How we handle your data

01Who is responsible

The controller of your data is WALVIS, the publisher of RentalProof and RPA.

We apply the Swiss Federal Act on Data Protection (FADP) and, for people living in the European Union, the General Data Protection Regulation (GDPR).

02What we collect

Your account

• Your email address, verified by a one-time code.
• Your name, and the phone number you give (we don’t verify it).
• How you arrived at RPA: a shared report, a campaign (for example Instagram), a site that mentioned us. We keep this point of origin on your account.

Each condition check

• The photos and video you take, and the areas you mark as damage.
• Your voice during the video, transcribed automatically into text to list the faults you describe.
• Your phone’s GPS position at capture, with its accuracy, and the matching place (for example “Faro Airport”).
• The time recorded by our server, your phone’s time and your time zone.
• The licence plate (read automatically from your photos or typed by you), the mileage and the fuel level if you enter them.
• The rental company you chose and the email address the report is sent to.

Your feedback

• If you give us feedback (at the end of an article or after sending a report): the rating, your comment, the language, the page it came from and, only if you tick the box, your email so we can reply. Feedback stays private unless, after sending a report, you tick the box to publish your comment with your first name on the site.
• After you send a report, the rating you give the rental company (1 to 5). It stays private unless you tick the box so it counts, anonymously, in the company’s public average. That average only appears from 10 ratings; no name or comment is ever published.

Your use of the site and the app

• Cookie-free statistics: pages viewed, key actions (for example “report sent”), country, device type, language, referring site. They can’t identify you.
• If you accept cookies: Google Analytics measurements (see the Cookies section).
• Technical logs (IP address, errors) for security and troubleshooting, kept briefly.

03Why we collect it

• To produce and send your report: that is the service you ask us for. Without photos, time, place and the company’s address there is no report.
• To keep your proof so you can find it and present it if there is a dispute.
• To seal the report so anyone can verify your files haven’t changed since capture.
• To understand how RPA is used and improve it: which pages are viewed, where people stop, what brings new users.
• To protect the service against abuse and failures.

Legal bases (GDPR): performance of the service you request (art. 6.1.b) for the report, its storage and its sealing; our legitimate interest (art. 6.1.f) for cookie-free statistics, security and tracking where sign-ups come from; your consent (art. 6.1.a) for Google Analytics and the Reddit pixel.

04Who receives your data

• The rental company you choose receives by email your name, the vehicle, the time and place, and the link to the full report (photos, video, transcript).
• Our technical provider, MindStudio, hosts the site, the database and the files, sends the emails, and runs the automatic services: plate reading on your photos, transcription of your voice. These services may rely on third-party AI providers, only to produce your report.
• Google, only if you accepted cookies, receives the Google Analytics measurements.
• Reddit, only if you accepted cookies, receives page visits and two events (account created, report sent) to measure our ads on Reddit. We send it no email and no phone number.
• The OpenTimestamps servers receive a digital fingerprint (a 64-character code) of your report, never your files nor any personal data.

We don’t sell your data and we don’t share it with anyone else, unless the law requires us to.

05Where your data is stored

Your data is stored with our technical provider, MindStudio (Remy platform). Some processing (hosting, email sending, AI services, Google Analytics) may take place outside Switzerland and the European Union, in particular in the United States.

These transfers rely on the mechanisms recognised by Switzerland and the European Union: adequacy decisions (including the Data Privacy Framework for certified US companies) or standard contractual clauses.

06How long we keep it

• Your condition checks (photos, video, report): 3 years after sending, the period during which a rental company can still raise a claim. They are then deleted automatically. You can delete them earlier from the app.
• Your feedback and rental-company ratings: 3 years.
• Your account: as long as it exists. You can delete it from My account; your condition checks are deleted with it.
• Cookie-free statistics: detail kept 90 days, then anonymous totals only.
• Google Analytics: 14 months, per Google’s configuration.
• Reddit pixel: 90-day cookies.
• Technical logs: a few weeks.

07The report link

Each report has a long web address that cannot be guessed. It is sent to the rental company and to you. Anyone who has this link can see the report, without an account: that is what lets the company open it from its email.

The report is not listed on our site and is not meant for search engines. Share the link only with the people concerned. Deleting the report from the app makes the link inactive.

08Your rights

At any time you can access your data, correct it, get it in a readable format, have it deleted, object to processing based on our legitimate interest, and withdraw your consent for measurement cookies.

• From the app (My account, by tapping your avatar): download all your data, delete a condition check, or delete your account.
• By email to hey@rentalproof-app.com: any other request. We answer within 30 days.

If you believe your rights are not respected, you can contact the Swiss Federal Data Protection and Information Commissioner, the CNIL (France), the AEPD (Spain) or the authority of your country.

09Cookies and local storage

RPA runs with very few cookies, and no advertising cookies.

Needed to work

• A session cookie to keep you signed in.
• Local storage on your phone for: your language, your cookie choice (6 months), where your visit came from (90 days), and the condition check in progress before it is sent.

Audience measurement

• Our own statistics, with no cookie, no persistent identifier and no stored IP address: on for everyone.
• Google Analytics, only if you tap “Accept”: _ga cookies (13 months at most), truncated IP address, no advertising signals.
• Reddit pixel, only if you tap “Accept”: a _rdt_uuid cookie (random identifier, 90 days) and, if you came from a Reddit ad, _rdt_cid (90 days). It tells us whether our Reddit ads bring sign-ups and sent reports. If you refuse or don’t answer, nothing from Google or Reddit is loaded.

10Security

All connections are encrypted (HTTPS). Files are stored under identifiers that cannot be guessed. Sign-in uses a one-time code, so there is no password to protect. Each report is sealed in Bitcoin, which makes any later change detectable.

11Minors

RPA is for people aged 18 and over, the age required to rent a car. We don’t knowingly collect data from minors.

12Changes and contact

We may update this page. The date and version at the top change with every update. For an important change we will let you know in the app or by email.

For any question about your data: hey@rentalproof-app.com.