Introduction
Book N' Ride ("Book N' Ride", "we", "our", or "the Platform") respects your privacy. This policy describes what the website, booking service, and ChatGPT connection actually do.
It is written to match Albanian Law No. 124/2024 on Personal Data Protection and, where it applies to a customer, the EU General Data Protection Regulation (GDPR). This page is not a certificate of compliance.
Last updated: October 2026.
1. Who We Are
Book N' Ride operates under Albanian VAT/NIPT number M01909019E.
For privacy questions, email info@booknride.al. There is no separate data protection officer. This address is the contact for privacy requests.
Book N' Ride is the controller for the website, customer accounts, bookings, and the ChatGPT car-search connection, except where a rental company or another provider decides its own purposes.
2. Personal Data We Collect
Depending on how you use Book N' Ride, we collect:
- name, email address, and phone number
- date of birth, where a rental or account needs it
- account login details, with the password stored in protected form
- booking details: places, dates, times, vehicle, price, and status
- support messages, including email and WhatsApp text linked to a case
- card brand, last four digits, and the payment reference. We do not store the full card number.
ChatGPT and the car-search connection
A search from ChatGPT sends the place, dates, times, and any car filters needed to answer. It does not ask for your name, email, or card, and we do not save that search as a customer record.
The same place, dates, and times are placed in the search web address sent to our server. Our host can keep that address, the IP address, and the browser name in its request logs. The text of the ChatGPT message is not saved by our application.
The IP address is also used briefly in server memory to slow down too many requests. That copy is not written to our database.
The link we send back contains the place and dates. The chat itself is kept by the AI service you used, under that service's own policy.
3. How We Use Your Personal Data
Bookings and payments
We use booking and payment details to arrange the rental, confirm it, handle changes, cancellations, and refunds, and send service messages about that booking.
Legal basis: the contract, or steps you ask us to take before a contract.
Support
We use contact details and the message to answer you and to keep a record of a complaint, refund, or change.
Legal basis: the contract, and our interest in resolving the request.
Security
We use technical information, including an IP address, to protect the site and limit abusive traffic.
Legal basis: our legitimate interest in keeping the service secure, and legal duties where they apply.
ChatGPT searches
We use the place, dates, times, and car filters from a ChatGPT search to find cars and return the results. We do not use that search to build a customer profile or a booking.
Legal basis: steps you ask us to take before a booking.
Analytics and advertising measurement
If you accept cookies, Google Analytics and Microsoft Clarity receive pages you open so we can understand how the site is used. Google Ads, where that tool is loaded, receives pages you open so we can measure advertising.
These tools are not loaded before you accept, or after you withdraw consent and the page reloads. They do not receive the page address in those cases. After you accept, a page address can include a rental place and dates.
Legal basis: your consent. You can refuse or withdraw that consent. See section 4.
4. Cookies and Similar Technologies
Some cookies are needed for the site to work, including login, security, and booking. Those do not wait for analytics consent.
Optional analytics are Google Analytics, Google Ads, and Microsoft Clarity. They load only after you choose Accept cookies.
Continue without cookies saves a refusal in this browser. The analytics tools stay off.
Cookie settings in the footer lets you change that choice. If you had accepted and then refuse, the page reloads so the analytics tools stop.
On a small screen, the same choice is available, including on car details, protection, and checkout.
5. Analytics
Google Analytics, Google Ads, and Microsoft Clarity are the optional tools. While consent is on, they can receive the page address, which may include a rental place and dates, and a cookie identifier. Google Ads is used to measure advertising. They are not loaded before consent or after consent is withdrawn.
We do not set their storage time in our code. That time is the setting inside each provider account. We have not confirmed those dashboard settings in this policy, so we do not state a number of months for them.
The site does not currently load a separate Google Tag Manager container. Server-side tag forwarding is switched off in the application.
6. How We Share Personal Data
We share personal data with these recipients when needed:
- the rental company for that booking, including name, contact details, date of birth, and trip details
- car-supply systems used to check availability and send the reservation
- Stripe, which processes card payments. PayPal is available only where that method is used
- Vercel, which hosts the website and booking server
- MongoDB Atlas, which stores the database
- SendGrid, which sends email
- Zoho Mail and WhatsApp, which carry support messages
- Google and Microsoft, only if you accept analytics cookies
- When you use Book N' Ride through ChatGPT, OpenAI processes your conversation under its own applicable terms and privacy policy. Book N' Ride receives the search inputs sent to its car-search service. We do not receive or independently store your entire ChatGPT conversation through this connection.
- authorities, when the law requires it.
Book N' Ride staff can access customer records to operate the service. A rental company sees the booking it is fulfilling.
7. Third-Party Services
Stripe, Vercel, MongoDB Atlas, SendGrid, Zoho, WhatsApp, Google, Microsoft, OpenAI, and the rental company each have their own privacy information for the part they control.
