Privacy Policy

This website

carz.lat runs no advertising trackers and sets no analytics cookies. If you email us, we keep the correspondence to answer you. That’s it.

When you open the site, your browser notes in that tab only which website sent you, the first page you opened and any campaign tags in the link (session storage, not a cookie). We receive it only if you send an enquiry, so we can see how you found us. It goes nowhere else and is gone when you close the tab.

Renter enquiries from the rankings

Our city rankings carry a short enquiry form. If you use it, we collect your name, mobile number, email if you give one, dates, pick-up area, budget and what you told us you need for one purpose: to send your request to car rental operators in that city.

We share those details with the operators we email on your behalf — that is the point of the form, and we say so on the form itself before you fill it in. We do not sell them, we do not use them for marketing, and we do not pass them to anyone else. Each operator then handles what it receives under its own privacy obligations.

Emails we send operators carry an open pixel and tracked buttons; we record when it was opened and which button was pressed, nothing else.

We keep the request on file, with its date and the operators we sent it to. Write to cris@carz.lat and we will delete it.

The platform — two roles

For data an operator’s business puts into its deployment, the operator is the data controller and Carz acts as the processor: we store and process it only to run the service, never to sell, profile or advertise. Each operator runs on a dedicated, isolated deployment with its own database — no data is shared between operators.

What the platform processes

• Operator data: team accounts, vehicles, bookings, contracts, work orders, investor agreements and payouts.
• Renter data: contact details, driver licence and identity documents, signed contracts, inspection photos, payment history, tolls and fines. Collected by the operator to run the rental relationship.
• Payment data: processed by Stripe or Square. Card numbers never touch Carz servers — we store only the provider’s tokens and the outcome of each charge, as confirmed by the provider.

Sub-processors we use

• Stripe / Square — payment processing (PCI-DSS compliant providers).
• Resend — transactional email (contracts, receipts, renewal notices).
• Google Maps Places — address autocomplete on forms.
• Fly.io — application and database hosting.

Each processes only what its job requires, under its own security terms.

Renters’ rights

For Australian renters, personal information is handled consistent with the Australian Privacy Principles. Renters can access their own records — bookings, invoices, signed contract, payment history — through the client portal where their operator has enabled it, and can direct access, correction or deletion requests to their operator, who we support in fulfilling them.

Retention and deletion

Data is kept while the operator’s deployment is active, plus any period the operator must retain records for tax or legal reasons (for example, tax invoices). When an operator leaves, we export their data to them and delete our copy after a reasonable handover window.

Contact

Privacy questions or requests: cris@carz.lat. We answer within a reasonable time, and material changes to this policy are dated at the top of this page.