Privacy Policy

This Privacy Policy explains how Guardas de Productos, S.L. (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you use the Rental Car Proof website (rentalcarproof.com) and the Rental Car Proof mobile app (together, the “Service”).

We are a Spanish-registered company, VAT registered in the UK. We are the data controller for the personal data described in this policy.

Data controller: Guardas de Productos, S.L.
Contact for privacy and data requests: Email us

This policy applies whether you’re browsing our website, downloading a free resource, or using the Rental Car Proof app. Where something applies only to the website or only to the app, it’s labelled accordingly.

1. Data We Collect

1.1 If you use our website

• Email address — if you download a gated resource (such as the Inspection Checklist) or subscribe to updates, we collect your email address to deliver the resource and send you related content.
• Contact form data — if you contact us, we collect whatever information you provide (name, email, message).
• Analytics data — we use Google Analytics 4 to understand how visitors use our website. This may include pages viewed, referral source, device/browser type, and approximate location derived from IP address. In the EU, EEA, UK, and Switzerland, Google Analytics only runs after you’ve given consent; see “Cookies and Tracking” below.

1.2 If you use our app

Account data

• Email address — collected at registration via magic link authentication
• Display name — optional; entered manually, or provided via Google or Apple sign-in
• If you sign in with Google or Apple, we receive your name and email address from that provider to create and authenticate your account. If you use Apple’s “Hide My Email” option, we receive an Apple-generated private relay address instead of your real one.
• Device hash — a one-way (SHA-256) hash of your device identifier, collected at registration. This cannot be reversed to identify you or your device. See “Fraud Prevention” below for why we collect this.
• App language and device locale — the language your app is set to, and your device’s language/region setting, so we can support the languages our users need
• Approximate sign-up country — when you register, we estimate your country from your connection’s IP address using a local country-lookup database. Your IP address itself is never sent to an external service and is not retained — only the resulting country estimate is stored. This estimate can be inaccurate, for example if you use a VPN. It’s used for internal reporting on where our users are signing up from, and is deleted if you delete your account.

Rental data

• Vehicle details you enter (licence plate, make, model)
• Rental dates
• Rental company name
• Rental agreement reference number

Photo data

• Photos you take during a vehicle walk-around inspection
• Each photo includes metadata: timestamp, GPS coordinates, which inspection it belongs to, and which checklist step it documents
• We store both the original photo and a stamped (annotated) version — this is a deliberate design choice, so the original file remains as independent, untouched evidence
• GPS coordinates are captured from your device at the moment each photo is taken

Usage and entitlement data

• Your entitlement status (e.g. whether you’ve used your free rental, or hold an active plan or credits)
• Flags used to control one-time in-app messaging (e.g. whether you’ve seen the first-open guidance)
• A fraud flag, described in “Fraud Prevention” below

2. How and Why We Use Your Data

We use your data to:

• Provide the core service — let you create rental inspections, capture and store evidence photos, and generate evidence packs
• Authenticate you and keep your account secure
• Process purchases and manage your entitlements
• Send transactional emails (e.g. magic link sign-in, evidence pack delivery)
• Understand how our website and app are used, so we can improve them
• Detect, diagnose, and fix app crashes and technical errors
• Prevent abuse of our free-trial system (see “Fraud Prevention”)
• Respond to support requests
• Occasionally reach out to you directly and personally (not via automated marketing) for feedback on your experience using the service

We do not sell your personal data, and we do not use your rental or photo data for advertising.

3. Legal Basis for Processing

Under GDPR, we rely on the following legal bases:

• Contract — processing your account, rental, and photo data is necessary to provide the service you’ve signed up for
• Consent — where we send you marketing emails, or use non-essential website cookies/analytics
• Legitimate interests — for fraud prevention (device hash retention, described below), basic website analytics, crash and error monitoring to keep the app reliable, and occasional personal outreach to users for product feedback, where the impact on you is minimal and proportionate (e.g. a one-off email, not a recurring campaign); and understanding, at a basic level, the languages and countries our users are signing up from, to guide localisation and support priorities

4. Data Storage

Database and file storage: All account, rental, and photo metadata is stored with Supabase (PostgreSQL and Supabase Storage), hosted on AWS infrastructure in Frankfurt, Germany. Your data is stored within the European Union.

Evidence pack delivery: When you download an Evidence Pack, we generate a signed URL that expires after a limited time, so evidence links cannot be accessed indefinitely by anyone who obtains the link.

On your device: The app caches some configuration and app-state flags locally (e.g. whether you’ve completed onboarding). Photos are not retained permanently on your device after they’ve been uploaded — once safely stored, local copies are cleared.

5. Data Retention

Rentals: If you delete a rental, we don’t immediately erase it — it’s marked as deleted and hidden from your view, but the underlying record is retained. This prevents the free-trial entitlement system from being gamed by repeatedly creating and deleting rentals. This is a legitimate-interest basis for retention, not indefinite storage: the row is permanently deleted when you delete your account.

Photos: Retained for as long as the associated rental exists. Permanently deleted when your account is deleted.

