Privacy Policy

Last updated: May 2026

1. Who we are

Carfare operates a peer-to-peer car rental marketplace at carfare.is. When this policy refers to "Carfare", "we", "us", or "our", it means the Carfare platform. Questions about this policy can be sent to [email protected].

2. Information we collect

Account information

When you register, we collect your full name, email address, and a hashed password (or a Google account identifier if you sign up via Google). We do not store your Google password.

Identity verification

To make a booking, renters must upload a photo of their driving licence. This file is stored securely in a private directory that is not publicly accessible and is only visible to our admin team for verification purposes.

Booking and trip data

We store the details of every booking including dates, car, price, status, and any handover or return notes and photos. This data is necessary to operate the service and resolve disputes.

Messages

Messages sent between renters and hosts through the platform are stored so both parties can refer back to them.

Car listings

If you list a car, we store the details and photos you provide, your listed pickup location, and your pricing.

Usage data

We may collect basic server logs including IP addresses and request timestamps for security and debugging purposes. We do not use third-party analytics trackers.

3. How we use your information

To operate the booking and rental service
To verify your identity before allowing you to rent a car
To send transactional emails (booking confirmations, receipts, reminders)
To generate and store rental agreements as PDF documents
To process payments via our payment provider
To resolve disputes between renters and hosts
To improve the platform based on usage patterns

We do not sell your personal data to third parties. We do not use your data for advertising.

4. Payments

Card payments are processed by Rapyd, a licensed payment service provider. Carfare never sees or stores your full card number. Rapyd's own privacy policy governs how they handle your payment data. When you make a payment you are also subject to Rapyd's terms.

5. Google Sign-In

If you choose to sign in with Google, we receive your name and email address from Google. We use these only to create or identify your Carfare account. We do not request access to any other Google data such as contacts, calendar, or Drive.

6. Cookies

We use a single session cookie to keep you logged in. This cookie contains a signed authentication token and no personally identifiable information beyond your user ID. We do not use tracking cookies or advertising cookies.

7. Data sharing

We share data with third parties only to the extent necessary to run the service:

Rapyd — to process payments
Resend — to deliver transactional emails

Within the platform, certain information is visible to the other party in a booking — for example, a host can see the renter's name and a renter can see the host's name and contact details after a booking is confirmed.

8. Data retention

We retain your account data for as long as your account is active. Booking records and rental agreements are kept for a minimum of 2 years for accounting and legal purposes. Driving licence photos are deleted once you are no longer an active renter on the platform, or upon request.

9. Your rights

You have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your account and associated data (subject to legal retention obligations)
Object to processing in certain circumstances

To exercise any of these rights, contact us at [email protected].

10. Security

Passwords are hashed using bcrypt and never stored in plain text. Driving licence files are stored outside the public web root and served only to authenticated administrators. All connections to carfare.is are encrypted via HTTPS.

11. Changes to this policy

If we make material changes to this policy we will update the date at the top of this page and, where appropriate, notify users by email. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, reach us at [email protected] or via the contact page.