Privacy policy

This policy explains what personal data IC Car Rent handles, what for, and how you exercise your rights.

Last updated: 2 September 2026

Data we collect

For the account: email and password, stored only as a hash. For the profile: name and phone, if you fill them in. For the booking: dates, city, vehicle and the status history. For the checklist: the photos you take of the car at pickup and at return.

What we use it for

To create the account, process the booking, send the booking emails and settle disputes about the condition of the vehicle. We do not sell data and we do not use it for third-party advertising.

Who processes it

The data sits in a PostgreSQL database we manage. Emails go out through Resend and payment is processed by Teya, each handling only what its job requires.

Card details

Card details are entered in Teya's checkout and never reach our servers.

Cookies

We use one httpOnly session cookie to keep you signed in for 30 days. We do not use advertising cookies.

Inspection photos

Checklist photos are only accessible to the administrator and to the person who made the booking. None of them appear on the public site.

Your rights

You can access and correct your data, download a structured copy, and request deletion, restriction or object to processing through the authenticated form on this page. Some records may be retained when required by law or to establish, exercise or defend legal claims.

Legal basis and data minimisation

Account and booking data is processed to provide the requested service, meet legal obligations and protect legitimate operational and security interests. We collect only information necessary for those purposes.

Retention and security

Data is kept only for the service, statutory retention periods and the resolution of disputes, then deleted or anonymised. Access is role-based, passwords are hashed, session cookies are httpOnly, and administrative permission changes are authenticated and logged.

Processors and international transfers

Railway/PostgreSQL hosts application data; Resend delivers transactional email; Teya processes payments without card details passing through our servers. Transfers outside the data subject's country must use the safeguards required by applicable Brazilian and European law.

Your privacy rights

Download a copy of your data or submit an authenticated request. Requests are reviewed because some booking and tax records may need to be retained by law.

Help center