Privacy Policy

Effective 8 October 2026 · Version privacy-v5-2026

This policy explains what personal information EV-Solutions LLC d/b/a Atrium Car Rentals ("Atrium", "we", "us") collects about you, why we collect it, who else sees it, how long we keep it, and what you can ask us to do about it. It covers our website at driveatrium.com, our booking and driver portal, and the rentals themselves — including the data the vehicle records while you have it.

EV-Solutions LLC d/b/a Atrium Car Rentals is the business that decides how and why your information is used — the controller of it. Our address is 488 N 900 E, Provo, UT 84606. You can reach us at info@driveatrium.com or (385) 204-4272.

We have written this in plain language on purpose. If something here is unclear, email us and we will explain it.

1. The short version

We collect what we need to decide whether you can rent, to run the rental, to bill you, to keep you and the vehicle safe, and to satisfy our insurers and the law.
The vehicle records data while you have it — location, mileage, charge, speed and driving events, diagnostics. That is how mileage is measured and how rideshare miles are separated from personal miles for insurance.
We do not routinely receive or review cabin-camera footage. See section 3.
We do not sell your personal information. Our website does carry advertising tags, which some state laws treat as "sharing" — section 10 tells you how to opt out.
You can ask us what we hold, ask for a copy, ask us to correct it, or ask us to delete it. Email info@driveatrium.com.

2. What we collect about you

Not everyone gives us all of this. What we hold depends on how far you get: a visitor to the website gives us far less than a renter with a signed agreement.

Applicant information — name, date of birth, email, phone, home address, the platforms you drive on, how you heard about us, and anything else you type into an application or waitlist form.
Renter information — the vehicle assigned to you, rental dates, elections and add-ons, deposit, and the account history that follows from those.
Driver-licence information — licence number, state, class, expiry, and images of the licence itself.
Insurance information — your insurer, policy number, coverage limits, effective dates, and images of certificates and declaration pages.
Verification information — proof of address, a selfie or liveness check where used, phone verification codes, and the records showing when and how each check was completed.
Consumer-report information — motor vehicle records and background-check results obtained through a consumer reporting agency, and the eligibility decision made from them. See section 5.
Payment information — card type and the last four digits, billing address, payment and refund history, invoices, and amounts owed. We do not hold your full card number. Our payment processor does.
Rental information — condition-check photos and videos at pickup, return and periodic checks, your own damage declarations, odometer and charge readings at handover, fuel and charging, tolls, citations, and damage or claim records.
Support information — the things you tell us when you call, text, email, or use a form, and our notes about them.
Dispute information — anything relating to a chargeback, insurance claim, collection, or legal matter, including the evidence supporting a charge.
Communications — emails we send and their delivery status, SMS we send and receive, your consent choices, and the record of when you gave or withdrew them.
Messenger and Instagram conversations — the platform identifier associated with your conversation, messages you send us, our replies, delivery and read events, requests to stop messages, and questions saved for staff review. See section 12A for our virtual assistant.
Website and device information — IP address, browser and device type, pages visited, referring page, and similar diagnostic data, including from the advertising tags described in section 9.

3. Vehicle data

Our Teslas (Model 3 and Model Y) report through the Tesla API using a telematics service, Teslemetry. Our Toyota Camry Hybrid, and any vehicle fitted with an aftermarket telematics device, report the same kinds of data through that device — we use Samsara hardware for this, and as of the effective date of this policy no Samsara device is installed in the fleet. The categories are:

Location data — GPS position of the vehicle, and whether it is inside the agreed operating territory.
Odometer data — mileage readings, which is how mileage allowances and any excess-mileage charge are measured.
Charging data — state of charge, and charging sessions including where, when, and how much.
Diagnostic data — vehicle health, service and fault alerts, tire pressure, 12V battery status, software state.
Speed and vehicle-event data — speed patterns, and events such as hard braking or an airbag deployment.
Platform trip data — where you connect an Uber, Lyft, or DoorDash account through Argyle, the trip and earnings records that connection provides. This is a separate permission you grant and can withdraw at any time; withdrawing it stops new data flowing but does not delete what we already hold.
Camera, Sentry Mode, and cabin-camera data, to the extent it is collected, accessible, downloaded, or disclosed to us — see immediately below.

The honest statement about cameras

Teslas ship from the factory with a cabin camera above the rear-view mirror and exterior cameras that can record through Sentry Mode and Dashcam.

Atrium does not routinely receive or review cabin-camera footage. We do not stream it, we do not pull it as part of normal fleet operations, and it is not used to bill you or to monitor you while you drive. Where footage — cabin, Sentry, or Dashcam — is in fact collected, accessible, downloaded, or disclosed to us, this policy covers it: it is treated as incident material, used only for the incident that caused us to obtain it, and not browsed.

