Privacy Policy

1. Introduction & Commitment

InstaCar (“we”, “our”, or “us”) is dedicated to protecting the privacy, confidentiality, and integrity of your personal information. This Privacy Policy describes how we collect, record, organize, store, update, use, and dispose of your personal data when you use the InstaCar website, mobile application, reservation portal, and branch facilities, in compliance with Republic Act No. 10173, also known as the Philippine Data Privacy Act of 2012 (DPA).

2. Information We Collect

We collect only the personal information reasonably necessary to verify your identity, administer vehicle rentals, process financial transactions, and maintain vehicle safety:

• Identity & Contact Data: Full name, email address, mobile phone number, physical residential address, and profile photo (if provided via Google OAuth).
• Verification Documents: Scanned copies or photographs of government-issued driver's licenses, primary identity documents (Passport, UMID, Postal ID), and secondary proof of billing documents.
• Booking & Transaction Data: Rental start/end schedules, pickup/return locations, vehicle tier selection, payment method, down payments, balances, and security deposit records.
• Telematics & Fleet Data: Real-time GPS location, odometer readings, and vehicle diagnostic telemetry collected strictly during the active rental window for fleet safety and recovery.
• Technical Information: Device identifiers, IP addresses, browser types, and session authentication tokens required to deliver secure cloud access.

3. Legal Basis & Purpose of Processing

We process your personal information under the following lawful bases:

• Performance of Contract: Fulfilling rental bookings, delivering vehicles, processing payments, and verifying driver credentials prior to handoff.
• Legal & Regulatory Obligations: Compliance with Land Transportation Office (LTO) mandates, commercial transportation laws, and lawful law enforcement requests.
• Legitimate Interests: Protecting our automotive fleet from theft, damage, or unauthorized cross-island border crossings, and safeguarding platform integrity.
• Consent: Sending voluntary promotional updates, surveys, or service announcements where you have opted in.

4. Disclosure & Sharing of Information

InstaCar does not sell, rent, or trade your personal data to third parties for marketing purposes. We share data only with:

• Authorized Infrastructure Providers: Cloud database, storage, and authentication services (Supabase Inc.) hosted under industry-standard encryption protocols.
• Identity & OAuth Providers: Google LLC for streamlined single sign-on authentication where initiated by the user.
• Law Enforcement & Legal Authorities: If a rental vehicle is unreturned exceeding 24 hours without authorization, reported stolen, or involved in a vehicular incident.

5. Data Storage, Retention & Security

Your data is stored in secured, access-restricted cloud environments utilizing AES-256 encryption at rest and TLS 1.3 encryption in transit. Identity documents submitted for verification are purged or anonymized in accordance with our document retention schedule once statutory and audit retention obligations expire.

6. Your Data Subject Rights

Under Chapter IV of the Philippine Data Privacy Act of 2012, you possess the right to:

• Be informed whether your personal data is being processed.
• Reasonably access your personal data on file.
• Dispute inaccuracy or error in your personal data and require rectification.
• Suspend, withdraw, or order the blocking, removal, or destruction of your personal data from our systems upon settlement of active rental contracts.
• Lodge a complaint before the National Privacy Commission (NPC) if your privacy rights have been violated.

7. Cookies & Session Tracking

We use strictly necessary cookies and local storage tokens to maintain authenticated sessions, secure CSRF protection, and retain user theme preferences. We do not use third-party behavioral advertising trackers.

8. Contact Our Data Protection Officer

For inquiries regarding this Privacy Policy, requests to exercise your data subject rights, or privacy concerns, please contact our Data Protection Officer: