Privacy Policy

This Privacy Policy explains how Vumvum collects, uses, shares, and protects your personal information when you use the Vumvum peer-to-peer car rental platform. The platform is operated by Vumvum LLC (Arizona, USA) for users in the United States and Vumvum Ltd (Rwanda) for users in Rwanda and other African markets. The entity that controls your data is the one operating in your country of residence.

We aim to be straightforward about what we collect and why. If anything in this policy is unclear, contact us at [email protected].

We collect information in three ways: information you give us, information we collect automatically when you use the service, and information we receive from third parties.

Information you give us

• Account information: name, email, phone number, password, profile photo, role (renter/host), country, preferred currency.
• Identity verification: driver's license images (front and back) and a selfie. See Section 5 for how we handle these.
• Payment information: for renters, card details (handled directly by Stripe; Vumvum does not store full card numbers), or mobile money number and network. For hosts, payout method details (mobile money number or bank details depending on region).
• Listing information (hosts): vehicle make, model, year, registration document, insurance document, photos, location, daily rate, availability.
• Booking information: pickup and return times, location, messages exchanged with the other party, inspection photos.
• Communications: messages you send to other users on the platform, support requests, reviews, reports.

Information collected automatically

• Device and connection: IP address, browser type, operating system, device identifiers, language, time zone.
• Usage: pages visited, searches performed, links clicked, timestamps. We use this for product improvement and fraud prevention.
• Approximate location: derived from your IP address, used to show you cars near you and to set the right currency. We do not track precise device location unless you grant explicit permission (e.g. for the “Use my current location” search button).
• Cookies and similar technologies: see Section 9.

Information from third parties

• Payment processors: Stripe and our mobile-money payment processor return transaction status, last-four card digits, and risk signals.
• Identity verification providers: if we use a third-party KYC provider, they may return results of liveness checks, document authenticity checks, and watchlist screening.
• Other users: reviews and reports about you submitted by hosts or renters you have interacted with.

We use your information to:

• Operate the platform: show listings, process bookings, route messages, settle payments, issue refunds.
• Verify your identity and prevent fraud, money laundering, and abuse.
• Provide customer support and resolve damage disputes.
• Send service messages: booking confirmations, cancellation notices, payout notifications, password resets.
• Send marketing messages, only if you opt in. You can opt out at any time from the unsubscribe link in any marketing email.
• Improve and develop the product: analyze usage patterns, fix bugs, design new features.
• Comply with legal obligations: tax reporting, law enforcement requests, regulatory filings.

We do not sell your personal information to third parties for their marketing.

We share information only as needed to operate the platform or as required by law. Specifically:

• With the other party in a booking: once a booking is confirmed, the host and renter see each other's first name, last initial, profile photo, ratings, and (for the duration of the trip) a way to message each other in-app. Phone numbers are not shared by default.
• With payment processors: Stripe (cards) and our mobile-money payment processor receive the information they need to process the transaction. They are independent data controllers under their own privacy policies.
• With service providers: hosting (cloud infrastructure), email delivery, push notifications, analytics, customer-support tools, identity-verification providers. Each is bound by contract to use the data only for the service they provide to us.
• With law enforcement and regulators: when required by valid legal process, or where we reasonably believe disclosure is necessary to protect our rights, the safety of any person, or to investigate fraud.
• In a corporate transaction: if Vumvum is involved in a merger, acquisition, or asset sale, your information may be transferred. You will be notified before any transfer that materially changes how your information is used.
• Aggregated or de-identified data: we may share statistics that do not identify any individual (e.g. “average daily rate in Rwanda”).

Identity documents (driver's license images and selfies) are sensitive personal data. We treat them with extra care:

• Documents are stored encrypted at rest. Access is limited to the trust and safety team and the identity-verification provider.
• Documents are used only to verify identity and to re-verify in cases of suspected fraud or impersonation. We do not use them for marketing, profile photos, or any purpose unrelated to identity.
• Documents are retained for the duration of your account plus the period required to defend against fraud claims and to comply with anti-money-laundering recordkeeping laws (typically 5 years for Vumvum LLC, 10 years for Vumvum Ltd, depending on the transaction). After that period they are permanently deleted.
• You can request a copy of the documents we hold for you under Section 8.

We keep your information for as long as your account is active and for a reasonable period afterward to:

• Resolve disputes, complete chargebacks, and respond to legal claims.
• Maintain the integrity of trip history that other users rely on (reviews, ratings).
• Comply with tax, financial, and anti-money-laundering recordkeeping laws.

Specific retention periods:

• Account profile and listings: retained while account is active; deleted within 30 days of account closure (except items needed for the categories above).
• Booking and payment records: retained for the longer of 7 years or the period required by tax law.
• KYC documents: see Section 5.
• Server logs: typically retained for 90 days for security and debugging.

We protect your information with industry-standard technical and organizational measures. Connections to the platform are encrypted in transit (HTTPS). Passwords are stored hashed, not in clear text. Access to production systems is limited and logged.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authority as required by law. You can help us by using a strong, unique password for your account and enabling two-factor authentication when available.

You have the following rights regarding your personal information. To exercise any of them, email [email protected] from the email address on your account.

• Access: request a copy of the information we hold about you.
• Correction: ask us to correct inaccurate information. Most fields you can also update yourself in your profile settings.
• Deletion: ask us to delete your account and the personal information we hold about you. We may retain a limited subset for legal compliance (see Section 6).
• Objection or restriction: object to certain processing, such as marketing messages or automated risk decisions. You can opt out of marketing at any time using the unsubscribe link.
• Portability: receive your information in a structured, commonly used format.
• Withdraw consent: where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Users in Rwanda may also lodge a complaint with the National Cyber Security Authority (NCSA) under Law No. 058/2021. Users in the United States may have additional rights under their state's privacy law (e.g. CCPA for California residents).

We use cookies and similar technologies for three purposes:

• Strictly necessary: keep you signed in, remember your currency preference, prevent cross-site request forgery. These cannot be turned off.
• Analytics: understand how the platform is used so we can improve it. These can be declined through your browser's do-not-track setting or our cookie banner where applicable.
• Fraud prevention: detect suspicious patterns in account activity.

We do not use cross-site advertising cookies on the Vumvum platform.

Vumvum is not intended for users under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, contact [email protected] and we will close it.

Vumvum operates in the United States and Rwanda, and some of our service providers operate in other countries. Your information may be transferred to, stored in, and processed in countries other than the one in which you reside. We rely on standard contractual safeguards and, where applicable, jurisdiction-specific transfer mechanisms to protect your information when it crosses borders.

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent change. For material changes, we will notify active users by email or in-app notice at least 14 days before the change takes effect.

Questions about this policy or about how we handle your personal information can be sent to [email protected].

Vumvum LLC, Arizona, USA
Vumvum Ltd, Rwanda