Privacy notice
How Locar collects, uses and protects personal data when you use our software, and when your rental company uses it to manage its own customers.
Version 2026-10-10 · Last updated 10 October 2026
Who we are
- Company name
- Locar.ai
- Tax ID
- 000000
- Registered address
- 123, Street
- Commercial register
- Locar.ai Corporation
- Contact
- support@locar.ai
Locar provides software as a service for independent car-rental companies, mainly in Spain and Portugal. This notice explains what personal data we process, why, and what rights you have, whether you are a member of staff at a rental company that uses Locar, or a customer of one of those rental companies.
Our two roles
Under data protection law, the "controller" is whoever decides why and how personal data is processed, and the "processor" is whoever processes it on the controller's instructions. Locar is sometimes one, sometimes the other, depending on whose data is involved.
We are the controller for the account data of rental companies and their staff who sign up to use Locar: names, email addresses, phone numbers, roles, language preferences and sign-in records. We are also the controller for our own subscription billing records, platform security logs, and any email you send to our support address.
We are the processor, acting under a data processing agreement, for the personal data that a rental company keeps about its own customers and drivers inside Locar: bookings, contracts, identity and licence documents, payments, vehicle inspections, and WhatsApp conversations, among others. The rental company decides why and how that data is used.
If you are a customer or driver of a rental company that uses Locar, that company is responsible for your personal data and is the right contact for most questions about it. Please see that company's own privacy notice first; we explain how we support you in the "Your rights" section below.
Data we collect
Account holders and staff of a rental company using Locar:
- Name, email address and phone number given at sign-up or when invited to an account
- A password, stored only as a one-way cryptographic hash, never in readable form
- Language and timezone preferences
- Your role and the permissions it carries within your company's account
- Records of sign-ins, for account security
Technical data collected automatically as you use the service:
- IP address and browser or device information, recorded at sign-in and in security logs
- A single strictly necessary cookie that keeps you signed in between requests
- Preferences stored on your own device, such as colour scheme, recent searches and an offline queue of changes waiting to sync
- We do not use analytics, advertising or other tracking scripts
Data a rental company processes about its own customers and drivers, as a controller, using our software:
- Name, contact details, date of birth, nationality and address
- Identity document and driving licence data and images
- Signatures captured on a rental contract
- Booking and contract details, and related correspondence
- Payment and deposit information; card numbers are handled directly by our payment provider and are never stored by Locar
- Fines and tolls linked to a rental
- Vehicle inspection and damage photos
- WhatsApp conversations with the rental company, including voice notes and their transcripts
- The hand-over location recorded by the tablet at pick-up or return
- Where Spanish law requires it, the traveller report that a rental company must file, which Locar generates on its behalf
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and administering your account | Name, email, phone, password, role | Contract |
| Billing and managing your subscription | Billing and payment details | Contract |
| Keeping the service secure and preventing misuse | Sign-in records, IP address, security logs | Legitimate interest |
| Meeting our own legal obligations | Invoices and records we must keep by law | Legal obligation |
| Supporting you | Support emails | Legitimate interest |
These legal bases cover only the purposes for which Locar is the controller, described in "Our two roles" above. For personal data processed for a rental company — including an AI feature it chooses to enable and the Spanish traveller report — the rental company determines the purpose and the legal basis, as the controller of that data.
AI features
Locar offers optional AI features that a rental company can turn on for its own account: reading details from a driving licence, identity document, vehicle registration document or a photo of a fine or dashboard; translating WhatsApp messages and customer emails; transcribing voice notes; a WhatsApp booking assistant; and importing fleet or customer lists. Each feature is off until a rental company switches it on.
An AI reading is always a proposal. Nothing an AI feature produces is saved to a customer, vehicle or booking record until a member of staff reviews it and confirms it. Reading identity documents with AI is disabled by default and only becomes available when a platform administrator selects a specific model for it.