Where a provider processes data for us, we rely on the contract with that provider. You can ask us which contract applies. A service contract is not, by itself, the tool for a transfer outside Albania. That is covered in section 8.
8. International Data Transfers
The booking server runs on Vercel in the United States.
Stripe, SendGrid, Google, Microsoft, and OpenAI may also process personal data in the United States.
The database is on MongoDB Atlas in Frankfurt, Germany.
A rental company may be in Albania or in another country where the car is supplied.
Albanian Law No. 124/2024 requires a lawful transfer tool when personal data leaves Albania and no adequacy decision covers the destination. A provider's ordinary service contract is not, by itself, that tool. This version of the policy does not name a transfer tool for each provider, because those arrangements have not been confirmed one by one. You can ask info@booknride.al for the tool that applies to a named provider.
9. Data Retention
We keep different records for different reasons. This section describes the periods the system can enforce, and the records the law tells us not to delete on a timer.
Bookings and payments
A booking or payment record keeps the name, email, phone, date of birth, trip, price, payment status, card brand, last four digits, and payment reference. These rows are not deleted on an automatic timer. Public Albanian tax guidance says financial and accounting data are kept for at least five years from the end of the tax year they belong to. Our accountant must confirm whether a longer accounting period applies. Until that confirmation, we do not publish a shorter deletion date.
Refunds, disputes, and chargebacks stay with those records for the same reason.
Accounts
An account keeps the name, email, phone numbers, date of birth, and protected password while the account exists. You can close the login from the customer account page. Closing the login does not delete booking or payment records.
Support
A support case that is still open is kept until staff mark it resolved.
A resolved case about a refund, complaint, cancellation, booking change, or supplier mismatch is kept with the booking and payment records. It is not deleted on a shorter timer, because it may be needed for a refund, a dispute, or a legal duty. A case tied to a booking reference is kept with that booking.
A resolved case that is only a general question, a sales enquiry, or another routine message, and that has no booking reference, is deleted 24 months after it was last updated. The daily retention job deletes that case and its messages.
ChatGPT searches
The search is not saved as a customer record. The search web address can appear in Vercel request logs. The hosting account is on the Vercel Pro plan, which keeps those logs for 1 day. An extended 30-day log add-on was not enabled, and no log drain is copying the logs to another service. If a search fails, the email to staff includes the page path only, not the search address.
Affiliate clicks
An affiliate click can store an IP address and browser string. Those two fields are cleared after 30 days. The click record itself stays so commission records remain.
Temporary booking links
A temporary booking access link is meant to last 24 hours. Expired links are deleted by the daily retention job.
Analytics
Optional analytics are kept for the period set in Google and Microsoft. We have not confirmed those settings, so we do not state a number.
Backups
The database is a free shared MongoDB Atlas cluster in Frankfurt. Atlas does not keep backups for that cluster unless the optional daily backup is switched on. If it is switched on, Atlas keeps the last 4 daily snapshots. That switch is on the Atlas backup page and was not visible from the application. If a snapshot exists, a closed login can remain in it until that snapshot expires. Booking records in a snapshot follow the accounting retention above.
10. Data Security
We use encryption on the website connection, access controls for staff, and payment processing through Stripe.
We do not store the full card number. We do not keep the Stripe payment secret on the payment record after it is created. A daily job removes any payment secret still stored on an older record. The payment amount, status, and customer details stay.
No online service can guarantee absolute security.
11. Your Data Protection Rights
You can ask to access your data, correct it, delete it, restrict it, object, or receive a copy you can move. You can withdraw cookie consent as described in section 4.
We aim to answer within 30 days. Albanian law allows that period to be extended to 60 days when a request is complex. We may need to confirm your identity.
A deletion request closes the login when you use the account page and confirm your password. Booking and payment records stay where accounting, a refund, or a dispute requires them.
You can complain to the Information and Data Protection Commissioner in Albania (idp.al). If you are in the EU, you can also complain to the authority in your country.
Email info@booknride.al.
12. Marketing
The website does not currently run a promotional mailing list, and it does not have an unsubscribe tool for marketing campaigns.
Messages about a booking, payment, or change are service messages. They are not optional marketing.
If we later send promotional email, we will ask first and provide a way to stop it.
13. Children's Data
Book N' Ride is for people who can enter a rental booking. We do not knowingly collect a child's data for that purpose.
If you believe a child's data was sent to us in error, email info@booknride.al.
14. Rental Companies
Book N' Ride arranges the booking. The rental company receives the details it needs to hand over the car.
The rental company may then process data for its own rental agreement, identity check, deposit, and damage process, under its own notice.
15. Changes to This Policy
We may update this policy when the service or the law changes.
The current version is this page. The date at the top is the date of this version.