Privacy Policy

AutoRent LB

Last updated: October 5, 2026

1. Introduction

AutoRent LB ("AutoRent", "we", "us", or "our") operates a car and boat rental marketplace in Lebanon, available as a mobile application (iOS and Android) and as a website at www.autorentlb.com. Our platform connects customers who want to rent cars and boats with rental businesses and individual owners ("renters") who list them. Prices on the platform are shown in US Dollars (USD).

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the rights you have over your data. It applies to everyone who uses AutoRent — whether you are a customer, a renter, or simply browsing.

By creating an account or using AutoRent, you agree to the practices described in this policy.

2. Who is responsible for your data

AutoRent LB is the controller responsible for the personal data described in this policy. For any privacy question or request, contact us at:

Email: autorentlb@gmail.com
Phone / WhatsApp: +961 81 51 66 59
Website: www.autorentlb.com

3. Information we collect

We only collect data that we actually use to operate the service. The categories below reflect what the app and website do.

3.1 Account and profile information

When you register and manage your account, we collect:

Phone number (required — this is your primary login identifier)
Password (stored only as a securely hashed value; we never store or see your plain-text password)
First and last name (optional)
Email address (optional)
Date of birth (used to confirm you meet our minimum age requirement)
Profile photo / avatar (optional)
Time zone and language preferences

3.2 Identity verification (KYC)

To rent or list vehicles, you must verify your identity. We collect:

Photographs of your driver's license (front and back) or national ID
A selfie used to confirm the document belongs to you
The document number (stored in encrypted form), the name on the document, and its expiry date

Renters listing vehicles or boats may additionally provide ID documents, vehicle/boat registration documents, ownership proof, and a photo of their rental premises.

These documents are stored on private, access-controlled storage and are not publicly accessible.

3.3 Renter and business information

If you list vehicles or boats, we also collect:

Business name, business description/bio, and logo
Business operating hours
Business location, including address, city, and map coordinates (latitude and longitude)
The Whish mobile-wallet number we use to pay you. This is stored in encrypted form.

3.4 Listings

When you list a car or boat, we collect the details and photos of the vehicle (make, model, year, plate number, color, specifications, pricing, pickup/delivery details, and description).

3.5 Bookings, transactions, and payments

When a booking is made, we collect and store:

Booking dates, status, and the rental and fee breakdown
Your rental history on the platform
Pickup, drop-off, and delivery locations (address, city, and coordinates)
Cancellation reasons, where applicable

Payments. AutoRent currently operates on a cash-on-pickup basis — payment is arranged directly between the customer and the renter, and we record the amounts associated with each booking. We are in the process of introducing card payments through the Whish payment gateway. When card payments become available, card details are handled and tokenized by Whish; we do not store full card numbers — we retain only a payment token and limited details such as card brand, last four digits, and expiry month/year.

3.6 Communications

Messages you exchange with other users through our in-app chat (the message content is stored on our servers)
Reviews and ratings you submit about renters, customers, vehicles, or boats

3.7 Location data

The website and mobile app can use your device's location, only when you grant permission, to help you pin a pickup or business location on a map. This is used in the foreground while you are using that feature — we do not track your location in the background.
When you place a pin, the coordinates are sent to OpenStreetMap's Nominatim service (and, on the website, to the Photon/Komoot search service) to convert coordinates into a readable address. See Section 5.
Coordinates you save (for listings, pickup, delivery, or business locations) are stored with the related record.

3.8 Device and technical information

Push notification token (Firebase Cloud Messaging / Apple Push token) and basic device information (operating system and version), so we can send you notifications. Push notifications are sent only after you allow them.
IP address and browser/app user-agent, recorded for login sessions, identity/phone verification attempts, and administrative audit logs, for security and fraud prevention.

3.9 Cookies and local storage

On the website we use:

A secure, HttpOnly session cookie (cr_session) that keeps you logged in, and a companion presence marker (cr_auth). These expire after about 7 days.
Local storage to remember your push-notification token and certain interface preferences.
A random, anonymous visitor ID in local storage (ar_vid), used only for our own visitor statistics (see Section 11). It contains no personal information, and you can remove it by clearing your browser's site data.
Meta advertising cookies (_fbp and, when you arrive from an ad on Facebook or Instagram, _fbc). These hold a browser identifier and the ad click identifier, used to measure our advertising (see Section 11.2). They expire after about 90 days.

