Last updated: August 5, 2026 · Effective: August 5, 2026
This Privacy Policy explains how Exzato LLC (“Exzato,” “we,” “us,” “our”) collects, uses, shares, and protects your information when you use the Exzato website, mobile applications, and related services (the “Service”), which include a vehicle and auto-parts marketplace and social features (feed, posts, short videos, stories, groups, group chats, and direct messages). It is incorporated into our Terms of Service. The Service is offered in 49 U.S. states, excluding New York.
Account information: your email, username, profile photo, and profile details.
Identity-verification data: images of your government-issued ID and a selfie (sensitive — see Section 2).
Transaction & payment data: listings, bids, purchases, shipping details, and payments (processed by our payment provider, Stripe; we do not store full card numbers or bank credentials). Exzato Shop merchandise orders: when you buy merchandise through the Exzato Shop, we collect your delivery address, the items you ordered, and your order status; we share your name, delivery address, and email address with our print provider, Printful, solely so it can print and ship your order (Section 6). Feature and transaction records: saved searches and alerts you create; referral attribution when you join from a member’s invite link; ticket purchases for group events; and, when you use guided vehicle checkout, the generated sale documents, your drawn electronic signature with its signing details (date, time, and device and network information), and the walk-around inspection photos both parties submit, all kept as the record of that transaction. Engagement counts, such as reel view counts, are displayed publicly in the app. We also maintain aggregate, non-identifying daily platform statistics (for example total views and active users by state) to operate and improve features, including advertising placement. Advertising: Exzato Ads campaigns are targeted only by broad audience (a single state or nationwide) and by aggregate viewing patterns, never by selling or sharing your personal information with advertisers and never by building an individual advertising profile of you. Advertisers receive only aggregate, non-identifying performance figures (such as total views). We use the aggregate daily statistics described above to estimate a campaign’s likely reach and to measure its results.
User content: photos, videos, captions, listing details, posts, and the content of messages and direct messages you send through the Service.
Usage, device & analytics data: device type, OS and app version, crash logs, IP address, feature interactions, and device identifiers and device-fingerprinting signals (such as hardware and configuration characteristics), which we collect for fraud prevention and account security.
In-app interaction data (activity and interest data): to rank your feed and reels and to show you more relevant listings, we keep a record of your own activity on your account, collected for signed-in users. This covers how long you watch reels, how much of each one you watch, whether you watched with sound on, which ones you skipped past, and which ones you have already seen; which creators you watch most; the posts shown to you in your feed; the listings you open together with their make, model, year, approximate price range and category, and how long you spend on them; the listings you save; the searches you run and which result you tap; the browse filters you apply; and how many times and when you open the app. It is stored on your own account, only you and Exzato can read it, and it is kept in a bounded, rolling form rather than as a permanent log of everything you have ever done. We use it to personalize what you see and to improve search, recommendations and advertising placement. We do not use it to build an advertising profile of you, and we never sell it or share it with advertisers. You can turn personalization off in Settings, Privacy, under Personalized recommendations (Section 14). You can request this data’s deletion at any time, and deleting your account deletes it.
Aggregate engagement counts: we also keep non-identifying totals on the content itself, such as how many times a reel was viewed, shared or skipped and its average watch-through rate. These are counts across everyone, are not tied to any individual, and are used to rank content and to estimate advertising reach.
VIN queries: if you use VIN lookup features, the VIN you enter is processed against third-party vehicle-data sources to return vehicle information (Section 6); a VIN identifies a vehicle, not a person.
Location: approximate (city/state) location you provide for listings and proximity filtering, and coarse location inferred from IP; we do not continuously track precise GPS location.
Marketing list: if you opt in or create an account, your email may be added to our mailing list (Section 4).
To verify identity and age (18+), reduce fraud and impersonation, protect the marketplace, and meet legal and financial-compliance obligations, we collect images of your government-issued ID and a selfie, which we treat as sensitive personal information.
Alongside those photos, identity verification also collects structured fields you enter yourself: your full legal name, date of birth, driver licence number, issuing state, and licence expiry date. An Exzato reviewer cross-checks these fields against the photos before approving or declining a submission. These fields are retained on the same schedule as the verification images described below, and are used for the same purpose: confirming who you are.
How verification is performed, for everyone. Verification of every member, including a member who lists an item for sale or wants to RENT a vehicle, is performed solely by human review by authorized Exzato reviewers, and it costs nothing. For that review we do NOT use face-recognition or facial-geometry technology, we do not generate any biometric identifier or biometric information from your ID or selfie, and we do not use an algorithmic face-match vendor or any third-party identity-verification provider. A reviewer may compare your selfie to your ID photo by eye to confirm it is you; that is an ordinary human visual comparison, not an automated facial comparison, and it does not create or use facial-geometry data.
