Privacy Policy

CARVEOO | Version 1.0
Effective date: 2026-10-22
Approval: Approved by the Carveoo owner.

This policy describes the reviewed Carveoo implementation. It does not assert a compliance certification or assign an unconfirmed legal basis, retention period or service-provider contract.

1. Who operates the marketplace

Carveoo connects Guests with professional rental companies (Hosts). The Host supplies the vehicle and handles its rental operations. The Host Terms identify the marketplace operator as Carveoo B.V. Use the existing Help Center for privacy-related requests and questions about the operator’s contact details. No unprovided registered address is asserted here.

2. Account and authentication information

The WordPress and HivePress account system processes your email address, account identifier, password authentication data, profile details you provide, email-verification status and account permissions. Passwords are handled by WordPress authentication rather than being published in a profile. Verification, account setup and password-reset emails are used to operate account access. Email verification is required for the supported Guest booking journey.

3. Search, bookings and order records

Your selections can include vehicle, rental dates and times, pickup and return locations, extras, protection selection and displayed pricing. Booking and WooCommerce order records associate the relevant Guest, Host, vehicle, reservation and order, billing/contact details provided at checkout, price components, currency, status and recorded actions. Handover, return, cancellation, refund requests, disputes and payout review records may include participant confirmations, notes, timestamps and supporting evidence provided through the available workflows. Payment, rental start and physical return are separate recorded events.

The current TEST PAYMENT method records simulated native payment status without collecting money or transferring Host payouts. A simulated paid status is not proof of collected funds. A pre-existing Stripe extension is installed, but actual online collection is blocked pending separate approval and integration. Stripe is not described here as an active Carveoo payment processor, and no card details are requested by TEST PAYMENT.

4. Host companies, verification documents and banking details

Host onboarding collects company name, registration number, business address, island, representative name, business email and telephone; company registration and representative identity documents; vehicle information and photos; and payout account information such as account holder, bank, country, account number or IBAN where applicable and BIC/SWIFT. These support company review, vehicle management and preparation of payout records; providing bank details does not activate a transfer.

The reviewed Carveoo application code stores protected application fields and verification-document file contents as encrypted application data in the WordPress database. Document retrieval requires the application owner or an authorized administrator and a validated request. Vehicle photos use WordPress media storage and can be publicly accessible as media files; do not put identity documents, account details or other private information in vehicle photographs or listing descriptions. Published listings and company details are intended for marketplace discovery. Storage controls reduce exposure but are not an absolute security guarantee.

5. Messaging, reviews and support

Native Guest–Host messages are stored in the site database. Administrator message monitoring is enabled for the existing moderation/support workflow. User message deletion and message attachments are currently disabled; there is no configured message storage period. Do not send unnecessary identity, banking or other sensitive details in a conversation. Public reviews and published listing/company content may be visible to visitors. Internal application review and dispute notes are access controlled. The current Contact page routes reservation questions to native booking messaging rather than a public contact form.

WPForms Lite is installed, but its settings report that entries are not stored in WordPress through Lite and entry backups are not active. That setting does not mean emails or submissions made through other systems are never retained. Any additional forms and their recipients must be confirmed before they are described as active collection channels.

6. Consent and operational evidence

Policy acceptance is an intentional action, not a consequence of simply viewing this page. Supported acceptance evidence associates the account and relevant booking/application context with a timestamp, applicable policy versions and content hashes. The policy-acceptance receipt has no IP-address field. Operational audit records also record actors, events, times and appropriate review notes. These statements do not mean that hosting logs or other system records contain no IP addresses.

7. Technical information and abuse prevention

Requests to the website and external resource providers expose connection information such as IP address and browser request details to those systems. Carveoo uses the connection IP for abuse control and derives keyed rate-limit identifiers rather than storing the raw IP in those counters. Mail rate limits use keyed recipient identifiers. Carveoo mail diagnostic entries record handoff or suppression status and recipient counts, not message bodies or recipient addresses in that specific log. Other WordPress, plugin, email and hosting logs can contain different information; this policy does not assert an unverified hosting-log field set or retention period.

8. Cookies and browser storage

Authentication, account continuity, cart/session functions, language and currency preferences, and trip selections use cookies or browser storage. See the Cookie Policy for reviewed names, purposes and technical lifetimes. Clearing or blocking required storage may interrupt sign-in, verification return, retained selections or checkout. Browser storage is not a substitute for server-side availability, pricing or intentional-consent validation.

9. Recipients and external services

Relevant booking details and messages are shared with the participating Host and Guest for their reservation. Authorized Carveoo administrators can review records needed for platform operations, applications, support and disputes. The website and its backups depend on hosting/storage services; transactional emails use the existing WordPress and hosting mail transport. This policy does not identify unconfirmed contracted hosting/mail entities or data locations. A WordPress plugin being installed does not itself establish a separate cloud processing contract. Questions about these arrangements can be submitted through the Help Center.

The reviewed public pages load Mapbox mapping/geocoder resources from api.mapbox.com and font styles from fonts.googleapis.com, which can lead to font requests to Google infrastructure. Map/location features may send search text or coordinates to the configured map service when used. External requests disclose connection information to the destination service. Google Maps destination links are separate outbound navigation when selected. Exact service terms, data locations, transfers and any required choices need owner review; no claim is made that these resources wait for a consent choice.

No Google Analytics, Google Tag Manager, Meta Pixel or Hotjar script URL was identified in the inspected homepage and vehicle-page script inventory. HivePress and WooCommerce usage tracking are disabled in the settings reviewed. This is a bounded inspection, not a guarantee that every page, administrator tool, hosting service or future integration performs no tracking. WooCommerce internal order reports are different from a visitor advertising tracker.

10. Storage and retention

Account, booking, order, application, message, media and audit data are stored through WordPress, WooCommerce, HivePress and Carveoo database/media systems. Backups can retain copies, including protected Host application data. The reviewed WooCommerce inactive-account and order-data retention fields and native message storage period are blank; no scheduled deletion/anonymization interval is configured through those fields. This describes the configuration, not a promise to retain data indefinitely or delete it after an invented interval. No unconfirmed backup, hosting-log or email-log deletion period is asserted.

11. Requests and account controls

You can review available profile and reservation information through your account and use the existing Help Center for a data-related request. WordPress provides administrator personal-data export and erasure request tools, and HivePress account-deletion settings are enabled. These controls do not mean that deleting an account automatically deletes every order, message, private document, audit or backup. WooCommerce order-data removal on erasure is currently disabled. Request handling is subject to authorized review and applicable requirements; no unconfirmed response or deletion deadline is promised.

12. Further information

Use the Help Center for questions about operator contact details, the applicable handling of a privacy request, hosting/mail arrangements, Mapbox and Google resources, other service providers, retention and backups. This policy does not invent provider contracts, data locations, legal bases, transfer safeguards, deletion deadlines or compliance certifications.

13. Changes and approval

This policy is published as owner-approved version 1.0, effective 2026-10-22. Changes remain editable through WordPress and must be published clearly. Continued use is not recorded as acceptance of new contractual terms; any required Guest or Host policy acceptance remains intentional and versioned.

Related policies: Host Terms · Host Policies · Guest Terms · Cancellation & Refund · Insurance & Damage · Roadside Assistance · Major Disruptive Events · Privacy · Cookies.