rely on a valid legal basis permitting the transfer.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

For the duration of your account relationship with VRUM
For the period needed to complete bookings, transactions, refunds, disputes, or related customer support matters
For legal, tax, accounting, compliance, security, and audit purposes
To investigate claims, fraud, abuse, incidents, or disputes
To enforce contractual rights and platform policies

Examples of retention periods may include:

Account data: retained while your account remains active and for a reasonable period afterward for legal, fraud-prevention, or dispute purposes
Booking and transaction data: retained as required for accounting, tax, and contractual recordkeeping
Verification data: retained for compliance, safety, fraud-prevention, and audit purposes, and subject to the retention practices of applicable service providers where permitted by law
Support and complaint records: retained for dispute handling, quality control, and legal defense purposes
Cookie and analytics data: retained according to the applicable cookie or tool settings unless deleted sooner

Where legally required, data will be deleted, anonymized, or blocked once retention is no longer necessary.

9. Your ARCO-POL Rights and Other Rights

Subject to applicable law, you may exercise the following rights in relation to your personal data:

Access: to know what personal data we hold about you
Rectification: to correct inaccurate, incomplete, or outdated data
Cancellation / Deletion / Suppression: to request deletion where legally applicable
Opposition: to object to certain processing
Portability: to receive certain personal data in a structured format and, where applicable, transmit it to another controller
Right to be forgotten: where legally applicable, especially for data published in digital environments
Limitation / Restriction: to request limitation of processing in certain cases
Withdrawal of consent: where processing is based on consent
Information: to request additional information about how your data is collected, used, shared, transferred, or retained

9.1 Privacy Delegate / ARCO-POL Contact

Requests regarding ARCO-POL rights, consent revocation, or privacy matters should be directed to our designated privacy delegate:

VRUM GLOBAL Privacy Delegate
Email: contacto@vrum.autos
Address or filing channel: Calle Cortez Blanco Pasaje L 13, Antiguo Cuscatlan, La Libertad

9.2 How to Submit a Request

Your request should include, at a minimum:

Your full name
A reliable contact method for our response
Information reasonably sufficient to verify your identity
A clear description of the right you wish to exercise
Details that help us locate the data related to your request
Any documents necessary to support your request, where applicable

We may request additional information to verify your identity or authority before acting on a request.

9.3 Response Time

We will respond within the period required by applicable law. Where El Salvador law applies, requests will generally be addressed within twenty (20) business days, subject to any lawful extension or clarification process.

9.4 Cost

The exercise of ARCO-POL rights is generally free of charge, except where applicable law allows limited charges for reproduction, certification, or physical delivery.

9.5 Complaints

If you believe your privacy rights have not been properly addressed, you may also seek relief before the competent authority, including the Agencia de Ciberseguridad del Estado, or any other authority with jurisdiction.

10. Revocation of Consent

Where processing is based on your consent, you may revoke that consent at any time by contacting VRUM through the channels listed in this Privacy Policy or through any consent-management tool we make available.

Revocation of consent:

will not affect the lawfulness of processing carried out before revocation;
may not affect processing justified by another legal basis; and
may limit your ability to use certain features where the relevant processing is necessary for verification, security, booking eligibility, or service delivery.

11. Cookies and Similar Technologies

VRUM uses cookies, pixels, local storage, SDKs, scripts, and similar technologies for the following purposes:

Operating the website and maintaining essential functionality
User authentication and session continuity
Security, abuse prevention, and fraud detection
Remembering settings and preferences
Measuring traffic, performance, and technical reliability
Analytics and service improvement
Campaign measurement or promotional communications, where applicable

We may use the following categories of cookies or similar technologies:

Strictly Necessary Cookies
Functional Cookies
Analytics Cookies
Advertising or Similar Technologies, if used

Where required by law, non-essential cookies will be used only after you provide valid consent.

You may manage your cookie preferences through:

our cookie banner,
our cookie settings tool, or
your browser settings, where applicable.

Disabling some cookies may affect platform functionality.

A more detailed cookie notice or cookie settings panel may be provided separately and should be read together with this Privacy Policy.

12. Data Security and Security Incidents

We implement reasonable administrative, organizational, technical, and physical safeguards designed to protect personal data against unauthorized access, misuse, disclosure, alteration, destruction, or accidental loss.

These safeguards may include:

Encryption in transit
Access controls and authentication measures
Role-based permissions
Secure hosting and monitoring practices
Internal security procedures
Vendor due diligence and contractual protections

No system is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident affecting personal data, we may investigate, mitigate, document, and notify affected persons and competent authorities as required by applicable law.

13. Minors

VRUM is not intended for persons under eighteen (18) years of age. We do not knowingly permit minors to create accounts, list vehicles, or make bookings.

If we become aware that personal data from a minor has been collected without proper authorization or legal basis, we may suspend the account, restrict access, and delete or block the data as appropriate.

14. Third-Party Services

VRUM may integrate with or link to third-party services, including payment, mapping, communications, analytics, infrastructure, and verification services.

Those third parties may operate under their own terms, notices, and privacy practices. VRUM is not responsible for the independent privacy practices of third-party services except to the extent required by law for processing carried out on our behalf or within our own service flow.

Where a third-party flow is embedded in or launched from VRUM, we may provide additional notices at the point of collection.

15. Changes to This Privacy Policy

We may amend, update, or revise this Privacy Policy from time to time.

We will communicate material changes through one or more of the following means:

publication of the updated Privacy Policy on VRUM,
account notification,
email notice,
banner notice, or
another reasonable communication channel.

The “Last Updated” date at the top of this Privacy Policy indicates when the latest changes became effective.

16. Contact Information

For general privacy questions, ARCO-POL requests, consent revocation, or data-protection concerns, please contact:

VRUM GLOBAL
Email: contacto@vrum.autos
Legal address: Calle Cortez Blanco Pasaje L 13, Antiguo Cuscatlan, La Libertad
Privacy Delegate: VRUM GLOBAL Privacy Delegate
Delegate Email: contacto@vrum.autos
Delegate Filing Channel / Address: Calle Cortez Blanco Pasaje L 13, Antiguo Cuscatlan, La Libertad

17. Short Verification Notice for the Didit Flow

Identity Verification Notice

To use certain features of VRUM, including bookings, listings, payouts, or trust and safety checks, we may require identity verification. This process may involve collection of your ID document, selfie, liveness capture, and related technical and fraud-prevention data by VRUM and Didit. Where required by law, your express consent will be requested before sensitive verification data is processed. Refusing required verification may prevent access to certain features. Please review VRUM’s Privacy Policy and the applicable Didit verification disclosures before continuing.