Illinois. When renter verification used to be performed by an automated third-party facial-geometry comparison, Illinois law required Exzato to skip that comparison for a licence issued by the State of Illinois. Verification is no longer performed that way for anyone. Every member, including a member with an Illinois licence, is now verified by the same human review described above, which does not create facial-geometry data for anyone in the first place.
Retention and destruction of biometric data. Exzato does not create, capture, collect, or possess biometric identifiers or biometric information from any member today, because verification is performed by human review rather than automated facial-geometry matching. Exzato expects to reintroduce an automated identity-verification step in a future release, paid for by Exzato rather than by any member; if and when that happens, any biometric data it creates would be retained under the relevant vendor’s own published schedule and destroyed when the purpose for collecting it has been satisfied or within three years of the member’s last interaction with Exzato, whichever occurs first, and this Policy will be updated first. We do not sell, lease, trade, or otherwise profit from biometric data, and we do not disclose it except as required to perform a verification, with the member’s consent, or where required by law or valid legal process.
We do not sell your biometric data or any other personal information.
Storage & retention. Verification images are transmitted over encrypted connections and stored in access-restricted systems available only to authorized reviewers and the systems needed to process verification. We retain verification images only as long as needed to complete and substantiate verification and to satisfy legal, fraud-prevention, and record-keeping obligations, and we delete or de-identify them when that purpose is satisfied or within the period required by applicable law, whichever is earlier. Some payment-related identity checks (for a connected seller payout account) may separately be performed by Stripe under Stripe’s own terms; that is not the identity verification described above. Ask about the status or deletion of your verification data at privacy@exzato.com.
Not run today. Exzato does not obtain a motor vehicle record or any other consumer report about a Renter today (Section 2.2). This section describes how that check would work, and collects the authorization for it now, so consent is already on file before Exzato ever runs one and a Renter knows what to expect if that changes.
If Exzato obtains a record. A motor vehicle record is a consumer report under the federal Fair Credit Reporting Act, and it would be obtained from a consumer reporting agency with the member’s written authorization, which is collected in the app now, before anything is requested.
What it would tell us and how we would use it. The record would tell us the status of the licence and any convictions, moving violations, and at-fault accidents within the lookback period. We would use it for one purpose only: deciding whether to approve that member to rent a vehicle. It would NOT be employment screening, and would not be obtained or used for any employment purpose. If we ever run it, we will record the outcome and the agency’s reference number so a decision can be traced and disputed, and we will not use it for advertising, profiling, or any unrelated purpose.
Driver’s Privacy Protection Act. Motor vehicle records are protected by the federal Driver’s Privacy Protection Act. If Exzato obtains one, it will be on the basis of the member’s written consent, which we record with a timestamp now, and we would not redisclose it except as that Act permits.
If a member is ever declined because of one. Where a member is declined wholly or partly because of information in a consumer report, we will send them a notice naming the consumer reporting agency that supplied it, with that agency’s address, telephone number, and website, stating that the agency did not make the decision and cannot explain it, and telling the member they may obtain a free copy of the report from that agency within 60 days and dispute its accuracy or completeness with the agency. We will keep a record that the notice was sent.
Retention. Trip and screening records are retained for the period required by applicable peer-to-peer car sharing law, which is generally at least six years, so that they can be produced if a claim or dispute arises.
When you create an account and when you book, you authorise us to obtain consumer reports and related information about you where the law permits: your motor vehicle record, an auto insurance risk or loss-history score, a credit report or credit-based insurance score, and a criminal background check. We use them for ONE purpose, which is deciding whether to approve you to rent or list a vehicle and managing that decision afterwards.
Today we run identity verification only, performed by Exzato staff and free of charge. We do not currently obtain motor vehicle records, credit reports, insurance scores, or criminal background checks. We collect the authorisation now so that we are not asking you again later, and because a consumer report may not lawfully be obtained without it. For every booking we record which checks were and were not performed, so our records never claim more than we did.
What we will never do with it. We do not use any of this for lending decisions, employment decisions, underwriting an insurance policy on you personally, advertising, or profiling unrelated to renting. We do not sell it. Where a check is a consumer report and we decline you wholly or partly because of it, you receive the notice described in Section 2.1.
Withdrawing it. The authorisation lasts while your account is open. You may withdraw it by closing your account, which also ends your ability to rent or host. Records we are required to keep under peer-to-peer car sharing law survive account closure for the period that law requires.
