Privacy Policy

1. Scope and roles

This Privacy Policy describes how Garagii Automotive Solutions L.L.C. ("Garagii", "we", "us") collects, uses, stores and protects personal data through the Garagii.rental software platform and this website.

Under the UAE Personal Data Protection Law we act in two roles:

• Data Controller for the personal data of our clients' business representatives, account administrators, and visitors to this website.
• Data Processor for the personal data that rental agencies (our clients) upload into the Platform about their own customers, such as Emirates ID, passport and driving-licence details, rental contracts, fine records and inspection photos. For that data, the rental agency is the Data Controller and we act on its instructions.

2. Information we collect

A. Client business data (as Controller)

• Company details: company name, trade licence, tax registration number, business address.
• Account administrator details: full name, email address, phone number, job title, authentication credentials.
• Billing details: invoices issued to the client and payment records. We do not store full payment-card numbers.

B. Platform technical data

• Log data: IP address, device type, browser, access timestamps and activity logs, used for security, audit trails and reliability.

C. End-customer data processed on behalf of clients (as Processor)

• Identification documents: data and copies of Emirates ID, passport, visa and driving licence.
• Rental contracts: vehicle, dates, amounts, mileage, electronic signatures and the time they were given.
• Traffic and compliance data: Salik and toll usage, traffic fines, and vehicle inspection photos.
• Network flags: where a client records that a customer defaulted on payment, did not return a vehicle, caused damage or left an unrecovered fine, the Platform stores the category of the event, the date and a one-way cryptographic hash of the customer's Emirates ID or passport number; the number itself is never stored in the shared record or shown to other clients. Other clients can see only that a flag exists, its category, its date and how many clients raised one; never the customer's name, documents or contact details, nor which client raised it. Flags expire after 24 months and are cleared by the raising client once the matter is settled. The client that raised a flag is the Controller of it and must have informed the customer in its rental terms.

D. Client staff and drivers (as Processor)

• Users and drivers of a client company: name, role, phone number, and the task or job messages addressed to them, including notifications delivered over WhatsApp or SMS. We process this on the client's instructions; the client is the Controller and is responsible for obtaining each person's permission to be contacted on that channel.

E. Chauffeur directory

• Drivers listed by clients: name, licence status, contact details where the driver provides them, and availability, listed only with the driver's explicit, recorded consent obtained by the listing client. A driver may ask us or the listing client to remove the listing at any time.

F. This website

• The website sets a single cookie (lang) to remember your language choice. It runs no advertising trackers and sets no analytics cookies. Cloudflare, which hosts and serves the site, provides aggregate, cookieless traffic measurement (page views, country, browser); it builds no profile of you and retains no personal data from it. When you contact us on WhatsApp or by email, we use what you send only to answer your enquiry.

G. Vehicle tracking (as Processor)

• Where a client uses the Garagii Tracker Module, a tracker in the client's vehicle sends the vehicle's position, speed, ignition state, odometer reading and battery and power readings to the Platform. While a vehicle is on rent, this data relates to the person using it. We process it only on the client's instructions: to show the vehicle's location and state to the client's authorised staff, and to raise the warnings the client has set: speeding, idling too long, no signal, tracker unplugged, car battery low, and engine started outside working hours. Tracking data is not visible to other clients on the Platform unless the client itself chooses to share a vehicle's current location with a partner shop that is sub-leasing that vehicle. We do not use tracking data to profile drivers, for market statistics, or for any purpose of our own.
• Where the client's tracker supports it, the client's owner or manager can block a vehicle from starting again and release it. A vehicle is never stopped while it is moving. Every block and release is logged with who did it, when, and the reason given.
• Vehicle position history is kept for 30 days and tracking events for 90 days, after which they are deleted automatically.
• Only the tracker's device identifier and its readings are sent to our telematics provider, Flespi; we never send renter names or booking details to it, and we do not use Flespi's AI features.
• The client is the Controller of the tracking data and is responsible for telling its renters, in its rental terms, that the vehicle is fitted with a tracker and how the data is used. The SIM card in each tracker is contracted by the client with its own telecom provider; we do not process data on that network.

3. Legal basis for processing

• Performance of a contract: to deliver the service under our agreement with each client.
• Legal obligations: compliance with UAE tax law, commercial record-keeping requirements, and lawful requests from authorities.
• Legitimate interests: audit trails, security monitoring, fraud prevention and platform reliability.

4. Security, storage and cross-border transfers

4.1. Security. We apply technical and organisational safeguards including encryption of data in transit and at rest, role-based access control so that each user sees only what their role allows, strict separation of each client's data, and logging of access to records.

4.2. Cross-border transfers. Where hosting or sub-processing takes place outside the UAE, we use providers and regions that offer an adequate level of protection, or contractual safeguards providing equivalent protection, as required by the PDPL.

