1. Who we are
RentNowPK ("we", "us", "our") operates the car-rental marketplace at rentnowpk.com. We connect customers with verified rental vendors across Pakistan. We are the data controller for the personal information described in this policy. You can reach us at help@rentnowpk.com for any privacy question.
2. What we collect, and why
When you contact a vendor (no account needed)
- Your name and WhatsApp / phone number — so the vendor can reply to your enquiry
- The listing or vendor you contacted, the page you started from, and a short reference code (e.g. RN-7X3K) — so the vendor knows what you're asking about and we can attribute the lead correctly
- Your IP address and browser user-agent — used briefly to prevent abuse (rapid duplicate submissions, scripted spam) and for security logging
When you create a vendor account
- Full name, email address, WhatsApp / phone number
- Password (stored only as a one-way hash — we cannot read or recover it)
- Account preferences and notification settings
When you complete vendor KYC verification
- Your CNIC number
- Photographs of your CNIC (front and back) and a selfie holding your CNIC
- Used solely to verify that the person operating the account is a real Pakistani resident, to satisfy our trust-and-safety obligations to renters
When you list cars and a business
- Business name, city, address, contact numbers, business documents
- Photos of your fleet and your business location
- Listing details (make, model, year, pricing, availability)
When you enable push notifications
- A push subscription endpoint and the cryptographic keys (p256dh, auth) your browser generates — these let us deliver lead alerts to your specific device
- User-agent of the subscribing device, so you can recognise and remove old subscriptions later
Cookies and similar technologies
We use a small number of strictly-necessary cookies and browser-storage entries to keep the site working — most importantly the Supabase authentication session cookie that keeps you signed in as a vendor. We do not use third-party advertising or cross-site tracking cookies. See our Cookies Policy for the full list.
3. How we use your information
- Pass customer enquiries to the relevant vendor (name + phone)
- Verify vendor identity and operate the trust-and-safety review queue (KYC)
- Send vendors push and in-app notifications about new leads
- Calculate per-lead billing for vendors based on the pricing tier of each listing
- Detect and prevent fraud, duplicate enquiries, scripted abuse, and breaches of our Terms
- Improve the platform — measuring which pages perform, which listings convert, fixing bugs
- Comply with Pakistani law and respond to legitimate legal requests
4. Who can see your information
Vendors
When you contact a vendor through our platform, that vendor sees your name, phone number, the listing you enquired about, and the timestamp. They cannot see your enquiries to other vendors, your IP address, or any other personal information you may have submitted to other parts of the platform.
Customers (when you list as a vendor)
Customers browsing the marketplace see your business profile (name, city, photos, ratings, fleet) and your listings. They do not see your KYC documents, your email, your billing data, or any of your other private vendor information.
Service providers (sub-processors) we use to run the platform
- Supabase — database, authentication, file storage; data hosted in their managed region
- Cloudinary — image hosting and transformations for listing and business photos
- Vercel — application hosting, edge network, build infrastructure
- Web-push services (Google FCM, Apple APNS, Mozilla Push Service) — deliver push notifications to your device when you enable them
- Email infrastructure provider — for transactional emails (account verification, password reset, KYC status updates)
Each of these sub-processors is bound by their own data-processing terms and processes data only for the operational purpose described. We do not allow them to use your data for their own marketing.
Legal requirements
We may share information when required to do so by law, valid Pakistani court order, or properly-served regulatory request (e.g. Pakistan Telecommunication Authority, FIA Cybercrime Wing under PECA). We will challenge requests we believe are overbroad or improperly issued.
5. How long we keep your information
- Customer enquiry leads: 24 months from the date of enquiry, then deleted from primary storage
- Vendor accounts: kept for as long as the account is active; deleted on request (see your rights below)
- KYC documents: kept while your vendor account is active, plus up to 12 months after closure for fraud-prevention and dispute resolution
- Cookies: per-cookie expiry — most clear when you close the browser or sign out
- Push subscriptions: removed automatically when the push service tells us they're no longer valid (e.g. you uninstalled the app), or when you toggle notifications off in settings
- Backup copies may persist in encrypted backups for up to 30 days after deletion before they're cycled out
6. Your rights and how to exercise them
- Access the personal data we hold about you
- Correct anything that's inaccurate
- Delete your account and personal data
- Withdraw consent for push notifications and email at any time
- Object to processing on lawful grounds
- Lodge a complaint with us, and ultimately with the relevant Pakistani authority
To exercise any of these rights, email help@rentnowpk.com from the email address tied to your account, or — if you contacted a vendor without an account — include the WhatsApp number you used and the reference code (RN-XXXX) from your enquiry. We respond within 14 days.
7. How we protect your data
- All connections to the site are encrypted with HTTPS (TLS 1.2 or above)
- Database access is governed by row-level security — vendors can only read their own leads, customers' data is segregated, admin access is audited
- Passwords are stored as one-way hashes — even our own engineers cannot read them
- KYC documents are stored in private, access-controlled storage with restricted admin-only access
- Backups are encrypted at rest
- Engineering follows secure-development practices including code review, dependency scanning, and incident response procedures
No internet service is 100% secure. If we ever discover a breach affecting your data, we will notify you and the appropriate authorities promptly.
8. International data transfers
Some of the sub-processors above (notably Vercel and Supabase) operate from outside Pakistan. When we transfer data to them, we rely on their published data-processing terms and on the standard infrastructure protections of major cloud providers. We choose providers that take data protection seriously and review their compliance posture annually.
9. Children
RentNowPK is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
10. Changes to this policy
We may update this policy as the platform evolves or as Pakistani law changes. The 'Last reviewed' date at the top reflects the most recent legal review. For material changes affecting your rights, we'll notify vendors by email and post a notice on the platform before the changes take effect.
11. Contact us
Email help@rentnowpk.com for any privacy question, complaint, or rights request. We aim to acknowledge within 3 business days and resolve within 14 days.