Evidence pack exports: When you email yourself an Evidence Pack, the exported file is automatically deleted 61 days after export. The record that an export took place is kept afterward as an audit trail (that an export happened, and when), but the file itself is gone.

Active accounts: We retain your account, rental, and photo data for as long as your account remains active. We do not currently run an automatic process to delete data from accounts that become inactive or dormant. If you no longer wish to use the Service, you can delete your account at any time using the steps below.

Account deletion: When you delete your account, we permanently delete: (see rentalcarproof.com/account-deletion for how to do this)

• Your authentication record
• All rental records, including previously “deleted” ones
• All photo files and photo metadata
• Your profile record, including the device hash

The only thing retained after account deletion is your device hash, which is moved to a separate table used solely for fraud prevention (see below). This hash cannot be linked back to your identity, email, or any other personal data once your profile is deleted. The sign-up country estimate described above, if recorded, is deleted at the same time.

6. Fraud Prevention

To protect the free-trial system from abuse, we generate a one-way cryptographic hash of your device identifier when you register. This hash cannot be reversed to reveal your actual device ID or identify you personally.

If you delete your account, this device hash is copied into a separate table before the rest of your data is erased. If someone later registers a new account from the same device, we check the incoming device hash against this table. If it matches, the new account is flagged and is not granted a further free trial.

We rely on legitimate interests as the legal basis for this narrow, anonymous retention — it exists solely to prevent systematic abuse of our billing model, and the data retained cannot identify you. We retain this hash indefinitely for as long as it continues to serve that purpose; we do not currently apply an automatic expiry to the fraud-prevention list.

If you object to this processing, contact us at Email us. Please note that honouring an objection means removing your device hash from the fraud-prevention list, which would make the device eligible for another free trial.

7. Cookies and Tracking (Website)

Our website uses Google Analytics 4 to understand visitor behaviour — pages viewed, referral source, device/browser type, and approximate location derived from IP address. This involves a small number of cookies set by Google (names starting _ga) to distinguish visitors and measure usage.

If you’re visiting from the EU, EEA, UK, or Switzerland, you’ll see a cookie banner on your first visit. Google Analytics does not run, and no analytics cookies are set, until you accept. You can change or withdraw that choice at any time using “Manage cookies” in the footer of any page, which reopens the same preferences. Visiting from outside those regions, Google Analytics runs without a prior prompt.

We don’t use Google Analytics data for advertising, and we don’t combine it with the account, rental, or photo data described in Section 1.2.

8. Third-Party Services

We share data with the following service providers, each acting as a data processor on our behalf:

We require all third-party processors to handle your data securely and only for the purposes we’ve instructed.

9. International Data Transfers

Your core account, rental, and photo data is stored within the EU (Frankfurt, Germany). Most of our third-party service providers — Supabase, PostHog, Sentry, Resend, and Brevo — also process data within the EU.

One exception: RevenueCat, which we use for purchase validation and entitlement management, stores data on infrastructure located in the United States. Where this transfer occurs, we rely on the Standard Contractual Clauses (and, for UK residents, the UK International Data Transfer Addendum) as the legal safeguard required under GDPR and UK GDPR.

Google and Apple, which provide optional sign-in and (for Android) payment processing, operate global infrastructure covered by their own standard compliance frameworks. Google Analytics, used for website analytics, similarly runs on Google’s global infrastructure.

10. Your Rights (GDPR)

If you’re in the EU/UK, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — delete your account at any time directly within the app (Settings → Account → Delete Account), or if you no longer have the app installed, visit rentalcarproof.com/account-deletion or email us at Email us from the address linked to your account. This permanently erases your personal data, with the sole exception of the anonymous device hash described in “Fraud Prevention”. Where analytics data associated with your account is held by a third-party analytics provider, we request its deletion from that provider on a best-effort basis at the same time.
• Data portability — request your data in a portable format. Our Evidence Pack export (a ZIP of your photos and inspection manifest) already provides this for your rental data
• Object — object to processing based on legitimate interests, including the device hash retention described above
• Restriction — ask us to limit how we use your data while a request or dispute is resolved
• Withdraw consent — where we rely on your consent (e.g. marketing emails or non-essential cookies), withdraw it at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at Email us.

You also have the right to lodge a complaint with a supervisory authority. As a Spanish-registered company, our lead supervisory authority is the Spanish Data Protection Agency (AEPD). UK residents may also complain to the Information Commissioner’s Office (ICO), and residents of other EU/EEA countries may complain to their own local data protection authority.

11. Children’s Privacy

Rental Car Proof is not directed at children under 16 (or under 13 in the United States). We do not knowingly collect data from children. We do not currently have a mechanism to verify user age; if you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to This Policy

We may update this policy from time to time — for example, if we add a new third-party service or change how we handle data. We’ll update the “Last updated” date at the top of this page, and where changes are material, we’ll notify you via email or an in-app notice.

13. Contact Us

If you have questions about this policy or how we handle your data:

Guardas de Productos, S.L.
Email us