Privacy Policy

This Privacy Policy explains how Spark CX FZE, the company behind Govrum, collects, uses, shares and protects personal information when you use the Govrum website and services (the "Platform"). It is written to reflect UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and to be readable, not just legally correct.

For processing of personal information carried out under Spark CX FZE's control, Spark CX FZE is the "Controller". Rental agencies you interact with on the Platform are separate, independent Controllers for the personal information they process to fulfil rentals; their own privacy notices apply.

We collect the following categories of personal information:

• Account information — name, email address, mobile number, avatar, preferred city, chosen role (customer or agency), and (for agency team members) the agency workspace you belong to and your role in it.
• Agency profile information (for Agencies) — trade name, licence and business details, addresses, WhatsApp number, service areas, uploaded logo and trade licence document, and status (draft, pending review, approved, suspended).
• Booking information — the vehicle you asked about, dates and times, pickup and return locations, driver requirements, delivery fee, calculated VAT line, total price, notes to the agency, status of your request, promo codes used, and any cancellation reason.
• Messages and reviews — text and images you send through in-app chat, your reviews and star ratings, any moderation notes or agency replies attached to them.
• Preferences and activity — favourites, recently viewed cars and searches, notification and email preferences per category, and consented cookie choices.
• AI interactions — text and, for voice input, short audio clips you submit to the AI Concierge, Agency AI or transcription features, plus the resulting model output.
• Technical and usage data — device and browser information, coarse location inferred from your device, pages viewed, features used, error and audit logs, and (when you accept analytics cookies) aggregated Google Analytics data.
• Partner-programme information — for the Founding Partner waitlist: your name, company, email, phone and the details you submit.

Payment cards. Govrum does not collect or store credit-card or debit-card details. Rental payments are made directly to the agency and any payment method they use with you is handled by them or their payment provider, not by Govrum.

Government-issued identity documents. Govrum requires agency partners to upload their trade licence for verification, which is stored securely and accessible only to authorised staff. Govrum does not currently require customers to upload their driving licence, Emirates ID or passport through the Platform; the agency collects and verifies those documents directly at handover under its own privacy notice.

We use personal information to:

• Provide the Platform: show listings, run search and filters, take and route booking requests, host chat and reviews, and give agencies the tools to manage their inventory, calendar and pricing;
• Communicate with you about your account, bookings, reviews, and platform changes (transactional email and in-app notifications);
• Send marketing and promotional messages, but only where you have opted in through your notification preferences (you can turn any category off at any time);
• Provide the AI Concierge and Agency AI features, including sending your inputs to our AI-gateway provider;
• Understand and improve how the Platform is used through analytics (only with your cookie consent);
• Keep the Platform safe: prevent fraud, abuse, spam and misuse; investigate incidents; keep audit trails required for accountability;
• Comply with legal obligations and cooperate with lawful requests from competent UAE authorities.

Under PDPL principles, we rely on the following legal bases: performance of a contract with you (or steps at your request before entering into one); our legitimate interests in running, securing and improving the Platform, provided these do not override your rights; compliance with a legal obligation; and your consent (for marketing, non-essential cookies, and certain optional features).

We share personal information only where it is needed to run the Platform:

• Rental agencies — when you send a booking request, the agency receives the details needed to fulfil it: your name, contact number, requested dates, vehicle, pickup/return location, driver notes, and messages tied to that booking. Reviews you publish are visible to the agency and to the public.
• Our service providers ("processors") — vetted third parties that host our infrastructure and help operate specific features. Each is bound by confidentiality and data-processing obligations. See the next section for the current list.
• Authorities and legal parties — where we are required to by UAE law or valid legal process, or to protect our rights, property or safety, or the rights, property or safety of users or the public.
• Corporate transactions — if Spark CX FZE is involved in a merger, acquisition or asset sale, information may be transferred to the successor entity on terms consistent with this Policy.

We do not sell your personal information.