• Create and manage your account; process transactions, payouts, and the security deposit (via our payment providers).
• Display listings, match buyers and sellers, and facilitate payments and fund holding/release.
• Verify a renter’s identity by human review, at no cost to the renter, before approving them to rent a vehicle, and review their driving record if Exzato begins obtaining one (Sections 2 and 2.1).
• Verify identity and age and detect and prevent fraud, abuse, and prohibited listings, including by using device identifiers and device-fingerprinting signals to protect accounts and the marketplace.
• Personalize the content shown to signed-in users based on in-app interaction data (e.g., content viewing activity).
• Send transactional notifications about bids, listing outcomes, messages, payments, disputes, and account activity.
• Resolve disputes between buyers and sellers.
• Send marketing communications you can opt out of at any time (Section 4).
• Maintain, secure, and improve the Service using analytics, collecting only what is reasonably necessary (data minimization).
We may send marketing emails about features, listings, and promotions, and we comply with the federal CAN-SPAM Act: every marketing email is identifiable as an advertisement, uses accurate headers and non-deceptive subject lines, includes a working unsubscribe mechanism and our valid physical postal address, and we honor opt-out requests within 10 business days. You may also opt out at support@exzato.com. Opting out of marketing does not stop transactional or service messages necessary to operate your account.
We send transactional and service messages (bids, payments, disputes, security) by email, in-app, and push notification as needed to operate your account. Where we send marketing push notifications, we do so consistent with applicable consent requirements, and you can opt out of marketing messages without affecting service messages.
Firebase (Google): authentication, database, file storage, hosting, push notifications, and analytics.
Stripe, Inc.: payment processing, payouts, fund holding and release, and certain identity/financial-compliance checks. For Stripe-processed sales, sale proceeds are held in the seller’s own connected Stripe account and released at Exzato’s direction; Exzato does not hold user funds in its own accounts.
Apple App Store & Google Play billing: optional paid listing promotions (“boosts”) and any membership purchased in the mobile app are processed through Apple or Google in-app billing. Apple or Google handles the payment and provides Exzato with a purchase confirmation and transaction identifier so we can apply your purchase; Exzato does not receive your card number or full payment details. Apple’s and Google’s own privacy policies apply to the payment they process.
Printful, Inc.: printing and shipping of Exzato Shop merchandise orders. When you place an order in the Exzato Shop, we share the recipient’s name, delivery address, and email address with Printful, solely so it can print and ship that order. Printful does not receive your payment details; card payment is handled directly by Stripe.
Vehicle-data providers: when you use VIN lookup features, the VIN you enter is processed against third-party vehicle-data sources (e.g., the U.S. National Highway Traffic Safety Administration (NHTSA) and, where available, NMVTIS-based or other commercial providers) to return vehicle information; VIN queries are sent without your personal identifiers.
Google reCAPTCHA: our website uses reCAPTCHA to protect sign-up and other web flows from abuse; reCAPTCHA collects hardware and software information and sends it to Google for analysis. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Nominatim / OpenStreetMap: city-level location search (queries sent without personal identifiers).
We share only what is needed for these providers to perform their function; their own terms apply to services they provide as independent controllers.
We share information: with other users as needed for the marketplace (your username and profile photo are visible to signed-in users; listing and transaction details are shared with your counterparty); with service providers (Section 6); when required by law, subpoena, or court order, or to protect rights, property, or safety; and in connection with a merger, acquisition, financing, or sale of assets, with notice as required by law.
We do NOT sell your personal information or biometric data for money, and we do not use your personal information for cross-context behavioral or targeted advertising. To the extent any analytics integration is deemed a “sale” or “targeted advertising” under a state law, we provide a way to opt out at privacy@exzato.com or through in-app privacy settings, and we honor recognized universal opt-out signals where required.
We keep information while your account is active or as needed to provide the Service. Transaction and financial records may be retained up to 7 years for tax, accounting, and legal obligations. Identity-verification data is retained per Section 2. When data is no longer needed, we delete or de-identify it.
We use industry-standard safeguards, including encrypted connections, Firebase Authentication, server-side security rules, access-restricted storage, and Stripe’s PCI-DSS-compliant infrastructure. No system is perfectly secure; use a strong, unique password and report suspected unauthorized access to security@exzato.com. If a data breach affecting your personal information occurs, we will notify affected users and authorities as required by applicable state breach-notification laws.
