Privacy Policy

1. Controller and contact

The controller for Platform account, booking, payment metadata, support, notification and platform operation data is Car&Vibe j.d.o.o., OIB: 44616036993, Skradinska 13, 21000 Split, Croatia.

Privacy requests may be sent to legal@carandvibe.com.

2. Role of Partners

Partners may separately process Customer personal data as providers of the Underlying Service, for example to handle bookings, check requirements on location, ensure safety, issue invoices and comply with their legal obligations.

3. Data we process

account data: name, email, phone, account settings, login details and authentication metadata;

Partner data: business name, OIB or tax ID, address, contacts, payment or payout data, business documents, permits or insurance where needed;

booking data: dates, times, listing, Partner, status, price, fees, cancellations, refunds and related records;

Rent data: vehicle, pickup and drop-off details, Partner requirements and the renter’s confirmation that they hold a valid driving licence and meet Rent requirements;

Leisure data: participants, activity, meeting point, safety or licence information where needed for a specific service;

messages between Customers and Partners and message metadata, including time, participants and message status;

support, complaint, dispute and communication records;

payment metadata and payment status processed by Stripe or another payment service provider; Car&Vibe does not need to store full card numbers;

location data related to listing location, pickup area, meeting point or exact pickup/drop-off where applicable;

push notification tokens, device identifiers and notification preferences;

technical data, logs, security data, device data, IP address and data needed to prevent misuse;

consent-controlled website usage and technical interaction data, including page or route, referrer, browser, device, coarse location, timestamp and consent state, through Google Analytics 4, Google Consent Mode and Vercel Web Analytics where enabled;

user-generated content such as reviews, messages or listing photos if enabled.

4. Driving licence and future Verified Driver feature

In the ordinary Rent booking flow, Car&Vibe does not collect, review, verify or store driving licence images or documents.

Before booking, the renter confirms that they hold a valid driving licence and meet Partner requirements. At pickup or handover, the Partner physically verifies the original driving licence, identity, age, driving experience, deposit or card and rental agreement.

If Car&Vibe introduces a future Verified Driver feature, this Privacy Policy will be updated before that feature is activated.

5. Purposes and legal bases

6. Push notifications and messages

Car&Vibe may process push notification tokens, device identifiers and notification preferences to send booking updates, Partner or Customer messages, payment or reservation status, support updates and important service notices. You can manage notification permissions in device or app settings where applicable.

Messages between Customers and Partners may be processed for booking communication, support, dispute handling, safety, fraud prevention and legal obligations.

7. Website analytics, consent and advertising measurement

Car&Vibe provides a consent-management interface with Necessary, Analytics and Marketing categories. Necessary technologies remain active where required for security, authentication, booking and payment integrity, recording legal preferences and basic Platform operation. Analytics and Marketing are optional and can be accepted, rejected or changed independently.

Google Tag Manager (GTM) is a technical tag-management mechanism. GTM does not by itself determine the business purpose for which a configured tag processes data. The purpose, category and consent requirement depend on the specific tag delivered through the GTM container.

Car&Vibe uses Google Analytics 4 (GA4) analytics reporting only after the User grants the Analytics choice. Consent-gated Vercel Web Analytics may also process limited website usage and technical interaction data for analytics, reliability and service improvement after that choice. The Analytics choice controls `analytics_storage`.

After Analytics consent, Car&Vibe may measure aggregate booking funnels for Rent and Leisure in GA4. The Rent steps are viewing vehicle results (`search_results_viewed`), selecting a Rent listing (`listing_selected`), beginning submission of a booking request (`booking_request_started`) and successful submission of a booking request (`booking_request_submitted`). The Leisure steps are beginning submission of a booking request (`booking_request_started`) and successful submission of a booking request (`booking_request_submitted`). For both verticals, successful submission is recorded only after the server confirms that the request was created.

Each custom booking-funnel payload contains only its allowlisted event name and one fixed discriminator: `vertical: rent` for Rent or `vertical: leisure` for Leisure. Car&Vibe does not intentionally send a booking or request ID or reference, listing or experience ID, UUID, user or account ID, email, phone, date, time, number of guests or participants, listing title, Partner name, price or payment amount, Stripe or payment data, exact location, real dynamic URL, query string, referrer, free text or any arbitrary dynamic value with these events. `booking_request_submitted` may be configured as a GA4 key event for aggregate conversion measurement.

Google Consent Mode v2 communicates the User's consent state to Google. Before an optional choice is made, `analytics_storage`, `ad_storage`, `ad_user_data` and `ad_personalization` default to denied. The Marketing choice controls `ad_storage`, `ad_user_data` and `ad_personalization`.

If a consent-aware Google tag is configured to operate in advanced Consent Mode while storage remains denied, Google may receive limited cookieless consent-state and basic measurement pings. According to Google's documentation, those pings can include functional information such as timestamp, user agent, referrer, page URL, consent-state indicators and a random number. They do not use Analytics or advertising cookies while the relevant storage consent is denied. This technical transmission is separate from consented Analytics storage and reporting.

