Skip to content
Rent RideRent Ride

Privacy Policy

Last updated 7 September 2026

Resurf LLC ("Company," "we," "us," or "our") operates the Rent Ride software platform ("Service"). This Privacy Policy ("Policy") governs our data handling practices for business account holders, visitors, and platform end-users. By accessing or using the Service, you acknowledge the data practices described herein. This Policy explicitly delineates between data where we act as a Data Controller (our business customers and platform visitors) and data where we act strictly as a Data Processor (renter records entered by our business customers).

1. Scope, Legal Roles, and Responsibility Isolation

Every privacy right, statutory duty, and operational obligation under applicable data protection laws depends directly on your legal relationship to the Service:

Business Account Holders (Data Controller)

If you register an account or operate a workspace on Rent Ride, we act as a Data Controller for your account identity, billing details, platform usage logs, and support communications. This Policy serves as your primary legal notice, and rights must be exercised directly against us.

Vehicle Renters & End-Users (Data Processor)

If you rent a vehicle from a business utilising Rent Ride, that business acts as the sole Data Controller of your personal data. We process your data strictly as a Data Processor pursuant to the contractual instructions and Data Processing Addendum (DPA) executed with that business. We do not decide what data is collected or how it is used. All data subject access requests, deletion requests, or privacy inquiries regarding renter data must be submitted directly to the respective rental business.

Website Visitors (Data Controller)

For visitors browsing our public marketing websites, we act as the Data Controller for limited technical server logs collected during your access session.

2. What We Collect About Account Holders

We collect personal data necessary to establish, maintain, fulfill, and secure your subscription and workspace instances:

Identity and Profile Data

Full name, professional email address, telephone number, and workspace avatars. Where single sign-on (SSO) is enabled via external identity providers (Google OAuth), we process only the verified identity tokens, display name, and primary email address vouched for by the provider.

Entity and Tax Information

Legal business name, commercial registration numbers, tax identifiers, business address, currency, time zone, and billing contact information used to issue valid tax invoices.

Authentication and Access Credentials

Hashed authentication tokens, session cookies, security log identifiers, and OAuth connection metadata. We do not store plain-text passwords.

Billing and Financial Data

Subscription selections, payment history, invoices, and billing addresses. Payment card details are processed directly by PCI-DSS compliant payment gateways on tokenized pages. We never store or transmit full primary account numbers (PAN).

Audit and Telemetry Records

System activity trails recording workspace actions, API logs, IP addresses, browser agent metadata, HTTP headers, system interaction timestamps, and runtime error telemetry.

Product Usage Analytics

Which pages and features are opened and which controls are used, together with the browser, the referring page, and a coarse location derived from the network address. Recorded against a random identifier held in your browser, and associated with your account identifier once you have signed in. It is behavioural rather than diagnostic, which is why it is listed apart from the record above. Session recordings are kept alongside it, with the text of every page and the value of every field masked by your browser before a recording is sent, so the contents of your screen are not among what we receive. See our Cookie Policy for how to refuse it.

Support Communications

Support correspondence, feedback, diagnostic uploads, and communications sent to our legal or operating teams.

3. Customer-Managed Renter Data (Processed on Customer Instruction)

Our business customers input, store, and process personal data relating to vehicle renters within their isolated workspace. We hold this data strictly as a Data Processor under contract and disclaim liability for our customers’ compliance with legal bases for collection:

  • Full legal names, personal email addresses, and phone numbers.
  • Residential and postal addresses, dates of birth, and driver’s licence numbers, issuing jurisdictions, and expiration dates.
  • Customer-uploaded documents, including digital scans of driving licences and any other identity or supporting document the business chooses to attach, held in private storage buckets that are not readable by URL.
  • Reservation schedules, recorded payment and refund entries, damage reports, vehicle inspection logs, system-generated rental agreements and invoices, and free-text operational notes.
  • Any custom data fields configured independently by the business customer within their workspace forms, including any files attached to them.
  • Where the business emails a renter through the Service, the queued message retains the rendered content, being the renter’s name, the booking, the vehicle, the dates and the amounts, as the record of what was sent.

4. Invoice Links Shared with Renters

One feature deliberately discloses renter data outside the workspace, and it is described here so that a business customer can account for it in its own privacy notice.

