Privacy Policy

Rentiflow ("Rentiflow", "we", "us", "our") provides software for vehicle rental businesses to manage bookings, fleet, customers and communications ("the Service").

Registered company: [Registered company name — to be added], company number [Companies House registration number — to be added], registered office at [Registered office address — to be added].

Contact: contact@rentiflow.com

This policy covers two distinct groups of people, because the roles are legally different:

• Visitors to this marketing website, and staff who use the Rentiflow application on behalf of a rental business we have as a customer ("Customer") — for this data, Rentiflow is the data controller.
• End customers of a rental business — the people who book vehicles through a Customer's use of Rentiflow (names, contact details, booking history). For this data, the rental business is the data controller and Rentiflow acts only as a data processor, acting on that business's instructions. If you are an end customer of a rental business and have a question about your data, please contact that rental business directly in the first instance — Section 7 explains this relationship in more detail.

As controller (marketing site visitors and Rentiflow staff-user accounts), we collect:

• Contact and account details you give us: name, email address, phone number, organisation and branch, when you book a free website review, send an enquiry, or are invited as a staff user by a Customer.
• Correspondence: records of emails or form submissions you send us (e.g. via our free website review or contact forms).
• Technical data: standard web server logs (IP address, browser type, pages visited) generated by visiting this website.

As processor, acting only on a rental-business Customer's instructions, the Rentiflow application stores the data that Customer chooses to enter about its own end customers and its fleet, including:

• End customer details: first name, last name, email address, phone number, and their booking/rental history with that Customer.
• Vehicle records: registration, make, model, and operational status — not usually personal data, but may be linked to an individual customer's booking.

We use personal data we control for the following purposes:

• To provide, maintain and support the Service to our Customers (performance of a contract).
• To respond to enquiries and free website review requests (performance of a contract / steps taken at your request prior to entering a contract).
• To send service-related communications — e.g. account, billing or security notices (performance of a contract / legitimate interest in operating the Service securely).
• To improve the Service and this website, and for basic security monitoring (legitimate interest).
• Where you've separately agreed to receive marketing communications from us (consent) — you can withdraw this at any time.

This website does not currently use analytics or advertising cookies. If that changes (for example, if we add Google Analytics or a similar tool), we will update this section and request consent where required before any non-essential cookie is set.

The embedded booking and enquiry forms on this site are provided by a third party, GoHighLevel/LeadConnector. Loading those embeds may set cookies or use local storage on their domain, governed by their own privacy and cookie policies, not this one — we don't control what they set.

The Rentiflow application itself (used by our Customers' staff) uses a small number of strictly necessary cookies to keep you signed in securely. These aren't optional — without them the application cannot authenticate you — so they're not subject to cookie consent requirements under UK law.

If you're an end customer who has booked a vehicle through a business using Rentiflow, that business — not Rentiflow — is the data controller responsible for your personal data and for responding to requests about it (access, correction, deletion, etc.). We process that data strictly under their instructions, under a data processing agreement that reflects the obligations in Article 28 of the UK GDPR (confidentiality, security, sub-processor approval, assistance with data subject requests, and deletion or return of data at the end of the relationship). A copy of our standard data processing terms is available on request to any Customer or their advisers — contact us at the address below.

We don't sell personal data. We share it only with the service providers who help us run Rentiflow ("sub-processors"), each bound by their own data protection obligations to us, and only to the extent needed to provide the Service:

• Supabase — database hosting and authentication for the Rentiflow application.
• Vercel — hosting for this website and the Rentiflow application.
• n8n — workflow automation used to send transactional emails (booking confirmations, reminders) on a Customer's behalf.
• GoHighLevel (LeadConnector) — powers the enquiry and free website review forms on this marketing website only; not used within the Rentiflow application itself.

Where any sub-processor listed above stores or processes data outside the UK, we rely on an appropriate safeguard recognised under UK data protection law (such as the UK International Data Transfer Addendum or an adequacy decision). [Confirm and document the hosting region for your Supabase project and any other sub-processor before publishing — update this section with the specific safeguard that applies.]

We keep personal data for as long as needed for the purposes it was collected for, or as required by law (for example, financial records are typically kept for 6 years for UK tax purposes). Data we process on behalf of a Customer is retained for as long as their contract with us is active, and deleted or returned within a reasonable period after termination, in line with our data processing terms — see Section 7 and our separate data-retention procedure referenced there.

We apply technical and organisational measures appropriate to the sensitivity of the data involved, including:

• Encryption of data in transit (HTTPS/TLS) across this website and the Rentiflow application.
• Row-level security enforced at the database layer, so a Customer's staff can only ever access their own organisation's data — and, depending on role, only their own branch's data.
• Role-based staff access within each Customer's account, with the ability to deactivate a staff member's access immediately.
• Restricted, narrowly-scoped use of elevated database credentials, limited to specific server-side operations that genuinely require them.

Under UK GDPR, where we are the controller of your data (see Section 2), you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have data erased in certain circumstances.
• Restrict or object to certain processing.
• Receive your data in a portable format, where applicable.
• Withdraw consent at any time, where processing is based on consent.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your data properly.

Rentiflow is a B2B product intended for use by business staff. We do not knowingly collect personal data from children.

We'll update this page if our practices change and update the "last updated" date below. For material changes affecting how we process data on a Customer's behalf, we'll notify Customers directly.

Last updated: 2026-09-15

Questions, requests, or complaints about this policy: contact@rentiflow.com

ICO registration: [ICO registration number — to be added once registered, see icoregisternow.org]