Privacy Policy
AutoRent LB
Last updated: July 1, 2026
1. Introduction
AutoRent LB ("AutoRent", "we", "us", or "our") operates a car and boat rental marketplace in Lebanon, available as a mobile application (iOS and Android) and as a website at www.autorentlb.com. Our platform connects customers who want to rent cars and boats with rental businesses and individual owners ("renters") who list them. Prices on the platform are shown in US Dollars (USD).
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the rights you have over your data. It applies to everyone who uses AutoRent — whether you are a customer, a renter, or simply browsing.
By creating an account or using AutoRent, you agree to the practices described in this policy.
2. Who is responsible for your data
AutoRent LB is the controller responsible for the personal data described in this policy. For any privacy question or request, contact us at:
- Email: autorentlb@gmail.com
- Phone / WhatsApp: +961 81 51 66 59
- Website: www.autorentlb.com
3. Information we collect
We only collect data that we actually use to operate the service. The categories below reflect what the app and website do.
3.1 Account and profile information
When you register and manage your account, we collect:
- Phone number (required — this is your primary login identifier)
- Password (stored only as a securely hashed value; we never store or see your plain-text password)
- First and last name (optional)
- Email address (optional)
- Date of birth (used to confirm you meet our minimum age requirement)
- Profile photo / avatar (optional)
- Time zone and language preferences
3.2 Identity verification (KYC)
To rent or list vehicles, you must verify your identity. We collect:
- Photographs of your driver's license (front and back) or national ID
- A selfie used to confirm the document belongs to you
- The document number (stored in encrypted form), the name on the document, and its expiry date
Renters listing vehicles or boats may additionally provide ID documents, vehicle/boat registration documents, ownership proof, and a photo of their rental premises.
These documents are stored on private, access-controlled storage and are not publicly accessible.
3.3 Renter and business information
If you list vehicles or boats, we also collect:
- Business name, business description/bio, and logo
- Business operating hours
- Business location, including address, city, and map coordinates (latitude and longitude)
- The Whish mobile-wallet number we use to pay you. This is stored in encrypted form.
3.4 Listings
When you list a car or boat, we collect the details and photos of the vehicle (make, model, year, plate number, color, specifications, pricing, pickup/delivery details, and description).
3.5 Bookings, transactions, and payments
When a booking is made, we collect and store:
- Booking dates, status, and the rental and fee breakdown
- Your rental history on the platform
- Pickup, drop-off, and delivery locations (address, city, and coordinates)
- Cancellation reasons, where applicable
Payments. AutoRent currently operates on a cash-on-pickup basis — payment is arranged directly between the customer and the renter, and we record the amounts associated with each booking. We are in the process of introducing card payments through the Whish payment gateway. When card payments become available, card details are handled and tokenized by Whish; we do not store full card numbers — we retain only a payment token and limited details such as card brand, last four digits, and expiry month/year.
3.6 Communications
- Messages you exchange with other users through our in-app chat (the message content is stored on our servers)
- Reviews and ratings you submit about renters, customers, vehicles, or boats
3.7 Location data
- The website and mobile app can use your device's location, only when you grant permission, to help you pin a pickup or business location on a map. This is used in the foreground while you are using that feature — we do not track your location in the background.
- When you place a pin, the coordinates are sent to OpenStreetMap's Nominatim service (and, on the website, to the Photon/Komoot search service) to convert coordinates into a readable address. See Section 5.
- Coordinates you save (for listings, pickup, delivery, or business locations) are stored with the related record.
3.8 Device and technical information
- Push notification token (Firebase Cloud Messaging / Apple Push token) and basic device information (operating system and version), so we can send you notifications. Push notifications are sent only after you allow them.
- IP address and browser/app user-agent, recorded for login sessions, identity/phone verification attempts, and administrative audit logs, for security and fraud prevention.
3.9 Cookies and local storage
On the website we use:
- A secure, HttpOnly session cookie (
cr_session) that keeps you logged in, and a companion presence marker (cr_auth). These expire after about 7 days. - Local storage to remember your push-notification token and certain interface preferences.
The mobile app stores your login token and cached profile in your device's secure storage (Android encrypted storage / iOS Keychain), which is cleared when you log out.
See Section 11 for analytics and advertising technologies.
4. How we use your information
We use your data to:
- Create and manage your account and authenticate you
- Verify your identity and eligibility to rent or list (KYC)
- Operate the marketplace: publish listings, process booking requests, and coordinate pickups, deliveries, and returns
- Record bookings and process payments, payouts, and refunds
- Enable messaging, reviews, and ratings between users
- Send you transactional notifications (booking updates, verification results, security messages) by push, SMS, and email
- Protect the platform against fraud and abuse and keep accounts secure
- Comply with our legal obligations under Lebanese law
- Improve and maintain the service
We do not sell your personal data.