  • An invoice issued in the Service can be shared with the renter it is addressed to as a link containing a long random token. Anybody holding that link can open the invoice without signing in.
  • The invoice shows what an invoice shows: the renter’s name, email address, telephone number and postal address, the booking, and the amounts.
  • The link expires ninety (90) days after it is issued. Until it does, its security is the secrecy of the token, so it should be sent to the renter and not published.
  • Whether to send it, and to whom, is the business customer’s decision as controller.

5. Lawful Bases and Business Purposes

Contractual Performance

Provisioning workspaces, verifying account identity, processing payments, executing system operations, delivering transactional emails, and fulfilling our operational obligations. We also write to account holders about their own account: what a workspace still needs set up, when an allowance has been reached, when a trial is ending, and when a payment has failed. Notices about your account and your billing are sent regardless of any marketing preference, because they concern the service you are paying for; the rest carry a one-click unsubscribe link and can be refused without losing them. None of it is advertising, and nothing is sent on anybody else’s behalf.

Legitimate Business Interests

Maintaining application performance, detecting and mitigating security vulnerabilities, monitoring infrastructure health, preventing fraud or abuse, enforcing platform Terms of Service, defending legal claims, and measuring how the product is used so that it can be improved. The last of these is analytics, and it is the one entry here that is a choice rather than a necessity: it is limited to our own product, is never combined with your activity on other sites, is never sold or shared for advertising, and can be refused in your browser without any loss of function. A browser sending a Do Not Track signal is excluded from it automatically.

Legal and Regulatory Obligations

Complying with statutory accounting rules, tax disclosure obligations, financial audit demands, and valid legal process issued by court orders or law enforcement bodies.

Renter Data Processing

Customer-managed renter records are processed exclusively pursuant to the legal instructions, contracts, and lawful bases established by the business customer.

6. Third-Party Disclosures and Subprocessor Categories

We do not sell, rent, or trade personal data. We disclose personal data to third-party subprocessors strictly on a need-to-know basis under standard contractual data protection terms, grouped by functional category:

  • Cloud Database & Object Storage Providers: Infrastructure vendors hosting relational databases, authentication mechanisms, and encrypted file buckets.
  • Application Hosting & Edge Networks: Cloud distribution and serverless execution networks processing system requests in transit.
  • Payment Processors & Gateway Operators: PCI-DSS compliant financial platforms handling subscription billing, payment tokenization, and tax calculations.
  • Email Communications Infrastructure: Transactional email dispatch services and delivery notification systems handling platform alerts and custom domain communications.
  • Observability, Logging & Error Telemetry: Diagnostic tools capturing aggregated application performance logs, runtime exceptions, and system telemetry.
  • Product Analytics: A usage measurement platform recording which parts of the product are used, so that development is directed by evidence rather than assumption. Events reach it through our own domain rather than from your browser directly.
  • Identity Providers: Where you choose to sign in with Google, that provider authenticates you and returns your display name, verified email address, and avatar. We receive nothing else, and nothing is sent to them unless you choose that route.
  • IP Geolocation: A single country lookup made once during onboarding, to preselect the country and currency on the setup form. It is skipped entirely where our hosting provider has already supplied a country for the request.
  • DNS Publication: Where a business customer asks us to publish its own email DNS records, the records and the domain are written to that customer’s DNS provider on its authorization. Off unless requested.
  • Corporate Restructuring & Legal Advisers: Certified accountants, legal counsel, auditors, or successors in the event of a merger, acquisition, asset sale, or corporate reorganization.
  • Regulatory & Statutory Authorities: Courts, tribunals, or law enforcement bodies where required by law or valid legal subpoena.

7. International Data Transfers

  • Our database, file storage, and the mail sent on behalf of our business customers are hosted in the United States. The messages sent when you sign in, reset a password, accept an invitation, or change your email address are relayed through a mail provider in Ireland, so those carry your email address into the European Union.
  • Transfers of personal data originating from the European Economic Area (EEA), United Kingdom (UK), or Switzerland rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent lawful transfer frameworks.
  • We do not sell personal data or share personal data with third parties for cross-context behavioral advertising.

