Privacy Policy

1. Who we are

Drv.am is operated by Individual Entrepreneur Alexey Ivanov (registration number 306421592), Georgia, Tbilisi, Samgori district, Police Lane I, N5, floor N2, N4a ("we", "us"). We are the controller of your personal data: we decide how it is used and are responsible for it. You can reach us at support@drv.am.

2. Data we collect

• Account data: your email address and name; your interface language, theme and, if you enter it, your exam date. When you sign in by email, we send you a one-time sign-in link and code. If you set a password, it is stored only as a one-way hash, so we cannot read it.
• Sign-in data from Google: if you sign in with Google, the data described in section 3.
• Learning data: the tests and exams you take, your answers and scores, your progress, the questions you got wrong or saved for review, and how many questions you have answered today (used for the daily free limit).
• Content you send us: comments you post on questions and emails you send to our support address.
• Payment data: the amount, currency, order number and status of your payments and, if you buy a subscription, its status and renewal dates. Payments are handled by Dodo Payments (see section 6); we never receive or store your card details.
• Technical and usage data: your IP address (including the IP address of your last sign-in), browser and device type, operating system, the pages you open, actions you take in the Service (for example, starting a test or buying access) and technical details of errors.
• Guest exam data: if you try an exam without an account, we store your answers under a random identifier kept in a cookie in your browser. If you then register, the results are moved to your new account.
• Push notification data: if you allow notifications in your browser, the subscription address your browser gives us so that we can send you reminders.

You need to give us your email address to create an account; without it we cannot provide the Service. Everything else is optional or collected automatically as described above.

3. Google user data

You can create a Drv.am account and sign in with your Google account. This section explains exactly what we receive from Google and what we do with it.

What we access

We request only Google's basic sign-in permissions: openid, email and profile. With your permission, Google shares with us:

• your Google account email address;
• your name;
• your Google account ID (a number that identifies your Google account).

Google also includes a link to your profile picture, which we do not store or use. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service. We never see your Google password, and we do not keep Google access or refresh tokens, so we cannot act on your Google account.

How we use it

• Email address: to create your Drv.am account, to recognise you when you sign in, and to send you service emails: the welcome email, sign-in links, notifications of replies to your comments and answers to your support requests.
• Name: to address you in the Service and in our emails.
• Google account ID: to link your Google account to your Drv.am account, so that the next Google sign-in opens the same account.

We do not sell Google user data. We do not use it for advertising, and we do not use it to develop, improve or train artificial intelligence or machine learning models. We do not give it to data brokers or use it to decide on credit. Nobody reads it except when you ask us for help, when it is needed for security (for example, investigating abuse), or when the law requires it.

How we store and share it

Your email address, name and Google account ID are stored in our database on Fly.io servers. We share them only with the service providers that run parts of the Service for us, and only for the purposes in section 6:

• Resend receives your email address to deliver our emails;
• Sentry receives your email address with error reports, if an error happens while you are signed in;
• Mixpanel receives your name as part of your product analytics profile;
• Dodo Payments receives your name and email address when you start a payment.

Limited Use

Drv.am's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

We keep your Google user data for as long as your Drv.am account exists. You can delete your account at any time in your profile with the "Delete my account" button. This immediately removes your email address, name and Google account ID from our database, together with the rest of your account data (see section 9 for the few records that are kept after deletion). You can also email support@drv.am from the address you signed in with to ask us to delete it.

You can remove Drv.am's access to your Google account at any time on the Third-party apps & services page of your Google Account. This stops Google from sharing your data with us in future; to delete the data we already hold, delete your Drv.am account as described above.

4. Why we use your data and on what legal basis

• To provide the Service — your account, sign-in, tests and exams, progress tracking, spaced review of mistakes, the daily free limit and service emails. Legal basis: performance of our contract with you.
• To handle payments and paid access. Legal basis: performance of our contract with you; keeping accounting records is a legal obligation.
• To answer your support requests and comments. Legal basis: performance of our contract with you.
• To send practice reminders by push notification, only if you turned them on. Legal basis: your consent, which you can withdraw at any time by turning notifications off.
• To understand and improve the Service with product analytics (Mixpanel). Legal basis: our legitimate interest in learning which features and pages are used so we can improve them.
• To measure visits with Google Analytics. Legal basis: our legitimate interest in understanding how the Service is used.
• To keep the Service secure and working — error monitoring, server monitoring and preventing abuse. Legal basis: our legitimate interest in a secure, working Service.
• To comply with the law, for example tax rules or a lawful request from an authority. Legal basis: legal obligation.

Where we rely on legitimate interests, you can object at any time (see section 10). We do not send newsletters or marketing emails, we do not sell your personal data, and we do not make decisions about you based solely on automated processing.

