CARVEX
Contact

Carvex privacy policy

Effective date: 26 October 2026

1. Purpose

This policy explains which personal data Carvex processes on carvex.net and in its apps, why, and what your rights are. It applies Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data.

2. Data controller

  • Controller: Carvex.
  • Carvex agencies are branches of Carvex. Their staff process your data for the bookings the agency handles.
  • Contact: contact@carvex.net.

3. Data we collect

  • Identity and contact: last name, first name, date of birth, phone, email, address.
  • Sign-in with Google or Apple: an account identifier and, for Google, your profile picture.
  • Driving licence: number, issue date, expiry date.
  • Supporting documents: scans or photos of your identity document (national ID card or passport) and of your driving licence.
  • Rental contract: place of birth, identity document number, drawn signatures of the renter and the drivers.
  • Additional drivers: the same data, entered by you or by the agency. You inform these people of this policy.
  • Bookings: model, dates, places, price, currency, issued documents (proforma invoice, contract, invoices, credit notes, receipts), and booking history.
  • Payments: method, amount, currency, date, status, provider reference, and refunds. Carvex never stores your full card number.
  • Notifications: your preferences and, when you turn on push notifications, the push subscription of your device.
  • Technical data: IP address, sign-in and error logs, browser type, chosen language.
  • Your messages with support.

4. Why we use your data

  • Create and secure your account, and sign you in.
  • Handle your bookings: availability, acceptance by the agency, vehicle handover and return.
  • Issue the rental contract, invoices, credit notes, and receipts.
  • Collect payments and the deposit, and make refunds.
  • Check your identity document and your licence, before and at pick-up.
  • Send you messages about your account and your bookings.
  • Prevent fraud and abuse, and protect the platform from bots.
  • Answer your support requests.
  • Meet our legal, accounting, and tax obligations.

Carvex does not sell your data and does not use it for targeted advertising.

  • Your consent, given when you create your account.
  • The performance of the booking and the rental contract you ask for.
  • Compliance with a legal obligation: accounting, tax, requests from the authorities.
  • The legitimate interest of Carvex in securing the platform and preventing fraud.

6. Sign-in and bot check

  • Email code: Carvex emails you a one-time sign-in code that works once, for 10 minutes.
  • Google or Apple: when you pick this method, Carvex receives your name, your email, and an account identifier from that provider. Google also shares your profile picture. Section 7 covers how Carvex uses Google data.
  • Cloudflare Turnstile: an invisible check tells a person from a bot. For this, Cloudflare processes technical data, such as the IP address and browser signals.

7. Google user data

When you sign in with Google, Google shares your name, your email address, your profile picture, and a Google account identifier with Carvex. Carvex asks Google for no other data.

  • Use: Carvex uses this data only to create your account and sign you in.
  • Storage: Carvex keeps it in its PostgreSQL database, with your account (see section 11). The sign-in tokens that Google issues are stored encrypted.
  • Sharing: Carvex does not sell this data, shares it with no third party other than the providers that host the platform, and never uses it for advertising.
  • Deletion: when you delete your account from the “Account” screen (see section 14), Carvex erases your name, your email, your profile picture, and the link to your Google account. You can also ask for deletion at contact@carvex.net.
  • Revoking access: you can remove Carvex’s access at any time from your Google account, at https://myaccount.google.com/permissions.
  • Carvex’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Payments

  • CIB or Edahabia card: you pay on the page of Chargily, an Algerian payment provider.
  • Foreign card: you pay on the page of Stripe. Stripe operates from abroad, so your card data is processed outside Algeria.
  • Carvex receives only the payment result: amount, status, and reference. Carvex never stores your full card number.
  • Payment at the agency: the agency records the amount, the payment method, and a reference.

9. Notifications

  • Email, sent through Resend.
  • In the app.
  • Push notifications, only when you turn them on for your device. You turn them off in your preferences or in your browser.
  • You pick the notification categories in your preferences. Essential emails (account access, confirmation, payment, contract, credit note) stay on.

10. Who can see your data

  • The staff of the agency that handles your booking, for that booking.
  • Carvex administrators, for oversight, document review, and support.
  • Our providers, only to deliver their service: Cloudflare (hosting, file storage, bot check), the host of the PostgreSQL database, Resend, Chargily, Stripe, and Google or Apple when you sign in with them.
  • Public authorities, when the law requires it.

11. Hosting and transfers outside Algeria

  • The platform is hosted on Cloudflare. The data is stored in a PostgreSQL database run by a specialised host.
  • Some providers process data outside Algeria.
  • These transfers follow the conditions of Law No. 18-07. They cover only the data each service needs and come with security measures.

12. Retention

  • Account: as long as the account exists. When you delete the account, its personal data is erased.
  • Identity document and licence scans: 24 months after the end of your last rental, then erased automatically. A scan you removed from your account follows the same rule.
  • Contracts, invoices, credit notes, and receipts: for the legal retention period of accounting and commercial documents.
  • Technical logs: 7 days for server logs. The IP address and browser stored with a sign-in session stay as long as the account exists.

13. Security

  • Traffic is encrypted (HTTPS).
  • Files are stored in a private space and open through temporary links.
  • Access depends on the role: an agency sees only its own bookings.
  • Card data stays with the payment providers.

14. Your rights

  • You have the right to information, access, rectification, objection, and deletion.
  • You correct your information on the “Account” screen.
  • You delete your account from the “Account” screen. Carvex refuses the deletion while a booking is open or an amount is still owed. Deletion erases your name, email, phones, address, date of birth, licence data, scans, and drawn signatures.
  • Contracts and invoices already issued stay on file with the identity the law requires.
  • For any other request, write to contact@carvex.net. Carvex may ask you to prove your identity.
  • You can file a complaint with the National Authority for the Protection of Personal Data (ANPDP).

15. Cookies and local storage

  • A session cookie keeps you signed in.
  • Your browser’s local storage keeps preferences, such as the language.
  • The Cloudflare Turnstile check may use technical data from your browser.
  • Carvex uses no advertising cookies.

16. Vehicle location

The rental contract says whether the vehicle has a GPS tracker. The Lessor uses it to locate the vehicle. The Carvex platform does not receive these positions.

17. Changes to this policy

Carvex may change this policy. The new version shows on the platform with its effective date. When the language versions differ, the French version prevails.

18. Contact

Carvex. Email: contact@carvex.net.