Rentavoq privacy policy

Rentavoq [final legal entity name to be confirmed], an Indiana company ("Rentavoq," "we," "us"), operates a car-rental (and extensible asset-rental) software platform, including this marketing site, an operator application, per-operator branded renter storefronts, and an internal admin console (together, the "Platform"). This policy explains how we collect, use, disclose, and protect personal information.

1. Scope and our role

1.1 This policy covers personal information Rentavoq processes as a business/controller for its own purposes — for example, information about marketing-site visitors, operator personnel who use the operator app, and prospects.

1.2 For personal information about renters that Rentavoq processes on behalf of an operator customer (the "Operator"), the Operator is the business/controller and Rentavoq acts as a service provider/processor. In that role, the Operator's own privacy notice governs, and our processing is subject to the Data Processing Addendum. This policy describes those practices for transparency, but renters should also consult the applicable Operator's privacy notice.

1.3 Third-party services (Stripe, Canopy Connect, Bouncie, Persona/Stripe Identity, Twilio, Postmark, e-sign, and tolls/citations providers) process data under their own privacy policies.

2. Categories of personal information we collect

Depending on your relationship with us, we may collect:

Identifiers and contact data: name, email, phone, postal address, account credentials, operator business details.
Renter identity and verification data: driver's license image and details, date of birth, government ID, selfie image, and identity-verification results (via Stripe Identity / Persona).
Biometric or biometric-derived data: facial geometry or similar identifiers that may be generated during ID-to-selfie matching by our verification providers. See Section 4.
Insurance data: insurance policy and coverage information obtained through Canopy Connect, and verification results.
Payment data: payment card and bank information (processed and stored by Stripe — Rentavoq does not store full card numbers), deposits, holds, transaction history.
Booking and rental data: reservations, rental agreements, inspection photos, damage records, claims, tolls, citations, messages.
Vehicle location and telematics data: GPS location, trip data, speed, mileage, harsh-event and diagnostic data from Bouncie devices installed in vehicles. See Section 5.
Device and usage data: IP address, device and browser type, log data, pages viewed, cookies and similar identifiers.
Communications: SMS (Twilio) and email (Postmark) content and metadata, and support inquiries.

3. Where it comes from

We collect information: (a) directly from you; (b) from Operators about their renters; (c) automatically via cookies, devices, and telematics hardware; and (d) from third-party services and verification providers.

4. Biometric information (special notice)

4.1 Identity verification may involve capturing a photo of a government ID and a selfie and comparing them, which may generate facial-geometry or other biometric identifiers through our verification providers (Persona and/or Stripe Identity).

4.2 Purpose. Biometric processing is used solely to verify identity, prevent fraud, and gate key handoff before a rental.

4.3 Consent. Where required, consent is obtained before collecting biometric data, and biometric data is handled in accordance with applicable biometric-privacy laws. Some U.S. states (for example Illinois, Texas, and Washington) impose specific consent, notice, and retention-schedule requirements; certain features may be restricted in those states.

4.4 Retention. Biometric identifiers are retained only as long as needed for the verification purpose or as required by the provider or law, and are then deleted or de-identified. [Biometric retention schedule to be confirmed with counsel before publication.]

4.5 No sale. We do not sell biometric information.

5. Location and telematics information (special notice)

5.1 Vehicles operated on the Platform may include Bouncie telematics devices that collect precise geolocation and driving/diagnostic data, continuously or during a rental.

5.2 Purpose. Location and telematics data is used for fleet management, theft and recovery, safety, mileage and usage tracking, tolls and citations reconciliation, and analytics.

5.3 Notice and consent to renters and drivers. The Operator is responsible for notifying renters and drivers that vehicles are tracked and for obtaining any consent required by law. Recording and monitoring laws vary by jurisdiction.

5.4 Precise geolocation is treated as sensitive personal information under some laws and is subject to additional protections and, where applicable, limitation rights.