The mobile app stores your login token and cached profile in your device's secure storage (Android encrypted storage / iOS Keychain), which is cleared when you log out.

See Section 11 for analytics and advertising technologies.

4. How we use your information

We use your data to:

Create and manage your account and authenticate you
Verify your identity and eligibility to rent or list (KYC)
Operate the marketplace: publish listings, process booking requests, and coordinate pickups, deliveries, and returns
Record bookings and process payments, payouts, and refunds
Enable messaging, reviews, and ratings between users
Send you transactional notifications (booking updates, verification results, security messages) by push, SMS, and email
Protect the platform against fraud and abuse and keep accounts secure
Comply with our legal obligations under Lebanese law
Improve and maintain the service

We do not sell your personal data.

5. How we share your information

We share personal data only as needed to run the service, and only with the following categories of recipients:

5.1 Other users of the platform

To make a booking work, certain information is shared between the customer and the renter — for example, the customer's name and contact details and the pickup/delivery location are made available to the renter once a booking is committed, and renter/business details are shown to the customer. Reviews and ratings you publish are visible to other users.

5.2 Service providers and processors

Provider	Purpose	Data shared
Google / Firebase Cloud Messaging	Delivering push notifications to your device	Push token, notification content
BroadNet (SMS gateway)	Sending one-time passcodes (OTP) by SMS	Phone number, OTP message
Whish (payment gateway)	Card payment processing, once card payments launch	Payment and transaction details (card data is handled by Whish; we receive a token, not the full card number)
OpenStreetMap – Nominatim	Converting map coordinates to an address (reverse geocoding)	Map coordinates you select
Photon / Komoot (website only)	Location search suggestions	Your location search query
CARTO / OpenStreetMap	Displaying map tiles (website)	Standard request data needed to load map images
Hostinger	Hosting our servers, application, and database	All data is hosted on this infrastructure
Email (SMTP) provider	Sending transactional emails (e.g. verification links)	Your email address and message content

We require our service providers to handle your data only as needed to provide their service to us.

5.3 Advertising partners

Unlike the service providers in Section 5.2, the companies below do not handle this data solely on our instructions: they process it to provide advertising measurement to us, and may also use it for their own purposes under their own terms.

Google (Google Ads and Google Analytics, loaded through Google Tag Manager, website only). We share data with Google to measure the effectiveness of our advertising: standard web request data (including IP address and browser user-agent), Google advertising and analytics identifiers, pages viewed, and advertising events such as a booking request. See Section 11.1.
Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Meta Pixel and Conversions API, website only). We share data with Meta to measure the effectiveness of our advertising on Facebook and Instagram: IP address, browser user-agent, Meta browser and click identifiers, pages viewed, booking events, and your email address and phone number in hashed form only. See Section 11.2 for the details and your choices.

5.4 Legal and safety

We may disclose data where required by law, court order, or a lawful request from Lebanese authorities, or where necessary to protect the rights, safety, or property of AutoRent, our users, or the public.

6. International data transfers

AutoRent is operated for Lebanon, but some of the service providers and advertising partners listed in Section 5 — including Google (and Firebase), Meta, the Whish gateway, our hosting provider Hostinger, and our email provider — process data on servers that may be located outside Lebanon. Where this happens, your data may be transferred to and stored in other countries. We use reputable providers and take reasonable steps to protect your data wherever it is processed.

7. Data retention

We keep personal data only as long as necessary for the purposes described in this policy, and as required by Lebanese law:

Account and profile data — kept while your account is active and for a reasonable period after closure.
Identity verification (KYC) records — retained for at least five (5) years after the end of our relationship with you, in line with Lebanese anti–money-laundering requirements (Law No. 44/2015).
Booking, payment, and financial records — retained for up to ten (10) years, in line with Lebanese commercial record-keeping requirements.
Security and audit logs (including IP addresses) — kept for a limited period for security and fraud-prevention purposes.

When data is no longer needed and no legal retention obligation applies, we delete or anonymize it.

