Privacy policy

About this page. We wrote it ourselves from public guidance by the UK ICO, the European Data Protection Board, the European Commission and Thailand's PDPC. It has not been reviewed by a lawyer. Parts marked [to be added] are waiting for our company to be registered.

The short version

• Rental businesses use RoveHQ to run their rentals. When you rent from one of them, that business decides what it collects about you and why. It is the controller; RoveHQ is its processor and only handles your information on its instructions. For those records, ask the business first (we will help them answer you).
• RoveHQ is the controller for the accounts of the businesses that use RoveHQ, for our website, and for the renter list: renters who tick "Send me trip extras" so that we can send them offers from our partners.
• We do not sell personal information. We don't use renters' booking records for our own marketing unless they joined the renter list.
• Your information is stored in Singapore. For people in the EU, UK and Thailand we protect it with the transfer safeguards described below.
• You can see, correct, download or delete your information, object to how we use it, and complain to a supervisory authority.

Who we are

[Company legal name — to be added], [registered address — to be added], company number [to be added] ("RoveHQ", "we"). RoveHQ runs the website rovehq.io, the RoveHQ platform at rovehq.app and the renter booking site rove.rent.

Contact for anything on this page: privacy@rovehq.io.

EU representative (Article 27 GDPR): [to be appointed]. UK representative (Article 27 UK GDPR): [to be appointed]. We have not appointed a Data Protection Officer: at our size and with our activities we don't believe one is required (Article 37 GDPR), and we will review that as we grow.

Whose information this covers

What we collect and why

Business accounts (RoveHQ is controller)

Renters' booking records (the business is controller, RoveHQ is processor)

When you book with a business on RoveHQ, the business collects your name, contact details, date of birth, nationality, address or hotel, passport and driving licence details and photos, a selfie, your signature, your bookings, payments, deposits, vehicle checks with photos, and messages. The business uses these to rent you a vehicle, check who you are and keep its records. RoveHQ stores and processes them only on the business's instructions, under our data processing agreement. The business's own privacy notice tells you its legal bases and how long it keeps them.

Shared customer history. A business may report a serious problem with a rental that was handed over (unpaid rent, damage, a vehicle not returned, false documents). Other businesses on RoveHQ that later check the same person see the report and the name of the business that made it. Businesses must report only rentals that really happened and facts that are true. You can reply to a report or dispute it, and RoveHQ may remove reports. The businesses run this as controllers, relying on their legitimate interest in preventing fraud and loss; RoveHQ provides the tool.

Shared rental prices. RoveHQ combines the daily prices businesses charge for the same vehicle model into unnamed market figures, shown only when at least three businesses have that model. No renter information is used.

The renter list (RoveHQ is controller)

If you tick "Send me trip extras" on a booking form, you agree that RoveHQ keeps its own copy of your name, contact details, nationality, licence country, language, date of birth and a summary of your rentals (which business, vehicle, dates, amount, extras), and that we may send you offers from our travel partners.

• Legal basis: your consent (Art. 6(1)(a) GDPR; Section 19 PDPA).
• Withdraw any time: untick the box on your booking page, or email privacy@rovehq.io. When you withdraw, we delete your copy straight away (contact details and rentals). We keep only a matching key and the date you withdrew, so that we don't add you back by mistake.
• We don't give your details to partners; we send their offers ourselves.

AI reading of photos

To save typing, RoveHQ uses AI to read photos people upload: passports, driving licences, receipts and payment slips. The photo is sent to our AI provider (Anthropic; if it is unavailable, OpenAI or Google Gemini), which returns the text it reads (name, numbers, dates, amounts). A person at the business can check and correct the result. Our AI providers process the photos under their business terms: they don't use them to train their models and keep them only for a short time for safety and abuse monitoring. No decision with legal or similarly significant effects is made by AI alone (Article 22 GDPR).

Website visitors

How long we keep it

Where your information is stored, and transfers abroad

Our database and file storage are in Singapore (Supabase, on Amazon Web Services' ap-southeast-1 region) and our application runs in Singapore (Vercel). Some of our providers are in the United States and other countries: see sub-processors.

• From the EU/EEA: Singapore has no EU adequacy decision, and neither does the United States except for companies certified under the EU-US Data Privacy Framework. So we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914): in our contracts with providers and, for businesses' data, in our data processing agreement, together with the security measures described there.
• From the UK: we use the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses (or its International Data Transfer Agreement). The EU's adequacy decisions for the UK were renewed in 2025 and run to 2031, so data can also flow from the EU to the UK.
• From Thailand: transfers follow Section 29 of the PDPA and the PDPC's 2023 notifications on cross-border transfers, using contract clauses with appropriate safeguards.

You can ask us for a copy of the safeguards that apply.

How we protect it

Encryption in transit (HTTPS) and at rest; each business's records are kept apart by database rules (row-level security); ID photos and documents are private files opened only through short-lived links; staff access is limited and logged; RoveHQ support can view a business only when the business asks, for a limited time, and the business can see that it happened.

Your rights

Under GDPR, UK GDPR and the PDPA you can ask to:

• access your information and get a copy;
• correct it;
• delete it (the "right to be forgotten");
• restrict how it is used, or object to uses based on legitimate interests, and always to direct marketing;
• take it with you in a common format (portability);
• withdraw consent at any time (this doesn't affect what was done before);
• not be subject to decisions made only by automated means that significantly affect you.

How: business owners can download or delete their business's data in My account. Renters should contact the business they rented from: it can export or delete your record from your customer page in RoveHQ. If you can't reach the business, or your request is about the renter list, email privacy@rovehq.io. We reply within one month (we may extend that by two months for complex requests and will tell you why). We may ask you to prove who you are.

Complaints

Please talk to us first. You can also complain to a supervisory authority, for example:

• UK: Information Commissioner's Office, ico.org.uk
• EU/EEA: the data protection authority in the country where you live or work (list at edpb.europa.eu)
• Thailand: Personal Data Protection Committee, pdpc.or.th

Children

RoveHQ is for businesses and adult renters. We don't knowingly collect information about children under 16.

Changes

If we change this policy in a way that matters, we will update the date at the top and tell business owners by email or in the app before the change takes effect.