8. Data Retention and Lifecycle Management

We would rather state this exactly than tidily. Most records here are kept until somebody asks for them to go, and the two things that are purged automatically are purged on schedules worth naming.

Active Workspace Data

Retained for as long as the workspace exists. Canceling a subscription does not delete anything: the workspace becomes read-only and its records stay available to you, because a rental business may need to produce an agreement or an invoice long after it has stopped trading on our software.

Deletion on Request

We delete or irreversibly anonymize a workspace when its owner asks us to, within thirty (30) days of the request, except where the law requires us to keep something. There is no automatic erasure timetable, and we will not delete a workspace you have merely stopped paying for without being asked.

Records You Delete Yourself

Deleting a renter, booking, vehicle or document in the workspace removes it from the application immediately and permanently deletes any files attached to it. The underlying row is retained as a tombstone so that references to it elsewhere, such as an invoice that names a renter, remain legible.

Financial and Tax Records

Invoices and recorded payment entries are retained indefinitely, and in any event for no less than the seven (7) years that statutory tax obligations require. They are not deleted when the record they relate to is.

The Workspace Activity Trail

Swept automatically on a per-plan schedule: ninety (90) days on Enterprise, fourteen (14) days on Professional, and not retained at all on Starter, which does not include the activity log. Deletion is permanent.

Mail, Suppressions, and Operational Records

A message sent through the Service is kept as the record of what was sent, and is not currently purged on a schedule. An address that hard-bounced or reported a message as spam is suppressed for that business permanently, which is what keeps us able to send at all. Our own record of support actions taken on a customer account is append-only and is not deleted.

Infrastructure Logs and Backups

Request and error telemetry is retained by our logging provider on that provider’s configured retention period. Data removed from the live database persists in our hosting provider’s encrypted backups until those age out on their ordinary cycle; it is not restored to the live service and remains subject to this Policy until it is gone.

9. Disclaimers, Security Standards, and Risk Allocation

  • Data is encrypted in transit, and at rest by our infrastructure providers. Uploaded files are held in private storage that cannot be read by URL and is reached only through short-lived signed links issued to an authorized user.
  • Each workspace is separated from every other by scoping enforced on every query the application makes, and the anonymous public interface to our database is closed off entirely rather than relied on to refuse. Within a workspace, what a member can see and do is decided by the role you give them.
  • No method of electronic transmission or cloud storage is completely immune to breach or failure. Resurf LLC explicitly disclaims all strict liability for security breaches outside of our direct operational control.
  • Account holders are responsible for setting strong passwords, protecting authentication credentials, and revoking staff access promptly upon personnel changes. We do not currently offer multi-factor authentication; where you sign in through Google, whatever second factor you have enforced with that provider applies.

10. Data Subject Rights

Depending on your statutory jurisdiction (including GDPR, UK GDPR, and CCPA/CPRA), you may hold legal rights including access, correction, erasure, portability, and restriction of processing. We do not discriminate against any user for exercising legal privacy rights.

Exercising Account Holder Rights

Account holders may submit formal data rights requests by writing to our data protection contact below. We will respond within thirty (30) days, and there is no charge for a first request.

Third-Party Renter Notice

We do not possess legal authority to fulfill, modify, or respond directly to data subject requests submitted by renters. Renters attempting to exercise privacy rights regarding data held within a workspace must contact the respective rental business customer directly.

11. Children’s Privacy Mandate

The Service is enterprise business software and is not directed to individuals under sixteen (16) years of age. We do not knowingly process personal data from children. If you believe child data has reached our systems without statutory authorization, notify us immediately for swift deletion.

12. Modifications and Updates

We reserve the right to amend this Policy at any time. The top date indicates the latest revision. Material changes impacting your rights will be communicated via email or platform announcement prior to taking effect. Continued use of the platform following modifications constitutes acceptance of the updated Policy.

13. Governing Law and Legal Contacts

This Policy and any legal disputes arising hereunder are governed exclusively by the laws of the State of Wyoming, USA, without regard to conflict of law principles.

Operating Entity

Resurf LLC, 5830 E 2ND ST, STE 7000, Casper, Wyoming 82609, United States.

Data Protection Contact hello@rentride.app

privacy@rentride.app