A short, plain-language summary of all of this, which your rental agreement cross-references, is on our Vehicle Data Notice.

4. Why we use it

Eligibility — deciding whether we can rent to you, and on what terms.
Performing the rental — assigning a vehicle, handover and return, extensions, condition checks, and communicating with you about your rental.
Safety — responding to accidents, breakdowns, and roadside events, and enforcing the safety terms of the agreement.
Maintenance — service scheduling, recalls, diagnostics, and keeping the fleet roadworthy.
Billing — rent, deposits, taxes, mileage, charging, tolls, citations, damage, and collections.
Insurance — administration of our policies, underwriting and renewal submissions, reporting rideshare versus personal mileage, and handling claims.
Fraud prevention — identity verification, detecting misuse of the vehicle or of a payment method.
Recovery — locating and recovering a vehicle where the agreement and the law permit it.
Legal compliance — tax and accounting records, licensing, responding to lawful requests, and record-keeping the law requires of us.
Dispute resolution — defending or resolving a chargeback, claim, complaint, or legal proceeding.

We also use aggregated or de-identified data — fleet-level mileage, utilisation, and safety statistics — to run the business and to answer our insurers. That data does not identify you.

5. Who we share it with

We share personal information only with these categories of recipient, and only as much as each needs:

Payment processors — Stripe holds and processes card details; QuickBooks holds invoices and accounting records.
Screening vendors — SambaSafety (consumer reports furnished by Safety Holdings, Inc.) for motor vehicle records and background checks. Continuous MVR monitoring is planned but is not running as of the effective date of this policy. Our standalone Disclosure Regarding Consumer Reports explains this under the Fair Credit Reporting Act.
Connected-data vendors — Argyle, for the gig-platform trip and earnings data you separately permit.
Telematics and fleet vendors — Teslemetry and Tesla, and Samsara where a device is fitted.
Insurers and brokers — including HUB International and Y-Risk, for underwriting, renewal, and claims.
Repair and recovery providers — body shops, service centres, tire and glass vendors, roadside assistance, and licensed recovery agents.
Professional advisers — lawyers, accountants, and auditors, under a duty of confidence.
Technology providers who run our systems — Netlify (hosting), Supabase (database and document storage), Resend (email delivery), Twilio (SMS). They process data on our instructions.
Messaging and AI providers — Meta provides Messenger and Instagram. When our virtual assistant is enabled, we send recent conversation text to OpenAI to help select a response to your question. See section 12A.
Law enforcement and government — where the law permits or requires it, including in response to a subpoena, warrant, or a genuine emergency involving a risk to life.
A buyer or successor — if the business or its assets are sold, merged, or reorganised, your information may transfer with it, subject to this policy.

We do not sell your personal information, and we do not share vehicle data or gig-platform data with advertisers.

6. How long we keep it

Retention depends on the category:

Signed agreements and billing records — kept for at least 7 years after the rental ends, for tax, accounting, insurance, and limitations-period reasons.
Telematics supporting a charge on your account — kept for the duration of the rental plus the applicable limitations period, and longer for as long as a dispute, claim, or investigation is open or reasonably anticipated.
Other telematics not tied to a charge — kept for the duration of the rental and afterwards only so long as insurance, safety, tax, or legal needs require.
Driver-licence images — kept for the rental plus 3 years, unless a law, insurer requirement, claim, or legal hold requires us to keep them longer.
Camera footage (cabin, Sentry, Dashcam) — not retained unless an incident occurs. Where an incident does occur, the footage relating to it is kept for that incident and under any applicable litigation hold, then deleted.
Consumer reports — kept as long as the Fair Credit Reporting Act and our insurers require, and then disposed of securely.
Application records where no rental followed — kept for the period needed to show why a decision was made, then deleted.
Communications and consent records — kept for as long as needed to prove what you consented to and when, which for SMS and e-signature consent means at least the limitations period.
Website and advertising data — kept according to the retention periods of the advertising platforms described in section 9.

7. How we protect it

Encryption in transit. The website, the portal, and every function are served over HTTPS/TLS.
Access control on the database. Renter data lives in a Postgres database with row-level security. Anonymous pages cannot read or write other people's rows; privileged writes go through server-side functions.
Documents in restricted storage. Licence images, insurance certificates, and signed documents are held in access-controlled storage buckets, not on the public web.
Signed, expiring links. Links that expose account or financial information carry a cryptographically signed token that is verified with a timing-safe comparison. A link without a valid token does not get financial data.
Card data stays with the processor. We hold card brand and last four digits only; the full number never touches our systems.
Secrets are not in the codebase. API keys live in the hosting platform's environment configuration.
Least privilege. Admin tools are limited to Atrium staff who need them, and access is logged.
A human gate on anything adverse. Automated jobs report to a person and stop; no automated process takes an action against a renter on its own.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and any regulator as the law requires.