5. Sharing and retention

5.1. No sale of data. We never sell, rent or otherwise monetise personal data or clients' operational data.

5.2. Between clients on the Platform. When two rental agencies transact on the B2B network, each sees the other's company details, licence information and vehicle data needed for the deal. No client can see another client's customers or bookings.

5.3. Service providers. Data may be shared with sub-processors solely to operate the service:

• Cloudflare, Inc.: website hosting, content delivery, and the aggregate, cookieless traffic measurement described in section 2.F;
• Railway Corp.: application hosting for the Platform;
• Flespi (Gurtam): telematics data processing for the Garagii Tracker Module, hosted in the European Union;
• other cloud hosting and infrastructure providers;
• messaging providers used to deliver documents and notifications to customers, staff and drivers, and to carry the conversations described in section 7, which may include WhatsApp, Instagram and Messenger (Meta Platforms, Inc.) and SMS carriers;
• where we introduce spoken task messages for drivers, a voice-generation provider, which would receive the task text and the chosen language, and no customer identification, contract or payment data;
• our inbound voice line for corporate sales and support, which may include ElevenLabs (AI voice processing) and Didlogic (telephony carrier);
• payment providers.

Data is disclosed to government or police authorities only when required by a formal legal request, court order or statutory duty under UAE law.

5.4. Retention. Personal data is kept for as long as needed to provide the service and for the periods required by UAE law. Financial and tax records, including invoices, are retained for at least five (5) years as required by UAE tax legislation. Vehicle position history is kept for 30 days and tracking alert events for 90 days, after which they are deleted automatically. Messaging conversations are kept as set out in section 7.4. A client may request export or deletion of its data on termination, subject to those statutory periods.

6. Voice communications and AI processing

When you contact our corporate sales or support phone numbers, your call may be answered and processed by an automated Artificial Intelligence (AI) voice agent. To ensure quality of service, accurately address your technical support inquiries, and facilitate meeting scheduling, these conversations are transcribed and summarized.

We adhere to strict data minimization principles. All voice call transcripts and summaries are retained for a maximum period of 90 days for quality assurance and dispute resolution, after which they are permanently and securely deleted from our servers. Your communications are processed exclusively through our vetted, secure telecommunications and AI infrastructure partners and are never sold to third parties.

7. Messaging (WhatsApp, Instagram, Messenger)

7.1. Garagii Inbox. A rental agency that uses the Platform (a client) may connect its WhatsApp Business number, Instagram account or Facebook Page to Garagii Inbox. When it does, we store the messages, photos, voice notes and documents that its customers send to the agency, and the agency's replies, on the agency's behalf. The agency is the Data Controller of these conversations and decides how it uses them; we act as Data Processor and process them only to provide the Inbox to that agency.

7.2. Chat history. When an agency connects its WhatsApp number, up to six (6) months of past chat history may be imported into the Inbox, with the agency's consent.

7.3. Automated assistant. An agency may let an automated assistant answer messages on its behalf. The assistant always hands the conversation over to a person at the agency when the customer asks for one.

7.4. Retention. Chats and media are kept while the agency uses the Inbox. They are deleted within ninety (90) days after the agency switches the Inbox off or stops using Garagii, or earlier on a valid deletion request (see Data deletion).

7.5. Meta platforms. Messages travel through Meta's platforms (WhatsApp, Instagram and Messenger) and are also subject to Meta's own terms and privacy policies.

7.6. Licence and ID photos. When staff choose to, Garagii can read the details from a licence or ID photo a customer sends in the chat to pre-fill the customer's record; staff check and confirm the details before they are saved.

7.7. Service providers for messaging. To provide the assistant, document reading and voice-to-text, Garagii uses trusted service providers (Anthropic for AI text and image processing, ElevenLabs for converting voice notes to text); they process the content only to return the result to the shop.

8. Your rights

Subject to the exceptions in the PDPL, individuals whose personal data we control may ask us to:

• Access the personal data we hold about them;
• Correct inaccurate or incomplete data;
• Delete personal data, where no statutory retention period or legal claim requires us to keep it;
• Withdraw consent to marketing communications at any time.

For end-customer data that a rental agency has uploaded into the Platform, we act as Processor: please direct your request to that rental agency, which is the Controller, and we will support it in responding.

How to ask for deletion, what is deleted and in what time are set out on our Data deletion page.

9. Changes to this policy

We may update this policy as the service or the law changes. The effective date at the top shows the current version; material changes are communicated to clients in advance.

10. Contact

For privacy enquiries, to exercise your rights, or for compliance matters:

Garagii Automotive Solutions L.L.C.
Attn: Data Protection Officer
Dubai, United Arab Emirates
Email: founder@garagii.ae