Privacy Policy

This policy explains what personal data Rayo Rentals collects, why, and the rights you have over it under the General Data Protection Regulation (GDPR) and similar data protection laws.

Data controller

Rayo Rentals is operated by RobustITConcepts Pvt. Ltd. For any question about this policy or your data, contact us at info@robustitconcepts.com.

What we collect

We only collect data you give us directly, through one of these forms:

• Booking requests (vehicle cards and the booking search page): name, email, phone, pickup/dropoff locations, pickup/dropoff dates, and any notes you add.
• Contact form (Get in Touch, homepage): name, email, phone (optional), subject (optional), and your message.
• Account registration (sign up/login): email, password (stored as a salted hash, never in plain text), and optionally first/last name.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

Cookies and local storage

We keep cookie use to what the site needs to function:

• Session cookies (access_token, refresh_token, csrf_token) - set only once you log in, so you stay signed in and requests are protected against cross-site forgery. These are strictly necessary and can't be turned off without logging out.
• Cookie consent choice - your Accept/Reject choice from the banner is remembered in your browser's local storage, not a cookie, so we don't ask again on every visit.

We do not currently use analytics or advertising cookies.

Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to how we process your data.
• Receive your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email info@robustitconcepts.com.

Data retention

We keep booking and contact-form records for as long as needed to respond to them and to meet our own record-keeping obligations, then delete or anonymize them. Account data is kept for as long as your account is active.