Privacy Policy

Kapi Cars is operated by KAPI LLC, Somerville, MA. This policy explains what personal information we collect on our website and services, how we use it and who we share it with. Hosts who rent you a car receive the details in section 4 and handle them under their own policies.

• Account: name, email address, password (stored only as a one-way hash), and phone number.
• Identity and eligibility: date of birth; driver’s license number, state, issue and expiry dates, and photos of the front and back of your license; your home address.
• Insurance: the coverage you choose and any proof of insurance you upload (for example an insurance card).
• Payment: billing name and address and card details, collected by Stripe. We see only the card brand, last four digits and expiry.
• Trips: dates, times, locations, cars booked, trip photos, odometer and fuel readings, damage claims and reviews.
• Messages: messages between you, hosts and our support team.
• Device and usage: IP address, browser and device type, pages viewed, searches and clicks on our site, and the date and time of each visit.

Date of birth, driver’s license details and insurance documents are sensitive. We use them only to check eligibility, verify identity, meet legal record-keeping rules and handle claims.

• create and secure your account, and stop fraud and bots;
• check your age, phone and driver’s license before a trip;
• process bookings, payments, refunds, tolls, tickets and damage claims;
• send booking confirmations, trip reminders and other service messages;
• connect you with your host and provide support;
• keep records the law requires (for example rental records and tax records);
• understand how the site is used so we can improve it (first-party analytics only).

We do not sell your personal information. We share it only as follows:

• Your host: for a confirmed trip, your name, phone, email, driver names, license check result and trip details. Guests see the host’s business name and car details.
• Service providers that work for us, each receiving only what its job needs:
  • Stripe (payments and payouts): name, email, billing address and card details (card numbers go straight to Stripe; we never store them).
  • Resend (sending email): your name, email address and the content of the email (receipts, trip updates, notices).
  • Twilio (text messages): your phone number and the text of verification codes and trip messages.
  • Google reCAPTCHA (stopping bots on sign-up and login): device and browser information, IP address and how you interact with the page (Google’s own privacy policy applies).
  • Google Sign-In (signing in with Google, if you choose it): your name, email and Google account ID.
  • Bonzah (Pablow, Inc.) (trip insurance, when you buy it): name, date of birth, address, driver’s license details, the drivers on your trip, and trip and car details needed to issue the policy.
  • Sentry (error monitoring): technical details when something fails, which can include your account ID, IP address and the request that failed.
  • Vercel and Railway (hosting): all site data is stored on and served from their infrastructure.
  • Certn (background or driving-record checks, only if we ask you first): the identity and license details needed for the check.
• Legal and safety: toll agencies and police (for example for tolls, tickets or a stolen car), insurers handling a claim, and anyone the law requires us to share with.
• Business transfers: a buyer of our business, under this policy.

We do not share personal information with other companies for their own direct marketing (California “Shine the Light”, Civ. Code §1798.83).

We use cookies and browser storage that the site needs to work: to keep you signed in, remember your searches and preferences, and protect forms from bots. We measure site use with our own first-party analytics. We do not use advertising cookies, and we do not allow third parties to track you across other websites over time through our site. Google reCAPTCHA and Google Sign-In run Google code on pages where they appear, under Google’s privacy policy.

Do Not Track: our site does not change its behavior when your browser sends a “Do Not Track” signal, because we do not do cross-site tracking in the first place.

We text you when you verify your phone number at booking and for trip updates. Message frequency varies, usually 2 to 5 messages per trip. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Opting out may stop trip updates and verification codes.

We protect your data with access controls, encryption in transit (HTTPS), and hashed passwords. Card numbers are handled only by Stripe. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

• Booking and payment records: 7 years (tax and audit rules).
• Rental records (renter name, address, license number and state, car and trip times): at least 12 months after each trip, as rental laws require.
• Trip condition photos and damage-claim files: 3 years.
• Your payment method at Stripe: 90 days after you delete your account, to settle late tolls and tickets.
• Everything else: until you delete your account.

You can review and update most of your information in your profile. To get a copy of your data, correct something you cannot edit, or ask a question, email privacy@kapicars.com. We answer within 30 days. If we say no, we tell you why, and you can reply to ask us to review the decision.

You can delete your account from Profile Settings. When you do, we immediately remove or anonymize your name, email, phone, date of birth, home and billing address, driver’s license number and details, license photos, profile photo and uploaded insurance proof, and you can no longer log in. We keep only what section 8 says we must keep. You cannot delete your account while you have an active trip, an open damage claim or an unpaid balance.

You can stop marketing emails at any time by emailing privacy@kapicars.com, and stop texts by replying STOP. We do not treat you differently for using any of these choices.

Our services are not for anyone under 18, and we do not knowingly collect their data.

When we change this policy we update the effective date above. If the change is important, we tell you by email or on the site before it applies.

KAPI LLC, Somerville, MA · privacy@kapicars.com