Privacy Policy

The data controller for the Cibaura platform is Cibaura, Santo Domingo, Dominican Republic, Dominican Republic. Privacy questions and data-subject requests: [email protected].

This policy explains what we collect, why, who we share it with and the choices you have. It applies together with our Terms of Service.

Account data — name, email address, phone number, password (stored only as a cryptographic hash), account status, and the version, time and network address of each acceptance of our Terms.

Identity verification (KYC) data — to rent a vehicle you provide your driver’s license number and expiry date, your date of birth, and photos of a government-issued ID (front/back) and of your driver’s license (front/back). Agencies applying to the Platform provide business registration and owner-identity documents. These files are stored in access-controlled private storage, are used solely to verify that you can lawfully rent and drive (or operate an agency), and are reviewed only by our verification staff.

Booking data — the cars, dates, prices, pickup/delivery choices and, for door-to-door delivery, the delivery address, reference and coordinates you provide. Each booking also stores a rental agreement snapshot: the Terms version you accepted, your name, your license number and expiry as of that moment, the vehicle plate, and the Agency’s rental conditions as they read that day.

Messages — the per-booking chat between you and the Agency, kept as part of the booking record (it also serves as the handover/damage record).

Payment data — your card is collected and tokenized directly by Stripe; Cibaura never receives or stores card numbers. We store only the gateway token, card brand, last four digits and expiry, plus the authorization, capture and refund history of your bookings. Agencies provide bank account details for payouts.

Technical data — device and log information (IP address, browser, timestamps, push-notification tokens) used for security, fraud prevention and debugging, and the session cookies described in Section 8.

We process personal data to: operate your account and bookings (performance of the contract); verify identity, age and license validity before a rental (legal and contractual requirement, fraud prevention); process payments, refunds and agency payouts; enable renter–agency communication; send transactional notifications (email, in-app feed, push) about your bookings, verification and payouts; keep the marketplace safe (fraud, abuse and circumvention detection); and comply with legal obligations (tax, accounting, sanctions). Marketing communications, if any, are sent only with your consent and can be opted out of at any time.

Agencies — the Agency fulfilling your booking sees your name, email and phone, the booking details, the rental agreement snapshot (including your masked license number and expiry), the chat and, for delivery bookings, your delivery address. Agencies never receive your identity document images or your date of birth; they may verify your license in person at handover.

Stripe — payment processing, subject to Stripe’s privacy policy.

Service providers — hosting, database, private file storage, transactional email, push notification delivery, map/geocoding (only when you use door-to-door delivery) and error-monitoring providers acting under contract as processors on our behalf.

Authorities — where required by law, court order or to protect safety and prevent fraud. We do not sell personal data.

Account data is kept while your account is active. Identity verification data (license details, date of birth, document images) is kept while you hold an account so you do not need to verify again for each rental, and is deleted when you delete your account.

Booking records, rental agreement snapshots, messages, payment and payout records are retained for ten years after the booking closes, the period required by Dominican tax and commercial law for accounting records and to handle disputes, chargebacks and insurance claims. Log and security data is kept for up to twelve months.

When you delete your account (Profile → Delete account), we anonymize your profile (name, email and phone are replaced), permanently delete your identity documents and their metadata, detach and delete your saved cards at the gateway, remove your push tokens and sign out every session. Booking and payment records are kept for the retention period above, linked to the anonymized profile. Deletion is not possible while you have an open booking or own a pending or verified Agency.

Data in transit is encrypted (TLS); identity documents are stored in private, access-controlled storage and streamed only to authorized reviewers; passwords are hashed; card data never reaches our servers; sessions use httpOnly cookies and rotating refresh tokens that are revoked on password change, reset, suspension and deletion. No system is perfectly secure: if a breach affects you, we will notify you and the relevant authority as required by law.

Subject to the laws of the Dominican Republic (including Law 172-13 on the protection of personal data), you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; and receive a portable copy. You can update your name and phone, change your password and delete your account from your profile at any time. To exercise other rights, contact [email protected]; we may need to verify your identity first, and some data (for example records of completed rentals) must be retained where the law requires it.

The web platform uses strictly necessary httpOnly cookies to keep you signed in (an access cookie and a refresh cookie, both restricted to our own domain) and browser storage to remember interface preferences and whether a session existed. The mobile app stores its session tokens in the device’s secure storage. We do not use third-party advertising cookies. Stripe may set its own cookies when the payment form loads, for fraud prevention. Blocking essential cookies will prevent sign-in from working.

The Platform is not directed at children. You must be at least 18 to hold an account, and we do not knowingly collect data from minors; if we learn we have, we delete it.

We may update this policy; material changes will be announced on the Platform before they take effect. The version shown at the top of this page identifies the revision currently in force.