Privacy Policy

This Privacy Policy explains how Carvoy, operated by Eleanor Perrotte ("Carvoy", "we", "us"), collects, uses, and protects information when a car rental business (a "Tenant") and its staff use the platform.

Carvoy is business software: our direct relationship is with the Tenant company and the staff accounts it creates. Tenants also use Carvoy to store information about their own customers (people who rent vehicles). Section 6 explains how that works.

1. Information we collect

Account and business information

• Business details: company name, address, phone, email, currency, and similar settings entered when a Tenant sets up their account.
• Staff accounts: name, email address, and role for each person a Tenant invites to use Carvoy.

Operational data entered by a Tenant

• Fleet records: vehicles, maintenance, insurance, and licensing information.
• Customer records: names, driver's license numbers, dates of birth, phone numbers, email addresses, and physical addresses of the Tenant's own renters.
• Rental agreements, payment records (amounts, method, and dates - Carvoy does not collect or store credit card, debit card, or bank account numbers), expenses, accident logs, and court matter records.

Technical and security information

• Login activity, including IP address and timestamp, kept briefly to detect and block repeated failed login attempts and protect accounts from being guessed into.
• An audit trail of who changed what and when within a Tenant's account, used for accountability and troubleshooting.
• Standard web server logs (e.g. from our hosting provider) generated by normal operation of the service.

2. How we use information

• To provide and operate Carvoy - storing and displaying the records a Tenant enters, and enforcing who on their team can see or change what.
• To secure accounts - for example, rate-limiting repeated failed sign-in attempts.
• To send transactional emails you'd expect: invitations, password resets, and similar account notices. We don't send marketing email without asking first.
• To maintain and improve the service, and to diagnose problems.

We do not sell personal information, and we do not use it to serve third-party advertising.

3. How we store and protect information

Carvoy is built on Supabase (database and authentication) and hosted on Vercel. Data is encrypted in transit. Access within a Tenant's account is controlled by role (for example, sensitive records like license numbers and payment history are restricted from some staff roles), and database-level access rules keep one Tenant's data separated from another's.

No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard measures to protect the information in Carvoy.

4. Who we share information with

We use a small number of service providers ("sub-processors") to run Carvoy, currently Supabase (database, authentication, and email delivery) and Vercel (hosting). These providers process data on our behalf, under their own security and confidentiality commitments, and only as needed to provide their part of the service. We don't share personal information with anyone else except:

• where a Tenant asks us to (for example, help with a support request);
• where required by law, or to protect the rights, safety, or property of Carvoy, our users, or others; or
• as part of a merger, acquisition, or sale of assets, in which case we'd expect any new owner to remain bound by this policy for existing data.

5. Data retention

We keep account and operational data for as long as a Tenant's account is active. Login-security records (IP addresses tied to sign-in attempts) are kept only briefly, typically no more than a day or two, purely to detect abuse. If a Tenant closes their account, we'll delete their data within a reasonable period after giving them an opportunity to export it, unless we're required to keep something longer by law.

6. If you're a customer of a Carvoy Tenant, not a Tenant yourself

If you've rented a vehicle from a company that uses Carvoy, that company - not Carvoy - controls the information they've entered about you, and is responsible for collecting it lawfully and telling you how they use it. Carvoy stores and processes that information on the rental company's behalf, as their service provider. If you have questions about your own information, or want to access, correct, or delete it, please contact the rental company directly - we're not able to act on an individual request without going through the Tenant whose account the data belongs to.

7. Your choices and rights

If you're a Tenant or a staff user, you can review and update most of your own account information directly in Carvoy. For anything you can't change yourself, or to request a copy or deletion of your account data, contact us at the address below.

8. Cookies

Carvoy uses cookies only to keep you signed in and to remember your session - not for advertising or third-party tracking.

9. Children's privacy

Carvoy is business software and isn't directed at children. We don't knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we'll make reasonable efforts to let Tenants know.

11. Contact

Questions about this policy, or requests relating to your own account data, can be sent to eleanorperrotte1@gmail.com.