Privacy Policy

Information We Collect

• Name, email address, and phone number (account registration)
• Delivery addresses and location data (required for delivery routing)
• Payment information (processed securely by Stripe — we never store card numbers)
• Device information and IP address (fraud prevention)
• Order history and delivery records
• B2B: company name, business address, credit limit, and account balance (business accounts only)
• Driver: vehicle information, driver license, proof of insurance
• Carrier (Haul Plus vehicle transport & commercial freight): compliance data — USDOT number, MC number, and cargo insurance certificate (COI) details — collected to verify FMCSA operating authority and eligibility for the auto-transport and freight tiers
• Driver: GPS location data while the driver is online — collected in the background at 15-second or 50-meter intervals for dispatch routing and safety
• Driver: phone motion/accelerometer data during active deliveries only — used for automatic crash detection. A sudden impact-magnitude spike followed by stillness triggers an in-app check-in prompt; the outcome (dismissed as a false positive, or escalated for a safety check) is logged to your driver account along with your best-known location at the time. Lower-magnitude spikes (e.g. hard braking) are logged separately to your account as driving-trend data, not reviewed individually. Off at all other times, including online-but-idle.
• Driver: work email address (if you use our employer verification program)
• Driver review documents: submitted ID, license, and vehicle info reviewed by a human (no automated screening)
• Driver: Social Security Number (SSN) and date of birth — collected for IRS 1099-NEC tax reporting (drivers earning $600+ annually) and identity verification during the application review process. We do not store your full SSN: only the last four digits and a one-way cryptographic hash are retained (the hash lets us detect duplicate applications without keeping the number itself), accessible only to authorized personnel. Collection of SSN data triggers obligations under the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.).

How We Use Your Information

• Facilitating food, parcel, haul, vehicle transport & commercial freight (Haul Plus), and B2B deliveries between customers, restaurants, shippers, and drivers or carriers
• Processing payments and payouts via Stripe
• Managing B2B corporate credit accounts and generating consolidated invoices
• Verifying driver eligibility through human review of submitted documents
• Calculating delivery routes using OSRM (Open Source Routing Machine)
• Sending order status notifications via Expo push notifications
• Sending waitlist launch notifications when a new city or state activates on the platform
• Collecting and storing IRS Form W-9 for drivers earning $600+ annually via Stripe (stored in encrypted, non-public storage; used solely for 1099-NEC reporting)
• Detecting and preventing fraud and account abuse
• Complying with applicable law and tax requirements

Third-Party Services

We share data with the following trusted third parties only as necessary to operate the platform:

• Stripe — payment processing and driver/restaurant payouts via Stripe Connect
• Stripe Connect — driver payout disbursement via Stripe transfers (instant at delivery completion, daily, or weekly)
• Mapbox — interactive maps and geographic visualization on our platform
• OSRM (Open Source Routing Machine) — delivery route calculation and distance estimation
• Google Translate — optional page translation when a user selects a non-English language (page text is processed by Google)
• Expo / Google / Apple — push notification delivery
• Fourthwall — merchandise storefront (if you visit our merch page)
• Supabase — secure cloud database hosting
• Anthropic (Claude) — powers our AI support assistant; to answer your questions we send Anthropic the message text you type along with context about your active order or parcel — such as order/tracking ID, restaurant name, delivery address, order total, and driver-assignment status
• Resend — transactional email delivery (order confirmations, driver summaries)

We do not sell your personal information to any third party.

Data Retention

• Order and payment records: 7 years (IRS tax compliance)
• Driver GPS location data: 90 days, then permanently deleted
• Driver crash-detection and driving-trend data: retained as part of your driver safety record until you request account deletion
• Driver review documents: retained for 3 years per internal policy
• Account data: retained until you request deletion

Your Privacy Rights

Regardless of which state you live in, you have the right to:

• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information (subject to legal retention requirements)
• Opt out of marketing communications at any time

California residents: you may additionally request disclosure of categories of personal information shared with third parties under the CCPA.

Residents of states with comprehensive consumer privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others that have since adopted similar statutes — may have additional rights under those laws, such as opting out of certain data processing, obtaining your data in a portable format, or appealing a decision on a prior request. We honor these rights for every user who asks, not only residents of the specific states listed above.

To exercise any of these rights, email us at jason@drivereats.com. We will respond within the timeframe required by the law that applies to you, and within 30 days in all other cases.

Security

We use industry-standard encryption (TLS in transit, AES at rest), row-level security on all database tables, and never store raw payment card data. All financial operations use Stripe's PCI-compliant infrastructure.

Children's Privacy

DriverEats is intended for users 18 years of age or older. Because the platform facilitates alcohol delivery and driver services requiring legal adulthood, we do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will terminate the account and delete associated data.

Security & Data Breach Notification

We implement reasonable technical and organizational measures to protect your personal information, including TLS encryption in transit, AES-256 encryption at rest, and row-level security on all database tables.

In the event of a data breach affecting your personal information, DriverEats will notify affected users directly, and will notify the applicable state attorney general(s) and/or other regulatory authorities where required by the data breach notification law of the state(s) where affected residents live (for example, Ark. Code Ann. § 4-110-105 for Arkansas residents — other states have their own notification statutes with their own thresholds and deadlines, which we follow for residents of those states). Notifications will be sent to the email address associated with your DriverEats account in the most expedient time possible following discovery of a breach, consistent with the legal deadline that applies to you.

Contact Us

For privacy questions or data requests:
DriverEats
Bentonville, Arkansas
jason@drivereats.com