8. Security

We take reasonable technical and organizational measures to protect your data, including:

Encryption at rest of sensitive fields such as ID/document numbers and the Whish mobile-wallet number used for payouts
Hashing of passwords and one-time passcodes (these are never stored in readable form)
Private, access-controlled storage for identity documents and uploaded photos
Screen-capture protection on sensitive screens in the mobile app (such as identity verification and wallet screens)
Encrypted transport (HTTPS) for data in transit

No method of transmission or storage is completely secure, but we work to protect your information and continually improve our safeguards.

9. Your rights

Under Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your personal data, subject to our legal retention obligations
Restrict or object to certain processing of your data

You can update much of your information directly in the app or website (profile, contact details, listings). To exercise any of these rights, email us at autorentlb@gmail.com or call/WhatsApp +961 81 51 66 59. We may need to verify your identity before acting on a request.

Account deletion

You can delete your account directly from the website or app: go to your account settings and select Delete Account. Alternatively, you can contact us at autorentlb@gmail.com or +961 81 51 66 59 and we will process the request after verifying your identity. Please note that we may need to retain certain records (such as identity and financial records) for the legal retention periods described in Section 7 even after your account is closed.

10. Children's privacy

AutoRent is not intended for children. You must be at least 18 years old to create an account and use the service. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it. If you believe a minor has provided us with personal data, please contact us at autorentlb@gmail.com or +961 81 51 66 59.

11. Cookies, analytics, and advertising

Beyond the essential cookies and storage described in Section 3.9, our website uses the advertising measurement tools below. They run only when they are enabled in our configuration.

11.1 Google

Our website uses Google Tag Manager to run Google Ads conversion tracking and Google Analytics, to measure the effectiveness of our advertising — for example, to record when a booking is requested. This involves Google receiving standard web request information.

11.2 Meta (Facebook and Instagram)

Our website uses the Meta Pixel (in your browser) and the Meta Conversions API (from our servers) to measure how well our ads on Facebook and Instagram work — for example, how many people who saw an ad went on to view a listing or request a booking — and to help Meta show our ads to people likely to be interested.

What is collected and sent to Meta:

Your IP address and browser user-agent
The Meta browser identifier (_fbp cookie) and, if you arrived from a Facebook or Instagram ad, the ad click identifier (_fbc cookie)
The pages you view on our website, including which listing you looked at
Booking events: opening the booking form, submitting a booking request, and a booking being confirmed by the renter, together with the listing, the rental length, and the booking amounts
If you are signed in: your email address, phone number, and an internal account identifier. These are hashed with SHA-256 on our servers before they are sent — Meta receives only the one-way hash, never the readable email address or phone number, and uses it to match the event to a Meta account.

Who receives it. This data is shared with Meta Platforms Ireland Ltd. and Meta Platforms, Inc. Meta processes it to provide advertising measurement to us, and may also use it under its own terms. See Meta's Privacy Policy for how Meta handles data.

Your choices. You can limit or stop this:

In your browser: block third-party cookies, clear your cookies and site data, or use your browser's tracking-prevention or ad-blocking features.
In your Meta account: adjust your Ad preferences, and review or disconnect activity shared by businesses under Your activity off Meta technologies.

Bookings arranged outside our website — for example by phone or WhatsApp — are not shared with Meta.

11.3 Our own visitor statistics

Our website also keeps its own anonymous visitor statistics, which never leave our servers: which pages are opened, how the visit started (for example a search engine, a social network, or a tagged link), roughly how long the site was open, the type of device and browser, and the country and city estimated from your IP address. The IP address is used only for that estimate and is not stored; visitors are counted with a one-way code that changes every day, so these statistics cannot identify you or follow you from one day to the next. They are deleted after 90 days. Location estimates use IP Geolocation by DB-IP.

Our mobile app does not include any third-party analytics, advertising, or crash-reporting SDKs, and bookings made in the mobile app are not shared with Meta.

12. Third-party links and services

The app and website may link to third-party services (for example, opening a location in Google Maps, or contacting a renter by phone or messaging app). Once you leave AutoRent, the privacy practices of those third parties apply, and we are not responsible for them.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the app, website, or by other means. Your continued use of AutoRent after an update means you accept the revised policy.

14. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Email: autorentlb@gmail.com
Phone / WhatsApp: +961 81 51 66 59
Website: www.autorentlb.com