6. How we use personal information

We use personal information to: (a) provide, operate, and secure the Platform; (b) create and manage accounts; (c) process bookings, payments, deposits, holds, and payouts; (d) verify identity, license, and insurance and gate key handoff; (e) enable telematics, inspections, claims, and AI damage analysis; (f) send transactional and, with consent where required, marketing communications via SMS and email; (g) provide support; (h) detect and prevent fraud and abuse; (i) analyze and improve the Platform, including via aggregated or de-identified data; and (j) comply with legal obligations.

7. Legal bases (where applicable)

Where a legal-basis framework applies, we rely on: performance of a contract; legitimate interests (for example security, product improvement, and fraud prevention); consent (for example certain marketing, biometric, and precise-location processing); and legal obligation.

8. How we disclose personal information

We disclose personal information to: (a) the relevant Operator (for renter data); (b) subprocessors and service providers (Stripe, Canopy Connect, Bouncie, Persona/Stripe Identity, Twilio, Postmark, e-sign, tolls/citations, and hosting/analytics providers) under contract; (c) other operators via the opt-in cross-operator marketplace, if enabled; (d) professional advisors; (e) authorities where required by law or to protect rights and safety; and (f) parties to a corporate transaction (merger, acquisition, or financing).

We do not sell personal information for money. Some sharing for cross-context behavioral advertising or analytics may qualify as a "sale" or "sharing" under certain state laws; see Section 11.

9. Cookies and tracking technologies

9.1 The marketing site and storefronts use cookies and similar technologies for essential functionality, preferences, analytics, and (where applicable) advertising.

9.2 You can manage cookies via your browser and, where offered, our cookie banner or preference center. Some jurisdictions require opt-in consent for non-essential cookies.

9.3 Where required by law, we treat recognized opt-out preference signals — such as Global Privacy Control (GPC) — as valid opt-out requests. [GPC handling to be confirmed before publication.]

10. Data retention

We retain personal information only as long as necessary for the purposes described, to comply with legal, tax, accounting, and dispute-resolution obligations, and then delete or de-identify it. Retention schedules vary by data type — for example, biometric data is kept for the shortest feasible period, while financial records are kept as legally required.

11. Your privacy rights

11.1 State privacy laws (including CCPA/CPRA). Depending on your state of residence, you may have rights to: know and access, correct, delete, obtain a portable copy, opt out of sale/sharing and targeted advertising, limit use of sensitive personal information (for example precise geolocation, biometric, and ID data), and be free from discrimination for exercising your rights.

11.2 Indiana. The Indiana Consumer Data Protection Act (effective January 1, 2026) may provide Indiana residents rights to access, correct, delete, obtain a copy of, and opt out of the processing of personal data for targeted advertising, sale, and certain profiling. Requests are handled in accordance with that law where applicable.

11.3 How to exercise. Submit requests to privacy@rentavoq.com [contact address to be confirmed]. We will verify your identity before responding and respond within legally required timeframes. You may use an authorized agent where permitted.

11.4 Renter requests. Because Rentavoq processes most renter data on behalf of Operators, we route or forward renter requests to the relevant Operator and assist the Operator in responding.

11.5 Appeals. Where required, you may appeal a denial by contacting privacy@rentavoq.com [appeals contact to be confirmed].

12. Children's privacy

The Platform is not directed to children under 13 [age threshold to be confirmed], and we do not knowingly collect their personal information. Renters must be adults eligible to rent.

13. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vendor due diligence. No method of transmission or storage is completely secure. Security details and breach handling are further addressed in the Data Processing Addendum and described on our security page.

14. International users

The Platform is operated from the United States and is intended for U.S. use. If you access it from outside the U.S., you understand your information will be processed in the U.S.

15. Changes to this policy

We may update this policy. Material changes will be indicated by updating the "Last updated" date and, where required, by additional notice.

16. Contact us

Rentavoq — Attn: Privacy Indianapolis, Indiana [full mailing address to be added] Email: privacy@rentavoq.com [to be confirmed]