Who we share data with
We use a small number of providers to run Locar, each receiving only the data it needs for its task. The providers that process data on our instructions are bound by a data processing agreement or other appropriate safeguards. One entry below is different: the tablet's own browser contacts it directly, without a contract with Locar.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting and network, file storage, PDF generation, AI gateway, DNS | Global network; files stored in the EU; US company under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Neon (Databricks) | Main database | EU (Frankfurt) |
| Typesense Cloud | Search index for names, phone numbers, plates and booking numbers | Region set per account; Standard Contractual Clauses apply outside the EU |
| Stripe | Card payments, deposits and subscription billing | Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (US), under Standard Contractual Clauses and the Data Privacy Framework |
| Resend | Sending transactional emails | US, under Standard Contractual Clauses and the Data Privacy Framework |
| Meta Platforms (WhatsApp Business Platform) | Sending and receiving WhatsApp messages | Meta Platforms Ireland Ltd. and the US, under Standard Contractual Clauses and the Data Privacy Framework |
| AI model providers reached through our AI gateway (for example Google) | Only the AI features a rental company has enabled | May be outside the EU, under Standard Contractual Clauses or the Data Privacy Framework |
| OpenFreeMap | Map tiles on the hand-over screen; a free public service the tablet's browser contacts directly, with no contract between Locar and OpenFreeMap, receiving the tablet's IP address and the map area viewed | Hungary (EU) |
International transfers
Most of our providers process data within the European Union. Where a provider is based outside the EU, or processes data there, we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework, or both, to make sure your data keeps an equivalent level of protection.
You can ask us for more detail on the safeguards that apply to a particular transfer by writing to support@locar.ai.
How long we keep data
| Data | Retention |
|---|---|
| Unconfirmed AI document readings (fields and image) | Erased after 30 days |
| WhatsApp assistant transcripts and conversation summaries | Erased after 548 days (our card-dispute window) |
| Sign-in attempts, including IP address | 90 days |
| Expired or used sign-in sessions | 30 days |
| Password-reset and invite links | 30 days after they expire or are used |
| Unaccepted invitations to join a company account | 90 days |
| Notification delivery records | 90 days |
| Audit log | For the life of the company's account |
| Contracts, signatures, inspection photos and invoices | Kept as legal evidence for as long as the rental company must keep them under contract, tax and traveller-reporting rules; a fixed platform-wide period is being set |
| WhatsApp messages | Kept while the rental company's account is active; a fixed period is being set |
| All data, when a company account is closed | Deleted, except what the law requires us to keep, such as our own invoices |
Your rights
- Access the personal data we hold about you
- Have inaccurate data corrected
- Ask for your data to be erased
- Ask us to restrict how we use your data
- Receive your data in a portable format
- Object to how we use your data
- Withdraw your consent at any time, where consent is the basis for processing
To exercise any of these rights with Locar, write to support@locar.ai. We answer within one month, as required by data protection law.
If your question is about data that a rental company holds about you as its customer or driver, please contact that rental company first: it is the controller and the right place to start. Locar also offers rental companies a way to erase a customer's personal files directly, and we will forward and assist with a request sent to us by mistake.
Complaints
If you are unhappy with how we have handled your personal data, we would like the chance to put it right: write to support@locar.ai. You can also complain to the supervisory authority in the country where you live, including:
- Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es
- Portugal: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt
Website and waiting list
This section covers the public website at locar.ai and its waiting-list form. The site sets no cookies and stores nothing in your browser. Locar is the controller of the data you give there.
| Purpose | Data | Legal basis |
|---|---|---|
| Managing the waiting list and answering your request to join it (confirming your email, contacting you about your place) | Work email, company, country and fleet size; optionally the number of branches, the tool you use today, a WhatsApp number and a preferred language | Pre-contractual steps at your request |
| Sending you news about Locar by email | Work email and language | Consent, which you can withdraw at any time |
You are on the list only once you confirm your email address. We do not store your IP address, your browser details or the security-check token. Cloudflare hosts the site and provides the Turnstile security check on the form, and Resend delivers our emails; both act as processors on our instructions.
Sign-ups you do not confirm are deleted after 7 days. A confirmed sign-up is deleted after 365 days without activity, including when it became a customer account.
Every email we send has a link to leave. It lets you stop marketing emails, or remove yourself from the list entirely and delete your data at once. You can also write to support@locar.ai to exercise any of your rights.
Security
We protect personal data with encryption in transit, strict tenant isolation designed so that one rental company cannot see another's data, role-based access controls, hashed passwords and tokens, and an append-only audit log of every change.
If a security incident affects your personal data, we notify the affected rental company without undue delay, so it can meet its own legal duties, including any applicable 72-hour notification deadline.
Children
Locar is a business tool for rental companies and their staff. It is not directed at, or knowingly used by, children, and we do not knowingly collect personal data from children.
Changes to this notice
We may update this notice from time to time, for example when we add a feature or change a provider. The current version and date are shown on this page. If a change is significant, we will take reasonable steps to let rental companies know.
Contact us
For any question about this notice or about your personal data, write to support@locar.ai.