Privacy Policy

TougeX ("TougeX," "we," "us," or "our") is a platform for automotive enthusiasts to manage their vehicles, document builds, and connect with a community. TougeX is operated by DriverNation DBA TougeX, a Delaware corporation, with operations based in New York, USA and Ontario, Canada.

This Privacy Policy explains what personal information we collect, how we use it, how we share it, how we protect it, and the rights and choices you have. It applies to your use of the TougeX website, applications, and services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.

We use your information to:

• //Provide, operate, and maintain the Service (including your garage, build records, and profile).
• //Authenticate you and keep your account secure.
• //Enrich vehicle data you provide (e.g. VIN decoding).
• //Process transactions and manage subscriptions and credits (when paid features are enabled).
• //Perform identity verification you request.
• //Communicate with you about your account, updates, security notices, and (where you have opted in) product news.
• //Understand how the Service is used and improve it.
• //Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• //Comply with legal obligations.

We rely on the following legal bases where applicable (e.g. for users subject to GDPR): performance of a contract (providing the Service), your consent (e.g. optional communications, optional location features), our legitimate interests (securing and improving the Service), and compliance with legal obligations.

We do not sell your personal information. We share information only as follows:

• //Public content you choose to share: information you mark as public — such as public build pages, public profile details, and public badges — is visible to others by design. You control what is public through your privacy settings. By default, sensitive details are private.
• //Service providers: we share information with vendors who perform services on our behalf, under contractual confidentiality and data-protection obligations, including: hosting and infrastructure (Vercel; Neon, our database provider; Cloudflare R2, our media storage provider); payment processing (Stripe, when paid features are enabled); identity verification (Stripe Identity, only if you request verification); email/communications (Resend); and vehicle data (VIN-decoding services such as the U.S. NHTSA vPIC service).
• //Legal and safety: we may disclose information if required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of TougeX, our users, or the public, or to detect and address fraud or security issues.
• //Business transfers: if TougeX is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction; we will provide notice as required by law.
• //With your consent: in other cases where you direct or permit us to share.

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• //Access — request a copy of the personal information we hold about you.
• //Correction — request that we correct inaccurate information.
• //Deletion — request that we delete your personal information (subject to legal retention obligations). You can delete your account, which removes associated personal data as described in Section 7.
• //Portability — request your information in a portable format.
• //Objection/restriction — object to or ask us to restrict certain processing.
• //Withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect prior processing).
• //Non-discrimination — we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at privacy@drivernation.us. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

Region-specific notes:

• //Canada (PIPEDA / Québec Law 25): you have rights of access and correction, and we handle personal information in accordance with applicable Canadian privacy law. Our privacy officer can be reached at privacy@drivernation.us.
• //California (CCPA/CPRA):you have rights to know, delete, correct, and opt out of "sale"/"sharing" (we do not sell personal information). You may exercise these rights via privacy@drivernation.us.
• //EEA/UK (GDPR/UK GDPR): if applicable, you have the rights above and may lodge a complaint with your supervisory authority.

We implement technical and organizational measures designed to protect your information, including encryption in transit, hashing of passwords, encryption of sensitive secrets at rest, access controls, audit logging of administrative access, and stripping of location metadata from uploaded images. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where retention is required by law (for example, transaction records may be retained as required for tax, accounting, or legal purposes). Certain records maintained for integrity and security purposes (such as administrative audit logs) may be retained as necessary.

We use cookies and similar technologies for:

• //Essential/authentication: to sign you in and keep your session secure (these are necessary for the Service to function).
• //Preferences: to remember your settings.
• //Analytics: to understand usage and improve the Service.

You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning properly.

The Service is not directed to children under 13 (or the higher age required in your jurisdiction), and we do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us at cs@drivernation.us and we will take appropriate steps to delete it.

TougeX operates from New York, USA and Ontario, Canada and uses service providers that may store or process data in the United States, Canada, and elsewhere. If you access the Service from another country, your information may be transferred to, stored, and processed in countries with different data-protection laws. Where required, we use appropriate safeguards for such transfers.

The Service may link to or integrate third-party sites and services. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review their policies before providing information.

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, for material changes, provide additional notice (for example, by email or in-app notice) where required. Your continued use of the Service after changes take effect constitutes acceptance.

If you have questions or requests regarding this Policy or your personal information, contact us at:

DriverNation DBA TougeX
695 Washington St, Suite 1586, New York, NY 14203
Email: privacy@drivernation.us