Privacy policy

• Booking details you give us: name, email, phone number, optional date of birth, optional flight number, optional special requests, the driver-age band you selected, and your trip (dates, times, pickup and drop-off).
• Payment data: payments are processed by Stripe. We never see or store your card number — we keep the booking amounts and Stripe's payment references.
• Technical data: the cookies described in our cookie policy and standard server logs (IP address, browser type) kept by our hosting providers for security and reliability.

• To perform your booking (contract): creating and managing the reservation, taking payment, sending the confirmation email, coordinating pickup with the operator.
• Legitimate interests: preventing fraud and abuse, keeping the service reliable, improving the product.
• Consent: optional analytics or marketing cookies are set only after you accept them in the cookie banner — and you can change your mind at any time.
• Legal obligations: keeping booking and payment records for statutory accounting periods.

Your rental operator. To fulfil the booking, the operator receives your name, phone number, flight number, and trip details after payment — that is how they meet you at arrivals with the right car.

Service providers processing data on our behalf: Stripe (payments), Resend (transactional email), Supabase (database), Vercel (hosting), and Telegram (internal booking alerts to our team). Each receives only what its job requires. We never sell personal data.

Your operator is an independent business and becomes a separate data controller for the data it needs to provide the rental; it handles that data under its own privacy terms.

Some providers process data outside the EEA (notably in the United States). Where they do, transfers rely on recognised safeguards — the EU–US Data Privacy Framework or Standard Contractual Clauses.

Booking and payment records are kept for the statutory accounting and tax retention period — around 7 years under the tax law that applies to the operating company. Booking details not needed for that (such as special requests) are deleted within 24 months of the trip. Partner-link attribution is kept while the partner programme is active, for commission accounting. Server logs rotate within a few months. You can ask us to delete your data sooner where we are not legally required to keep it (see your rights below).

Personal data is encrypted in transit (HTTPS), access is limited to the people and systems that need it, and every provider that processes data for us does so under a data-processing agreement. Payment card details never reach our systems — they go straight to Stripe. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Drovy is intended for adults. Renting a car requires a driving licence and a minimum age, so we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

Under the GDPR you can ask us at any time to:

• access the personal data we hold about you,
• correct it, delete it, or restrict how we use it,
• object to processing based on legitimate interests,
• receive your data in a portable format,
• withdraw consent (for anything based on consent) with effect for the future.

Write to hello@drovy.co — we respond within a month. You can also complain to your local supervisory authority; in Portugal that is the CNPD (cnpd.pt).

If this policy changes in a way that matters, we will say so on this page. The date at the top always tells you when it was last revised.