Privacy Policy

Overview

This Privacy Policy explains how MyClienta — RentingPilot ("RentingPilot", "we", "us") collects, uses, stores, and protects personal data when rental shop owners, staff, and customers use the RentingPilot website, dashboard, booking pages, Cara chat, voice features, WhatsApp flows, and related services.

RentingPilot is built for EU rental businesses and is operated with GDPR principles in mind: collect only what is needed, keep it secure, explain what happens, and give people practical control over their data.

Data we collect

• Account data: owner name, email, phone, password hash, shop name, preferred language, plan, and dashboard settings.
• Business data: website URL, scraped shop details, fleet data, car photos, prices, locations, opening hours, and booking rules.
• Customer booking data: customer name, phone, email when provided, requested car, dates, pickup location, chat messages, and booking status.
• Driver verification data: driver name, date of birth, license number, and front/back driving license photos uploaded for a booking.
• Payment data: Stripe customer, subscription, invoice, and payment status. We do not store card numbers.
• Usage and device data: pages visited, feature actions, browser/device details, IP address, logs, and security events.
• Communications: support emails, transactional emails, WhatsApp messages, Cara chat transcripts, and voice/TTS requests where needed to deliver the service.

How we use data

• To create and manage owner accounts, dashboards, public booking pages, and marketplace listings.
• To import rental shop data from a website and pre-fill the owner's setup flow.
• To let Cara answer customer questions, capture bookings, and send booking notifications.
• To process subscriptions, invoices, plan limits, refunds, and billing support through Stripe.
• To send transactional emails, onboarding emails, security notices, and owner alerts.
• To secure the platform, prevent abuse, debug errors, and improve reliability.
• To comply with tax, accounting, legal, and regulatory obligations.

Service providers

We use trusted providers to run RentingPilot. They process data only for the purposes needed to deliver the service.

• Cloudflare: hosting, Workers, Pages, D1 database, R2 object storage for license photos, security, CDN, and logs.
• Hetzner: EU-hosted infrastructure for the Lead Engine scraper and supporting services.
• Stripe: payments, subscriptions, invoices, and billing records.
• Twilio: WhatsApp and SMS infrastructure where enabled.
• Meta WhatsApp: WhatsApp Business messaging delivery where enabled.
• Cartesia: text-to-speech and voice previews where enabled.
• Resend: transactional, onboarding, and support emails.
• OpenStreetMap/Photon: address and location suggestions.

We do not sell personal data.

Retention

• Driving license photos: stored in Cloudflare R2 and retained for up to 7 years where EU rental, insurance, dispute, or accounting obligations require it. Photos are deleted earlier when law allows and a valid deletion request applies.
• Booking history: stored in Cloudflare D1 and retained for 7 years for rental, tax, accounting, insurance, and dispute records. Where deletion applies, the booking record is retained with personal identifiers anonymized.
• Email and phone: retained while the account or booking relationship is active, then deleted or anonymized when no legal retention duty remains or when a valid deletion request applies.
• Cara chat transcripts: stored in Cloudflare D1 for up to 90 days, then deleted or anonymized unless a longer retention period is required for a booking dispute, fraud, safety, or legal obligation.
• Billing records: retained for up to 7 years where required for tax and accounting.
• Scrape cache: normally retained for up to 30 days unless needed for abuse prevention or debugging.
• Security logs: retained only as long as needed to secure the platform and investigate incidents.

Cookies

We use essential local storage/cookies for login sessions, security, language choices, referral codes, wizard progress, PWA prompts, and cookie consent. Analytics and marketing storage are off by default and only enabled after consent. You can reject all optional cookies or change granular preferences any time.

Your rights

Where GDPR applies, you have the following rights, subject to legal retention duties and identity verification:

• Access: ask for a copy of personal data we process about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete personal data where no legal retention duty requires us to keep it.
• Portability: ask for your data in a structured, commonly used format.
• Restriction: ask us to limit processing while a request or dispute is reviewed.
• Objection: object to processing based on legitimate interests or direct marketing.
• Consent withdrawal: withdraw optional cookie or marketing consent at any time.

Rental shop owners are responsible for handling their own customers' booking data lawfully. If you are a customer of a rental shop using RentingPilot, we may need to route some requests back to that shop as the primary data controller.

Security

We use TLS, role-based access, platform secrets, service isolation, logging, and least-privilege access. No system is perfect, but security issues are treated as urgent operational work.

Contact

For privacy questions or data requests, contact [email protected]or [email protected]. Operator: RentingPilot, operated from Denmark. Legal contact: [email protected]. You may also lodge a complaint with your local EU/EEA data protection authority.