⚠ Draft — not yet legally reviewed

Placeholder copy. Replace before launch with a Privacy Policy reviewed under the Australian Privacy Principles (APPs) and (if any EU users are expected) GDPR. Suggested service: Termly or iubenda for a generated baseline, then reviewed by counsel.

Privacy Policy

Last updated: August 01, 2026 — DRAFT

What we collect

  • Account info: name, email, phone, role (renter/host).
  • Identity verification: driver licence (renters), Certificate of Inspection + Class 4 CTP (hosts), optional TMR Traffic History.
  • Payment info: we never see or store card numbers — Stripe handles all payment data. We hold a Stripe customer reference only.
  • Booking activity: bookings, payments, bond claims, communications with support.
  • Usage data: IP, device type, pages visited (analytics, only if you accept cookies).

How we use it

  • Run the marketplace: process bookings, payments, payouts, Herald verification.
  • Communicate: booking confirmations, payment failures, Herald approvals, support replies.
  • Comply with the law: tax reporting, fraud prevention, regulatory requests.
  • Improve the product (anonymised, only if cookies accepted).

Who we share with

Only the parties needed to deliver the service:

  • Stripe: for payments, payouts, fraud detection.
  • Mapbox: for address geocoding (your addresses are sent only when geocoding).
  • AWS S3: for storing your uploaded ID documents and listing photos (private bucket; access only via signed URLs).
  • Email service provider (e.g. Postmark / SES): for transactional emails.
  • Australian regulators: when legally required.

We never sell your data.

Where data is held

Primary data is held on servers in Australia (or AWS Sydney region). Third-party processors (Stripe, Mapbox) operate from the United States and other regions per their respective privacy policies.

Cookies

Essential cookies (login session, CSRF, accessibility) are required for the site to work. Optional analytics cookies (Google Analytics) only fire if you click Accept on the cookie banner. Decline = no analytics, no tracking.

Your rights

Under the Australian Privacy Principles you have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate or outdated information.
  • Request deletion of your account and associated personal data (subject to legal retention requirements for tax / dispute records).

Email privacy@rentcaar.com.au to exercise any of these.

Retention

Account data: kept while your account is active. After deletion, payment-related records are retained for 7 years to comply with Australian tax law.

Contact

Privacy enquiries: privacy@rentcaar.com.au.