Privacy Policy
Current Car&Vibe legal content from the launch legal package. Backend booking snapshots remain authoritative for accepted request records.
Privacy Policy
1. Controller and contact
The controller for Platform account, booking, payment metadata, support, notification and platform operation data is Car&Vibe j.d.o.o., OIB: 44616036993, Skradinska 13, 21000 Split, Croatia.
Privacy requests may be sent to legal@carandvibe.com.
2. Role of Partners
Partners may separately process Customer personal data as providers of the Underlying Service, for example to handle bookings, check requirements on location, ensure safety, issue invoices and comply with their legal obligations.
3. Data we process
- account data: name, email, phone, account settings, login details and authentication metadata;
- Partner data: business name, OIB or tax ID, address, contacts, payment or payout data, business documents, permits or insurance where needed;
- booking data: dates, times, listing, Partner, status, price, fees, cancellations, refunds and related records;
- Rent data: vehicle, pickup and drop-off details, Partner requirements and the renter’s confirmation that they hold a valid driving licence and meet Rent requirements;
- Leisure data: participants, activity, meeting point, safety or licence information where needed for a specific service;
- messages between Customers and Partners and message metadata, including time, participants and message status;
- support, complaint, dispute and communication records;
- payment metadata and payment status processed by Stripe or another payment service provider; Car&Vibe does not need to store full card numbers;
- location data related to listing location, pickup area, meeting point or exact pickup/drop-off where applicable;
- push notification tokens, device identifiers and notification preferences;
- technical data, logs, security data, device data, IP address and data needed to prevent misuse;
- aggregate website visit data and basic technical website usage data through Vercel Web Analytics;
- user-generated content such as reviews, messages or listing photos if enabled.
4. Driving licence and future Verified Driver feature
In the ordinary Rent booking flow, Car&Vibe does not collect, review, verify or store driving licence images or documents.
Before booking, the renter confirms that they hold a valid driving licence and meet Partner requirements. At pickup or handover, the Partner physically verifies the original driving licence, identity, age, driving experience, deposit or card and rental agreement.
If Car&Vibe introduces a future Verified Driver feature, this Privacy Policy will be updated before that feature is activated.
5. Purposes and legal bases
| Purpose | Example data | Legal basis |
|---|---|---|
| Account creation and maintenance | name, email, phone, authentication data | contract performance; legitimate interest in security |
| Bookings and Partner communication | bookings, messages, statuses, locations | contract performance; legitimate interest |
| Payments, refunds and accounting | payment metadata, amounts, fees, invoices | contract performance; legal obligation; legitimate interest |
| Support, complaints and disputes | communications, evidence, booking history | legitimate interest; legal obligation |
| Security, fraud and misuse prevention | logs, device, IP, usage patterns | legitimate interest; legal obligation |
| Push notifications and service messages | push tokens, notification status, bookings | contract performance; legitimate interest; consent where required |
| Marketing if enabled | email, consents, preferences | consent or legitimate interest under applicable rules |
| Aggregate website analytics | aggregate website visit data and basic technical website usage | legitimate interest; consent where required under applicable rules |
6. Push notifications and messages
Car&Vibe may process push notification tokens, device identifiers and notification preferences to send booking updates, Partner or Customer messages, payment or reservation status, support updates and important service notices. You can manage notification permissions in device or app settings where applicable.
Messages between Customers and Partners may be processed for booking communication, support, dispute handling, safety, fraud prevention and legal obligations.
7. Website analytics and operational records
On the website, we may use Vercel Web Analytics for aggregate insights about website visits and basic technical website usage. This analytics is used to understand basic website usage, reliability and service improvement, not to track users for marketing across different websites.
We do not use custom analytics events to collect message content, payment data, exact locations, documents, driving licences or other sensitive data.
Car&Vibe may process technical and operational records necessary for Platform operation, security, service reliability, booking processing, payments, notifications, customer support, dispute handling and misuse prevention. These records are not used for marketing tracking unless this is separately disclosed and, where required, user consent is obtained.
Marketing advertising, remarketing, Google Ads/GA4, Meta Pixel, TikTok Pixel or similar tools are not currently active and will require a separate privacy and cookie update and, where required, user consent.
8. Recipients and service providers
We may share data with Partners where needed for a booking and performance of the Underlying Service. Data may also be processed through service providers such as Supabase, Stripe, Vercel, Resend, Google Workspace, Cloudflare, Apple, Google services and DeepL, depending on features used.
9. International transfers
Some service providers may process data outside the European Economic Area. In such cases Car&Vibe uses or verifies appropriate transfer mechanisms such as standard contractual clauses, adequacy decisions or other permitted mechanisms.
10. Retention
We keep data for as long as necessary for the purposes described in this Policy, including providing the Platform, accounting, tax and legal obligations, security, fraud prevention, complaint handling and dispute resolution. When data is no longer needed, it is deleted, anonymised or restricted in accordance with applicable rules.
11. Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction, data portability and objection to processing. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal.
To exercise your rights, contact legal@carandvibe.com. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), the supervisory authority for data protection in Croatia.
12. Children and minors
The Platform is not intended for children. Users must be at least 18 years old to use services and make bookings, unless stricter requirements apply to a specific service.
13. Marketing
If Car&Vibe uses marketing communications, users will be provided with information on subscribing, unsubscribing and managing preferences. Transactional and service messages may be sent regardless of marketing preferences where needed for Platform operation or a booking.
14. Changes to this Privacy Policy
Car&Vibe may update this Privacy Policy. The updated version will be published on the Platform and users will be notified where appropriate or legally required.
15. Contact
- Privacy and legal requests: legal@carandvibe.com
- Support: support@carandvibe.com
- General contact: hello@carandvibe.com