After Analytics consent, when the initial referrer is a Google domain and the landing route is on Car&Vibe's fixed public SEO allowlist, Car&Vibe may set the first-party HTTP-only cookie `carvibe_google_organic_session` for up to 30 days. The related first-party record stores a random session identifier, normalised landing route, language and session-level timestamps for landing, listing selection and booking start. It does not store the search query, full referrer, IP address, browser user agent, account identity or free text.

If an authenticated booking request is successfully created during that attribution window, Car&Vibe may attach `google_organic`, the normalised landing route and attribution timestamps to that booking. Referral, hotel and QR attribution has priority and is not overwritten. Staff reporting may then combine aggregate funnel counts with backend-confirmed captured-booking status and Car&Vibe platform revenue, rather than treating the full Partner service price as Car&Vibe revenue. Withdrawing Analytics consent stops future collection and clears the browser attribution cookie; records lawfully created before withdrawal may remain for the stated analytics and business-record retention purposes.

The aggregate Rent and Leisure funnel events are Analytics events, not Google Ads remarketing or advertising events. Google Ads conversion measurement may be activated in the future solely to measure advertising effectiveness and only under the applicable Marketing consent, a separate disclosure and approval. Google Ads remarketing, personalised advertising audiences, Customer Match and cross-site marketing profiles are not currently active and require a separate product and privacy review before activation.

Car&Vibe does not configure custom analytics, GTM data-layer, Google Ads or Vercel Analytics events to intentionally send full name, email, phone, exact pickup or meeting address, private messages, OIB or tax data, identity documents, raw Stripe identifiers, payment references, client secrets, exact coordinates or other protected booking or payment data. The custom booking-funnel events are limited to the allowlisted event name and either `vertical: rent` or `vertical: leisure`. Automatic page-view tools may separately process the page path or route and basic technical request data; analytics configuration must not add protected values to event payloads.

The consent record contains only a version, timestamp and the Analytics and Marketing choices. Users may reject optional categories as easily as accepting them. Cookie settings can be reopened through the persistent Cookie settings action in the website footer. A User may withdraw or change consent at any time. The update applies going forward and does not retroactively affect the lawfulness of processing based on consent before withdrawal.

Car&Vibe may also process technical and operational records necessary for Platform operation, security, service reliability, booking processing, payments, notifications, customer support, dispute handling and misuse prevention. Those operational records are separate from optional website Analytics and Marketing.

8. Recipients and service providers

We may share data with Partners where needed for a booking and performance of the Underlying Service. Data may also be processed through service providers such as Supabase, Stripe, Vercel, Resend, Google Workspace, Google Analytics, Google Tag Manager, Google Ads if separately activated, Cloudflare, Apple, Google services and DeepL, depending on features used and the User's consent choices.

9. International transfers

Some service providers may process data outside the European Economic Area. In such cases Car&Vibe uses or verifies appropriate transfer mechanisms such as standard contractual clauses, adequacy decisions or other permitted mechanisms.

10. Retention

We keep data for as long as necessary for the purposes described in this Policy, including providing the Platform, accounting, tax and legal obligations, security, fraud prevention, complaint handling and dispute resolution. When data is no longer needed, it is deleted, anonymised or restricted in accordance with applicable rules.

The first-party consent preference is valid for 180 days unless the User changes it earlier. Before GA4 is activated, the GA4 property must be configured for a maximum user-level and event-level data retention period of 14 months. This provider-side retention setting is separate from browser cookie duration and does not change mandatory retention of booking, invoice, tax, dispute, fraud or accounting records.

When Analytics consent is granted, GA4 may use first-party cookies whose default provider duration can be up to two years, subject to browser limits and the configured Google tag settings. Vercel states that its Web Analytics visitor-session hash is automatically discarded after 24 hours; aggregate provider records are handled under the applicable Vercel service configuration. Browser/device storage and provider-side aggregate records can therefore have different retention periods.

11. Your rights

Subject to the GDPR, you may request access, correction, deletion, restriction, data portability and objection to processing. Where processing is based on consent, you may withdraw or change consent at any time through the persistent Cookie settings action in the website footer, without affecting processing carried out before withdrawal.

A user may initiate deletion of their account directly in the app through: Profile → Profile Settings → Account Management → Delete Account.

For requests that cannot be completed through the app, contact legal@carandvibe.com. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), the supervisory authority for data protection in Croatia.

12. Children and minors

The Platform is not intended for children. Users must be at least 18 years old to use services and make bookings, unless stricter requirements apply to a specific service.

13. Marketing

If Car&Vibe uses marketing communications, users will be provided with information on subscribing, unsubscribing and managing preferences. Transactional and service messages may be sent regardless of marketing preferences where needed for Platform operation or a booking.

The website Marketing category relates to advertising storage, advertising user-data consent and advertising personalisation signals. Future Google Ads conversion measurement may be enabled only after the applicable Marketing consent. Remarketing, personalised advertising audiences, Customer Match and cross-site marketing profiles remain inactive unless a later product and privacy review expressly approves them.

14. Changes to this Privacy Policy

Car&Vibe may update this Privacy Policy. The updated version will be published on the Platform and users will be notified where appropriate or legally required.

15. Contact

Privacy and legal requests: legal@carandvibe.com

Support: support@carandvibe.com

General contact: hello@carandvibe.com