Privacy policy

Stradale, reachable at contact@drive-stradale.com. The publisher's full details are given in the legal notice.

Depending on what you do on the site:

• Account: email address, name, phone number, postal address, preferred language, and profile photo and bio if you add them.
• Identity verification: date of birth and licence issue date, read from your document by Stripe Identity. The document itself never passes through our servers and is not stored by us.
• Bookings: dates, car, amounts and Stripe payment identifiers. We never see your card number.
• Check-in reports: photos of the car, your licence and your ID taken at handover and return, mileage, fuel level and notes.
• Listings, for owners: car, photos, pick-up address and rental conditions.
• Reviews: rating and comment published under your name.
• Messages: what you write to the owner or renter of a booking, in that booking's conversation.
• Favourites: the listings you have saved.
• Security: your IP address is recorded temporarily to limit email sending and abuse.

• Providing the service you request: account, booking, payment, check-in report. Basis: the contract.
• Verifying drivers' identity and licence. Basis: the legitimate interest in not handing a car to an unidentified driver, and the owner's obligation to make sure of it.
• Keeping evidence of the car's condition in case of dispute. Basis: the legitimate interest of both parties.
• Preventing fraud and abuse. Basis: legitimate interest.
• Meeting accounting obligations. Basis: legal obligation.

We do not use your data for advertising and do not sell it to anyone.

The owner of a car sees, for their own bookings only, your name, your email, the verification status of your licence and the related check-in reports. They see nothing of your other bookings.

Our technical processors:

• Supabase — database, accounts and photo storage.
• Stripe — payments, payouts to owners and identity verification.
• Brevo — sending the service's emails.
• Vercel — website hosting.
• OpenStreetMap (Nominatim) — converting an address into coordinates. Only the address entered is sent, never your identity.

• Account: as long as it exists, then for a limited period after it is deleted.
• Bookings and accounting records: 10 years, as required by the French Commercial Code.
• Check-in reports: until the limitation period for any dispute has expired.
• Messages: as long as the booking they belong to.
• Security IP addresses: a few hours.

You can request access to your data, its correction, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Write to contact@drive-stradale.com; we reply within one month.

If you are not satisfied with the answer, you can contact the CNIL (the French data protection authority), 3 place de Fontenoy, 75007 Paris, or at cnil.fr.

The site sets three cookies, all strictly necessary: one that keeps you logged in from page to page, one that remembers the language you read the site in, and a security cookie that remembers your browser has already passed the anti-bot check, so you aren't asked again every time. The latter contains no account identifier or personal data, and cannot be used to recognise you across sites.

At payment, and only then, Stripe sets two more from the card form. They are used to detect fraudulent use of a stolen card: without them, fraud detection no longer works. They are only set if you reach the payment page.

There is no audience measurement and no advertising tracker. As these cookies are strictly necessary for the service to work securely, no consent is required and no banner is imposed on you.

The sign-up, login and forgotten password forms use Cloudflare Turnstile, which tells a visitor apart from an automated program. This service receives your IP address and technical characteristics of your browser, for the time it takes to decide. It does not profile visitors and is not used for advertising.

This check protects your data: without it, a script could list registered addresses and flood inboxes with messages sent from our domain. It is therefore a security measure, not advertising tracking.