Privacy Policy

1. What we collect

• Account: name, email address, profile photo, and — for hosts — phone, WhatsApp number and NIC number (identity verification).
• Rental activity: booking requests and dates, quotes, messages with the other party, reviews, and handover records (photos or short videos of the vehicle at pickup/return, fuel level, odometer, deposit amounts).
• Technical data: IP address and basic request metadata used for security, rate limiting and fraud prevention; session cookies that keep you signed in.

2. Why we use it

• To operate the marketplace: matching requests, availability, messaging.
• To send transactional emails you expect — sign-in links, booking updates, replies to your messages. No marketing email at launch.
• To keep the marketplace safe: identity verification, moderation, abuse and fraud prevention, and dispute resolution using handover records.
• To comply with legal obligations.

3. Who can see what

• Public: listing details (photos, description, area, rates), host display name and verification badge, and reviews with the renter’s display name.
• Only after a booking is accepted: the renter sees the host’s phone and WhatsApp; the host sees the renter’s contact details. Before acceptance, contact details stay hidden.
• Never public: NIC numbers (masked even for our admin team), handover evidence, private messages, and internal notes. Handover records are visible only to the two parties and, when a dispute is raised, to our moderation team.

4. Service providers

Rent & Drive runs entirely on Cloudflare’s infrastructure (hosting, database, file storage, email delivery). Sign-in is handled by Better Auth. These providers process data only to deliver the service. We do not sell or share personal data with advertisers, and the public site loads no third-party trackers.

5. Retention

• Account and rental data are kept while your account is active. Handover records and reviews may be retained after account closure for dispute resolution, safety, and legal reasons.
• Nightly database backups are encrypted at rest and retained for a limited window.

6. Your choices

• Update your name, photo, phone and WhatsApp any time from your profile.
• Ask for a copy of your data, or deletion of your account, by writing to privacy@uthpalax.com. We will tell you if we are legally required to keep something.
• Session cookies are essential for sign-in; the site does not use tracking cookies. Blocking them means you cannot stay signed in.

7. Changes and contact

If this policy changes we will update the date above and, for significant changes, notify you by email. Questions go to privacy@uthpalax.com.