Privacy policy
What data Kiroul processes, why, for how long, and how to exercise your rights.
In short
- We process the data needed for safe rentals: account, ID document, driving licence, vehicle documents, bookings, check-in reports and payments.
- The GPS position is only recorded during the rental, and it is deleted 30 days later (unless there is a dispute).
- No targeted advertising, no trackers, no sale of data. Our providers are listed below.
- Access, correction, account deletion: at any time, from the app or at kiroul@rs-digital.fr.
1. Data controller
| Item | Value |
|---|---|
| Controller | Sarah SOKRI, sole trader trading as RS Digital, publisher of Kiroul |
| Address | 4 avenue Michel Debré, 93360 Neuilly-Plaisance, France |
| Contact | kiroul@rs-digital.fr |
| Data protection officer | None appointed to date |
When an Owner uses a Renter’s data for their own obligations (for example to designate them as the driver after a traffic offence), the Owner acts as a separate controller.
2. Data we process
| Category | Data | Source |
|---|---|---|
| Account | Name, email address, password (hashed, never in clear text), phone, city, date of birth, optional profile photo, Apple or Google identifier if you use them | You |
| Identity verification | Photo of the ID document, verification selfie, verification result (status, date) | You, via Stripe Identity |
| Driving licence | Front and back photos, categories, issue and expiry dates, verification status | You |
| Vehicles | Registration certificate, insurance certificate, roadworthiness test, photos, plate number, specifications, prices and availability | Owners |
| Agencies | Company name, SIREN, company records, team members and roles (manager, agent, accountant) | Agencies |
| Bookings | Dates, handover locations, prices, status, history, cancellations, claims | You and the other party |
| Check-in reports | Time-stamped vehicle photos, mileage, fuel or charge level, electronic signatures | Renter and Owner |
| Location | Vehicle GPS position, during the rental only | [to be completed: Renter’s app and/or GPS tracker] |
| Payments | Stripe identifiers, amounts, payment status, deposits and payouts; Owners’ bank details collected by Stripe. Never your full card numbers | Stripe |
| Reviews | Ratings and comments given and received | Users |
| Support | Messages sent to support | You |
| Technical data | Server logs (method, path, status, duration, without URL parameters), IP address to limit sign-in attempts, sessions, notification token, language [to be completed: device model and app version, if collected] | Your device |
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the matching and rental service | Performance of the contract (Terms) |
| Verify identity, driving licence and vehicle documents | Performance of the contract; legitimate interest (rental safety, fraud prevention) |
| Payments, deposits, payouts and invoices | Performance of the contract; legal obligation (accounting) |
| Check-in reports, claims and disputes | Performance of the contract; legitimate interest (evidence) |
| GPS tracking during the rental | Legitimate interest (safety of vehicles and people, theft prevention) [to be completed: validation of the legal basis and data protection impact assessment (DPIA)] |
| Reviews and moderation | Legitimate interest (trust between Users); legal obligation (article L111-7-2 of the French Consumer Code) |
| Annual reporting of Owners’ income | Legal obligation (article 242 bis of the French General Tax Code) |
| Driver designation, answers to authorities | Legal obligation |
| Service emails (verification, password, bookings) and notifications | Performance of the contract |
| Platform security (rate limiting, logs) | Legitimate interest |
We do not sell your data, show targeted advertising or use any advertising tracker. If an automatic verification is declined, you can ask for a review by a person at kiroul@rs-digital.fr.
4. Recipients and processors
The other party to the rental: the Owner sees the Renter’s name, profile photo, verification status and reviews, and the information needed for the handover; the Renter sees the same information about the Owner and the handover location [to be completed: exact list of shared data]. Members of an Agency access their Agency’s bookings according to their role.
Authorised Kiroul staff (support, verification, moderation), within the limits of their duties.
Our processors, acting on our instructions:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website, API and web space | EU (Frankfurt region); US company |
| Neon Inc. (Databricks group) | Database (Postgres) | [to be completed: region to be confirmed]; US company |
| Cloudflare Inc. (R2) | Private file storage: ID documents, licences, vehicle documents and photos, check-in photos | [to be completed: EU storage jurisdiction to be confirmed]; US company |
| Stripe Payments Europe Ltd | Payments, deposits and payouts to Owners (Stripe Connect); identity verification (Stripe Identity) | Ireland (EU); US group |
| OVH SAS | Sending emails from kiroul@rs-digital.fr and support mailbox | France |
| Google LLC (Google Maps) and Apple Inc. (Maps) | Maps, addresses and directions in the app | USA |
| 650 Industries, Inc. (Expo) | Delivery of notifications and app updates | USA |
On their own behalf: Apple and Google (app download, “Sign in with Apple / Google” if you choose it, notification delivery), authorities where the law requires it (tax authorities, police, the authority handling traffic offences) and, in case of a claim, the parties’ insurers.
5. Transfers outside the European Union
Several providers are US companies (Vercel, Neon, Cloudflare, Stripe, Google, Apple, Expo) that may access data for maintenance or be subject to US law. These transfers are covered by the European Commission’s standard contractual clauses and, for certified companies, by the EU-US Data Privacy Framework adequacy decision of 10 July 2023.
6. Retention periods
| Data | Period |
|---|---|
| Account and profile | As long as the account exists; erased when the account is deleted [to be completed: inactivity period after which the account is deleted] |
| ID document, selfie and licence (files) | As long as the account exists, and erased from our storage when it is deleted [to be completed: earlier deletion after verification?]; verification data kept by Stripe follows its own legal obligations |
| Vehicle documents | As long as the vehicle is listed or the account exists |
| GPS position during the rental | Deleted 30 days after the end of the rental, unless a dispute is ongoing (until it is resolved) or the authorities require it |
| Check-in photos and signatures | [to be completed: retention period] |
| Bookings, payments and invoices | 10 years (accounting obligations, article L123-22 of the French Commercial Code); after an account is deleted, past bookings are kept without any link to that account |
| Reviews | [to be completed: retention period and what happens after account deletion] |
| Support messages | [to be completed: retention period] |
| Technical logs and rate limiting | [to be completed: retention period] |
| Owners’ tax information | [to be completed: legal period to be confirmed] |
8. Your rights
- Access and portability: get a copy of your data in a structured format.
- Rectification: correct your information in the app or by writing to us.
- Erasure: delete your account in the app or on the Delete my account page. Deletion is not possible while a booking is open; your files (ID document, licence, documents) are then erased from our storage.
- Objection and restriction: in particular to processing based on our legitimate interest.
- Instructions on what happens to your data after your death.
To exercise your rights, write to kiroul@rs-digital.fr from your account address; we reply within one month. You can lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France · https://www.cnil.fr) or with the data protection authority of your country.
9. Security
- Encryption in transit (HTTPS) and at rest with our hosting providers.
- Passwords hashed, never stored in clear text; sign-in attempts rate-limited.
- ID documents, licences and vehicle documents stored in a private space, never public.
- Internal access limited to authorised people; notification of the CNIL and the people concerned in case of a data breach.
10. Minors
Kiroul is for adults only. We do not knowingly collect data about minors.
11. Changes to this policy
We will tell you about any significant change by email or in the app. The version date is shown at the top of this page.