5. How we share your information
We share personal data only as needed to run the service, and only with the following categories of recipients:
5.1 Other users of the platform
To make a booking work, certain information is shared between the customer and the renter — for example, the customer's name and contact details and the pickup/delivery location are made available to the renter once a booking is committed, and renter/business details are shown to the customer. Reviews and ratings you publish are visible to other users.
5.2 Service providers and processors
| Provider | Purpose | Data shared |
|---|---|---|
| Google / Firebase Cloud Messaging | Delivering push notifications to your device | Push token, notification content |
| BroadNet (SMS gateway) | Sending one-time passcodes (OTP) by SMS | Phone number, OTP message |
| Whish (payment gateway) | Card payment processing, once card payments launch | Payment and transaction details (card data is handled by Whish; we receive a token, not the full card number) |
| OpenStreetMap – Nominatim | Converting map coordinates to an address (reverse geocoding) | Map coordinates you select |
| Photon / Komoot (website only) | Location search suggestions | Your location search query |
| CARTO / OpenStreetMap | Displaying map tiles (website) | Standard request data needed to load map images |
| Hostinger | Hosting our servers, application, and database | All data is hosted on this infrastructure |
| Email (SMTP) provider | Sending transactional emails (e.g. verification links) | Your email address and message content |
We require our service providers to handle your data only as needed to provide their service to us.
5.3 Legal and safety
We may disclose data where required by law, court order, or a lawful request from Lebanese authorities, or where necessary to protect the rights, safety, or property of AutoRent, our users, or the public.
6. International data transfers
AutoRent is operated for Lebanon, but some of the providers listed in Section 5 — including Google/Firebase, the Whish gateway, our hosting provider Hostinger, and our email provider — process data on servers that may be located outside Lebanon. Where this happens, your data may be transferred to and stored in other countries. We use reputable providers and take reasonable steps to protect your data wherever it is processed.
7. Data retention
We keep personal data only as long as necessary for the purposes described in this policy, and as required by Lebanese law:
- Account and profile data — kept while your account is active and for a reasonable period after closure.
- Identity verification (KYC) records — retained for at least five (5) years after the end of our relationship with you, in line with Lebanese anti–money-laundering requirements (Law No. 44/2015).
- Booking, payment, and financial records — retained for up to ten (10) years, in line with Lebanese commercial record-keeping requirements.
- Security and audit logs (including IP addresses) — kept for a limited period for security and fraud-prevention purposes.
When data is no longer needed and no legal retention obligation applies, we delete or anonymize it.
8. Security
We take reasonable technical and organizational measures to protect your data, including:
- Encryption at rest of sensitive fields such as ID/document numbers and the Whish mobile-wallet number used for payouts
- Hashing of passwords and one-time passcodes (these are never stored in readable form)
- Private, access-controlled storage for identity documents and uploaded photos
- Screen-capture protection on sensitive screens in the mobile app (such as identity verification and wallet screens)
- Encrypted transport (HTTPS) for data in transit
No method of transmission or storage is completely secure, but we work to protect your information and continually improve our safeguards.
9. Your rights
Under Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your personal data, subject to our legal retention obligations
- Restrict or object to certain processing of your data
You can update much of your information directly in the app or website (profile, contact details, listings). To exercise any of these rights, email us at autorentlb@gmail.com or call/WhatsApp +961 81 51 66 59. We may need to verify your identity before acting on a request.
Account deletion
You can delete your account directly from the website or app: go to your account settings and select Delete Account. Alternatively, you can contact us at autorentlb@gmail.com or +961 81 51 66 59 and we will process the request after verifying your identity. Please note that we may need to retain certain records (such as identity and financial records) for the legal retention periods described in Section 7 even after your account is closed.
10. Children's privacy
AutoRent is not intended for children. You must be at least 18 years old to create an account and use the service. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it. If you believe a minor has provided us with personal data, please contact us at autorentlb@gmail.com or +961 81 51 66 59.
11. Cookies, analytics, and advertising
Beyond the essential cookies and storage described in Section 3.9, our website may use Google Ads conversion tracking (via Google's gtag.js) to measure the effectiveness of our advertising — for example, to record when a booking is initiated or completed. This involves Google receiving standard web request information. This tracking runs only when it is enabled in our configuration.
Our mobile app does not include any third-party analytics, advertising, or crash-reporting SDKs.
12. Third-party links and services
The app and website may link to third-party services (for example, opening a location in Google Maps, or contacting a renter by phone or messaging app). Once you leave AutoRent, the privacy practices of those third parties apply, and we are not responsible for them.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the app, website, or by other means. Your continued use of AutoRent after an update means you accept the revised policy.
14. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:
- Email: autorentlb@gmail.com
- Phone / WhatsApp: +961 81 51 66 59
- Website: www.autorentlb.com