Privacy Policy

Effective date: May 13, 2026

Aurum Holdings ("Aurum," "we," "us") operates the Aurum Exotic software platform and associated services (the "Service"). This Privacy Policy describes how we collect, use, and disclose information when you use the Service or interact with us.

1. Who this policy applies to

This policy applies to two groups:

• Operators — vehicle rental businesses that license the Service to manage their fleets, bookings, and customers.
• Renters — end customers of those operators who book or rent vehicles through operator-branded storefronts powered by the Service.

Operators are the "data controllers" of Renter information; Aurum acts as a "data processor" on the Operator's behalf for that information.

2. Information we collect

We collect:

• Account information — name, email address, phone number, business name, business address, and similar details you provide when signing up.
• Booking and rental information — vehicle selections, rental dates, pricing, agreements, damage inspections, vehicle telemetry where consented.
• Payment metadata — payment status, amount, and last 4 of card. Full card numbers are handled by Stripe and never touch Aurum servers.
• Identity verification data — where KYC is required by Operators, government-ID images and verification results from our identity verification provider, retained per applicable law.
• Usage and device information — IP address, browser type, pages visited, actions taken, and similar analytics.
• Communications — messages exchanged with our support, Operator-customer chat history, and feedback you provide.

3. How we use information

We use the information to:

• Provide, maintain, and improve the Service;
• Process bookings, payments, and refunds;
• Verify identity where required;
• Communicate about your account, bookings, and service updates;
• Detect, prevent, and address fraud, abuse, or security issues;
• Comply with legal obligations;
• Generate aggregated, de-identified statistics about platform usage.

4. Third-party service providers

We share information with third-party service providers strictly to operate the Service:

Each provider is contractually obligated to protect the data they receive and to use it only as needed to deliver their service. We do not sell personal information.

5. Data retention

We retain information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, and audit obligations. Booking records and financial transactions are retained for at least seven years. Identity verification records are retained for the period required by applicable law.

6. Security

We use industry-standard administrative, technical, and physical safeguards to protect information, including encryption in transit (TLS 1.2+) and at rest, role-based access controls, and audit logging. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of personal information, and to receive a copy of your data in a portable format. To exercise these rights, email dev@aurumexotic.com. We will respond within the time required by applicable law (generally 30 days for US residents; 30 days for EU residents under GDPR where applicable).

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we collect and the right to opt out of any "sale" of personal information. We do not sell personal information.

8. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

9. International transfers

The Service is hosted in the United States. If you access the Service from outside the US, you understand that information will be transferred to and processed in the US, which may have data-protection laws different from those in your country.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice and become effective 30 days after notice unless a different effective date is specified.

11. Contact

For questions or data-rights requests, email dev@aurumexotic.com or write to:

Aurum Holdings
1951 E Dyer Rd, PH 577
Santa Ana, CA 92705
United States