• Supabase — hosting, database, authentication and file storage.
• Resend and the Lovable email infrastructure — sending transactional and preference-based emails.
• Mapbox — map display and address geocoding.
• Google Analytics — aggregated site analytics, loaded only after you consent through the cookie banner.
• Lovable AI Gateway — routing prompts and audio to underlying model providers (currently OpenAI-family models) for the AI Concierge, Agency AI and voice transcription.
• Cloudflare — social-share link previews.
• Google Fonts — web font delivery.

If we add or remove a provider we will update this list. The list may not include very short-lived diagnostic tools used internally.

When you use the AI Concierge, Agency AI or voice transcription, the text you type or the audio you record is sent to our AI-gateway provider for processing and returned as a reply. We do not use your AI conversations to train third-party public models on your behalf. AI output can be wrong or incomplete, so please verify anything material before you act on it. No significant decision about you is made solely by AI.

We do not disclose the internal system rules, safety instructions or fraud-detection heuristics our AI uses.

Govrum data is hosted on Supabase infrastructure and processed by the service providers listed above. Some of these providers process data outside the UAE. Where personal information is transferred outside the UAE, we do so only where an adequate level of protection exists or under appropriate safeguards permitted by PDPL, and we require our providers to protect the data to the standard set out in this Policy.

We keep personal information only for as long as we need it. In practice this means:

• Account data — for the life of your account and for a limited period afterwards to defend against disputes and comply with law;
• Booking, review and message data — retained after the rental so both parties can refer back to what happened, and to meet record-keeping obligations;
• Financial or tax-relevant records (such as generated receipts) — for the period required by UAE tax and commercial law;
• Audit and security logs — for a limited period appropriate to their purpose;
• Marketing preferences and cookie choices — until you change them or your account is closed;
• AI conversations — for the reasonable period needed to provide the feature and improve it, then deleted or aggregated.

We use encryption in transit, access controls, authentication (via Supabase Auth), database-level row security so users can only see the records they are entitled to, restricted staff access, audit logging and regular backups. No system is perfectly secure, so we do not promise that our safeguards cannot be defeated; we do commit to responding to incidents quickly and to notifying affected users and the competent UAE authority where the law requires it.

Subject to UAE law, you have the right to:

• Ask what personal information we hold about you and get a copy;
• Ask us to correct information that is inaccurate or incomplete;
• Ask us to delete your information where the law allows (see below);
• Object to, or restrict, processing based on legitimate interests;
• Withdraw consent you have given (this does not affect processing done before you withdrew);
• Opt out of marketing at any time from your notification preferences or the "unsubscribe" link at the bottom of marketing emails;
• Ask for a copy of information you gave us in a portable format, where technically possible.

To exercise any right, email privacy@govrum.com. We will respond within a reasonable time and may need to verify your identity first. Some requests may be limited where the law requires us to keep information (for example, for fraud prevention, tax or dispute records).

You can close your account from your account settings. When you close an account, we deactivate access and remove your profile from public view. Certain records associated with your account are kept in a restricted state for a limited time so we can meet legal, tax, accounting, dispute-resolution, fraud-prevention and audit obligations, and so that your booking counterparties still have a record of the transactions. Once those purposes are met, the information is deleted or fully anonymised.

Marketing messages (promotions, product updates, tips) are optional and are only sent to the channels you have enabled in your notification preferences. Transactional messages (booking updates, security alerts, receipts, invitation responses) are needed to run the service and are sent while you have an active account or booking, even if marketing is off.

The Platform is not intended for children. You must be at least 18 to create an account, consistent with UAE driving-licence eligibility. If you believe a child has created an account, please contact us at privacy@govrum.comand we will take appropriate action.

We use a small number of strictly necessary cookies and browser-storage keys to make the Platform work (for example, to keep you signed in). With your consent we also use functional and analytics cookies. Full detail, including how to change your choice at any time, is in our Cookie Policy.

We may update this Policy from time to time. When we do, we update the "Last updated" date at the top and, for material changes, notify active users by email or in-app notice before the change takes effect.

If you have a question about your privacy, email privacy@govrum.com. If you are not satisfied with our response, you may complain to the UAE Data Office or, where applicable, another competent supervisory authority.