Depending on your state of residence, you may have the right to access, correct, delete, and obtain a portable copy of your personal data; to opt out of targeted advertising, any “sale,” and certain profiling; and to opt out of marketing. To exercise these rights, contact privacy@exzato.com; we will respond within 45 days (extendable as permitted) and within any period required by law, and you may appeal a denial by replying to our response. We will not discriminate against you for exercising your rights. We honor recognized universal opt-out preference signals where required by law.
You can close your account at any time (Settings → account closure) or at support@exzato.com. On closure we delete or de-identify your personal data, except information we must retain for legal, tax, fraud-prevention, dispute-resolution, or financial-compliance reasons (e.g., transaction records under Section 8). Content you shared publicly or with other users may persist where required for those users’ records or by law.
The Service is intended only for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we enforce an age gate at registration. If we learn we have collected data from a minor, we will delete it promptly.
Renting a car through Exzato involves data we do not collect anywhere else, so it is set out separately here.
If you rent a car. We read the barcode on the back of your driver licence to confirm it is valid and current. From that barcode we keep your name, address, licence number, issuing state, date of birth and expiry date, because the peer-to-peer car sharing laws require a platform to record them. We do not take a photograph of your face, do not perform face matching, and do not collect or store any biometric identifier. We do not keep the raw barcode, which also carries height, weight and eye colour that we have no reason to hold.
We also record the trip itself: the vehicle, the start and end times, the pickup and return locations, the odometer readings, and the amounts charged. We do not track the vehicle’s location during your trip and Exzato installs no telematics device.
Condition photos. Before and after a trip, either the host or the renter may record a guided set of condition photos and video showing the front, rear, both sides, the interior, and the dashboard, along with the odometer reading and fuel level. Once submitted, a condition photo set cannot be changed or replaced by anyone, including the person who took it. Each set is time-stamped by our servers rather than the phone that took it, and records who submitted it and whether they were the host or the renter. We keep these photos as evidence for six years, the same period we keep other trip records, and we show them to the other party to the trip so a pickup photo can be compared against a return photo. If a claim is filed, we may also show them to the insurance carrier reviewing that claim.
If you host a car. We keep your vehicle details including the VIN, the address where the vehicle is picked up, and your insurance certificate with its carrier, policy number and expiry date. The VIN is sent to the federal safety recall database, which returns recall information about that make, model and year. Your insurance certificate is stored where only you and Exzato can read it, and is never shown to renters or made public.
Who we share it with. The other party to a booking sees what they need to complete it, which is your first name, your profile photo, and the trip details. They never see your licence number, your date of birth, your home address, or another person’s insurance document. Your identity and driving-record screening outcome, such as whether you are approved to rent, is visible only to you and to Exzato staff who administer that decision, and is never shown to the other party to a booking or to any other member. We share trip records with insurers and with state agencies where a car sharing law requires it, and with our payment provider to take payment. If you or the other party disputes a charge or raises a claim, the description and evidence you submit becomes part of a dispute record, which we may share with the insurance carrier investigating that claim.
How long we keep it. Trip and driver records are kept for six years, because the car sharing laws require it. That is longer than we keep most data, and it means a rental record survives deleting your account, in the same way a completed sale does. Insurance certificates are deleted a year after the listing is removed.
We use automation in three places, and nowhere else. We are describing each one precisely rather than saying “we use AI” and leaving you to guess.
Support chat. When you message support, an assistant powered by Google Gemini replies first. What we send to Google is the text of that support conversation and nothing else. We do not send your name, your email address, your listings, your payment details or your browsing history. The assistant is blocked from revealing account data, and you can ask for a human at any time, which hands the ticket to our team immediately. It also escalates on its own when it cannot help.
Ranking your feed, reels and marketplace. We order what you see using your own activity: which reels you watch and for how long, what you skip, whose posts you watch most, and which listings you open, save or search for, including their make, model, year and price range. This decides order only. It never decides who may buy, sell, bid, or hold an account. You can turn it off in Settings, Privacy, under Personalized recommendations, and your feed then runs on recency and popularity alone.
Advertising. Exzato Ads are targeted by state and by the kind of content you engage with on Exzato. We do not use third-party tracking, we do not follow you across other apps or websites, and we do not sell your data to advertisers.
What we do not do. No automated system suspends, bans, or restricts an account on its own, and none decides a dispute. A person at Exzato reviews those. Identity verification is reviewed by a human, as described above.
We may update this Policy. For material changes we will notify you via in-app notice or email and update the “Last updated” date above; your continued use after the effective date constitutes acceptance.
Exzato LLC
421 West Broadway, Ste 302 #847
Council Bluffs, Iowa 51503, USA
Privacy requests: privacy@exzato.com
General: support@exzato.com