5. Cookies and similar technologies

• Essential cookies keep you signed in, protect forms against forgery and link a guest exam to your browser. The Service cannot work without them.
• Preference storage remembers choices such as your language and theme, and which sections you collapsed.
• Analytics cookies: a device identifier (mp_device_id, kept for one year) that links your visits for our product analytics in Mixpanel. Google Analytics, which counts visits and is loaded through Cloudflare Zaraz, also uses cookies.

You can block or delete cookies in your browser settings. If you block essential cookies you will not be able to sign in.

6. Who we share data with

We use the following service providers. Each receives only the data it needs to do its job for us:

• Fly.io hosts the application and its database on servers in Frankfurt, Germany. All account and learning data is stored there.
• Tigris (through Fly.io) stores our files (such as question images) and backups of our database.
• Cloudflare delivers the website and protects it against attacks. All traffic to Drv.am, including your IP address, passes through Cloudflare.
• Google Analytics (Google) receives the pages you view, your device and browser, and your approximate location (country or city). We do not send your name or email address to Google Analytics.
• Mixpanel (product analytics, stored in the European Union) receives events about how you use the Service, your account number, device identifier, language and name, and your email address when you delete your account.
• Sentry (error tracking) receives technical details of errors, including your account number and email address if you were signed in. Passwords and other sensitive fields are removed before a report is sent.
• Datadog (server monitoring, European Union) receives technical data about requests to our servers, which may include your IP address.
• Resend delivers our emails and receives the emails you send to our support address.
• Dodo Payments is the merchant of record for purchases: it resells access to the Service to you, processes the payment, handles taxes and, for subscriptions, charges renewals. We send it your name and email address to fill in the checkout; you enter your card details on Dodo's payment page, and Dodo tells us whether the payment succeeded. Dodo acts as an independent controller of the data it collects at checkout, under its own privacy policy.
• Browser push services (for example, Google for Chrome, Mozilla for Firefox and Apple for Safari) deliver push notifications if you turned them on. The notification content is encrypted so the push service cannot read it.

We may also disclose personal data when the law requires it (for example, to a court or a public authority) or when it is necessary to protect our rights or the safety of users. If the Service is sold or transferred to another operator, your data will be transferred with it, the new operator will be bound by this policy, and we will notify you before that happens.

7. International transfers

We are established in Georgia. Our database is hosted in the European Union (Frankfurt, Germany), and some of our service providers process data outside Armenia, in particular in the European Union and the United States. We use providers that commit to protecting personal data in their data processing terms.

8. How we protect your data

• All connections to Drv.am are encrypted with HTTPS.
• Passwords, if you set one, are stored only as salted one-way hashes.
• Card details are entered on the payment provider's page and never reach our servers.
• Access to our servers and database is limited to the people who operate the Service.
• Passwords and other sensitive fields are removed from error reports before they are sent to our error tracking provider.

No method of transmission or storage is completely secure. If a security incident puts your data at risk, we will inform you and the supervisory authority as required by law.

9. How long we keep data

• Account, learning and Google user data: as long as your account exists. When you delete your account, it is removed from our database immediately.
• Payment records: kept after the account is deleted, together with the name and email address used for the payment, for as long as tax and accounting law requires.
• Comments: comments you posted on questions stay visible under the name they were posted with, but are no longer linked to an account. Write to us if you want them removed.
• Support emails: kept so that we can follow up on your request. Write to us if you want them deleted.
• Backups: our database backups can still contain deleted data for a limited period, until they are overwritten.
• Analytics and monitoring data: error reports, server logs and Google Analytics data are deleted automatically by those providers after their retention periods. Mixpanel data is kept until we delete it; write to us and we will delete your Mixpanel profile.

10. Your rights

Under Armenia's Law on Protection of Personal Data you have the right to:

• know what data we hold about you and get a copy of it;
• correct inaccurate data (you can change your name in your profile yourself);
• have your data deleted (see section 3);
• ask us to restrict the processing of your data;
• receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another service;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, for example by turning off push notifications, without affecting processing that took place before;
• file a complaint with the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.

To use any of these rights, email support@drv.am from the address linked to your account. We will answer within the time limits set by law.

11. Children

Drv.am is meant for people preparing for a driving licence theory exam. If you are under 16, please use it only with the permission of a parent or guardian. We do not knowingly collect personal data from children under 16 without that permission; if you believe this has happened, contact us and we will delete the data.

12. Changes to this policy

When we change this policy, we update the date at the top of this page. Before any significant change takes effect, in particular any change to how we use Google user data, we will notify you by email or in the Service.

13. Contact us

For any question about this policy or your personal data:

• Email: support@drv.am
• Operator: Individual Entrepreneur Alexey Ivanov, registration number 306421592
• Address: Georgia, Tbilisi, Samgori district, Police Lane I, N5, floor N2, N4a