8. Your rights, and how to use them

Depending on where you live, you may have the right to:

know what personal information we hold about you and why;
get a copy of it, in a portable format where that applies;
correct information that is wrong;
have information deleted, where we are not required to keep it;
opt out of targeted advertising, of the "sale" or "sharing" of your information, and of profiling that produces legal or similarly significant effects;
appeal a decision we make about a request; and
not be discriminated against for exercising any of these rights — we will not refuse to rent to you, charge you more, or give you a worse service because you made a request.

How to make a request: email info@driveatrium.com with the subject line "Privacy Request" and tell us what you want. You can also text (385) 204-4272. We will verify your identity before acting — usually by confirming details already on your account, and for a copy request by confirming control of the email address or phone number on file. We respond within 45 days, and will tell you if we need a permitted extension.

An authorised agent may make a request for you if you give them written permission and we can verify it.

State-specific rights. Several states — including Utah under the Utah Consumer Privacy Act, and California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana and others under their own laws — give residents specific versions of the rights above, sometimes with different deadlines, a right of appeal, or different limits. Which of them apply to you depends on your state of residence and on the law's own thresholds. Tell us your state when you write to us and we will apply the rights you actually have. If we deny a request and your state gives you a right of appeal, we will tell you how to appeal and how to contact your state attorney general.

Consumer-report rights are separate and come from the Fair Credit Reporting Act: you may request a copy of any consumer report we obtained about you, and dispute its accuracy with the consumer reporting agency. See our Disclosure Regarding Consumer Reports.

9. Advertising, cookies, and online tracking

Our public website pages carry two advertising tags: the Meta (Facebook) Pixel and a Google Ads tag. They are used to measure how our ads perform and to show Atrium ads to people who have visited the site. On most pages they start after the page has loaded or on your first interaction. One older Learn article loads them as the page opens, and on the short return from an application-fee payment described below they load straight away.

Where they run. On the homepage, the booking page, the pricing, vehicle and location pages, our other information pages (such as How It Works, FAQ, Reviews, About and Contact), the Learn articles, and three legal pages: this policy, the Terms of Service, and the Damage Schedule. They are not on the driver portal, the document-upload or inspection pages, the signing and payment-authorization pages, or Atrium's staff pages.
What the Google Ads tag reports. Page views, with standard device and browser information, and two kinds of response to our ads: a submitted booking request and a paid application fee. For ad reporting we value a booking request at $10 and a paid application fee at $15. Those figures are our own way of comparing ads, not amounts anyone is charged. A booking request is reported with our reference number for it, and a paid fee with Stripe's reference for that checkout session, so a retry or a reloaded page is counted once.
The application-fee return. When you pay the application fee, Stripe sends you back to our booking page for up to three seconds. That page reports the paid fee to Google, then takes you on to your driver account. Before either tag loads, it removes the payment reference from its own web address, so Meta's pixel never receives it and Google receives it only as the reference on the reported fee. Opening the payment page is not reported; only the return from a completed payment is.
What we do not send. We do not send Google or Meta your name, email address, or phone number, in plain or hashed form, or your licence details, vehicle data, or card details. The Meta Pixel records page views, with the standard device, browser and page information that comes with each one; we send it no booking, call, or payment events. We also switch off Meta's automatic event setup, which would otherwise report button clicks and details read from the page, on every page except that one older Learn article.
Cookies the tags set. Google's tag sets its own cookies in your browser so it can tell that a visit came from a Google ad and connect a later booking request or paid fee to that ad. Meta's pixel sets its own cookie for the same purpose for Meta ads. Google and Meta decide how long those cookies last.
Where you came from. If the link that brought you to one of the pages listed above carries an ad click identifier or campaign labels, that page notes them in your browser's session storage for that tab, where they stay until you close the tab. Only the first such link in a tab is kept, and that one older Learn article does not do this. The Book, Apply Now and assistant forms use the current page address or that saved landing information. If neither names a source, the form reads the click identifier from Google's or Meta's own cookie, if available (the more recent one, if both are there). In your browser, this becomes a single label such as "Google Ads", "Meta Ads", a campaign name or a referral category. These forms send and save only that label with your request, including with your contact details if you leave the booking form part-way through. Older reservation forms may send attribution to our server to reduce to the same label. Our lead records do not keep the click identifier itself.
Your saved request in this tab. Book, Apply Now and the assistant keep your form answers, name, email, phone number, conversation when used, request reference and a limited request-recovery credential in your browser's session storage for that tab. This lets the site retry an interrupted save, restore your progress or show the confirmed receipt without sending a duplicate request. The copy remains after a confirmed save while the tab is open; starting a separate request may also keep the previous request for recovery in that tab. Your browser discards this session copy when you close the tab. It does not contain identity documents, card details or account passwords. If session storage is blocked, the form uses memory for the open page and tells you that reloading or closing it will lose local recovery.
What we do not run. We do not use Google Analytics, Google Tag Manager, or any session-recording, heat-mapping, or behavioural-analytics tool on this website.
No cookie banner. This site does not currently display a cookie consent banner, so the controls below are how you opt out.
How to opt out. Use Google Ads Settings, your Meta account's Ad Preferences, the Digital Advertising Alliance at aboutads.info/choices, or the Network Advertising Initiative at optout.networkadvertising.org. You can also block or delete cookies in your browser settings, or use a browser that blocks these tags. Or email us and we will process an opt-out for you.

Cookies and similar technologies are also used for things the site cannot work without — keeping you signed in to the portal, and remembering a form in progress. Blocking those will break parts of the portal.

10. Do Not Sell or Share My Personal Information

We do not sell your personal information for money. However, the advertising tags described in section 9 may be treated as a "sale" or as "sharing for cross-context behavioural advertising" under some state privacy laws. If you want that stopped:

Use the opt-out controls listed in section 9, which stop the tags at the browser level; or
Email info@driveatrium.com with the subject line "Do Not Sell or Share" and we will process your request; or
Global Privacy Control (GPC): our website does not yet read browser GPC signals automatically. To opt out, use the Meta and Google controls above or email us at info@driveatrium.com and we will honor the request; email also lets us remove data already collected where the law allows.

We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16.

11. Text messages

Consent to rental and account texts and consent to marketing texts are two separate choices, recorded separately. Marketing consent is never a condition of renting from us. You can make or change your choices at our text message consent page.

Message frequency varies. Msg & data rates may apply. Reply STOP to any message to opt out — you will get one confirmation and then nothing further — or HELP for help. You can also email info@driveatrium.com or text (385) 204-4272.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are excluded from every category of sharing described in this policy; that information is not shared with anyone, and is disclosed only to the messaging provider that delivers the message on our behalf.

12. Email

When you apply or join a waitlist we send a confirmation and may send a short series of follow-ups about your application. Every marketing or follow-up email carries a working unsubscribe link. Transactional email about an active rental — a receipt, a service notice, a document to sign — is part of the rental and continues regardless.

12A. Messenger, Instagram, and our virtual assistant

When enabled, our virtual assistant identifies itself as an AI or virtual assistant and can answer routine rental questions using Atrium's approved information. Recent conversation text is sent to OpenAI to help choose a response. Messages can include personal information you choose to share. Atrium stores the conversation, replies, message status and questions needing review so authorized staff can help you and follow up on the conversation.

Questions the assistant cannot answer are saved for staff review, and automated replies pause. You can ask for a person or tell us to stop messages. The assistant does not approve a rental, reserve a vehicle, sign an agreement or charge a payment. Use your secure account for onboarding; do not send identity documents, card details, passwords or verification codes in a social-media message.

To request access to or deletion of your Messenger or Instagram conversation records, email info@driveatrium.com with the subject "Privacy Request". Tell us which platform you used and enough information to locate the conversation, such as your username and approximate message date. We will verify your identity before acting. The retention and request conditions in sections 6 and 8 apply; asking the assistant to stop messages does not itself delete existing records.

13. Children

Our service is for licensed drivers aged 25 and over. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email info@driveatrium.com and we will delete it.

14. Other websites

Our site links to sites we do not operate — rideshare platforms, our vendors, and government pages. We are not responsible for their content or their privacy practices. Read their policies before giving them information.

15. Changes to this policy

If we change this policy we will post the new version here, update the effective date and the version string at the top of the page, and — where the change is material — tell active renters by email. Changes take effect when posted. The version in force for a signed rental is the one in effect on the date it was signed.

16. Contact us

Legal entity: EV-Solutions LLC d/b/a Atrium Car Rentals
Address: 488 N 900 E, Provo, UT 84606
Email: info@driveatrium.com
Phone: (385) 204-4272

Version privacy-v5-2026 · Effective 8 October 2026