Privacy policy
Last updated: November 8, 2026
Who are we?
Fleedy is a service published by MC VTC, sole trader (micro-enterprise), SIRET 928 342 385 00046, 3 Rue du Leitrim, 35510 Cesson-Sévigné, France. Fleedy is intended exclusively for vehicle rental professionals. In accordance with Articles 13 and 14 of the GDPR, this policy explains how your personal data is processed. Contact: support@contact.fleedy.app
Our two roles
Fleedy acts in two distinct roles: • Data controller: for the accounts of our business customers and their staff, billing, the website, the contact form and public report verification. • Data processor (Article 28 GDPR): for renter data entered by rental companies during inspections. The rental company is the data controller: it informs its customers and handles their requests. Fleedy processes this data only on the rental company’s documented instructions, under the data processing agreement included in the Terms of service.
Processing for which Fleedy is the controller
1. Customer and staff accounts Data: last name, first name, email, phone, agency name, role, language, password (stored hashed). Purpose: create and manage the account, provide the service, support. Legal basis: performance of the contract. Retention: for the duration of the contract; data is anonymized when the account is deleted, except the proof of acceptance of the terms (see section 2). 2. Proof of acceptance of the terms Data: email and agency name at sign-up, date, declaration of acting in a professional capacity, acceptance of the terms and versions of the documents accepted. Purpose: prove that the account was opened by a professional who accepted the terms. Legal basis: legitimate interest (establishment, exercise or defense of our rights). Retention: 5 years after the end of the contract; this data is not anonymized when the account is deleted. 3. Subscription, billing and payment Data: plan, currency, subscription status, invoices, Stripe customer identifier. Card numbers are collected by Stripe and never by Fleedy. Purpose: manage the subscription, collect payment and invoice. Legal basis: performance of the contract; legal obligation (accounting). Retention: 10 years for accounting records. 4. Contact form Data: name, email, subject, message. Purpose: answer your request. Legal basis: legitimate interest (answering requests received) or pre-contractual measures. Retention: 3 years at most after the last exchange. 5. Public report verification Data: inspection identifier and SHA-256 fingerprint of the PDF, computed in your browser. The PDF is neither transmitted nor stored. The fingerprint record also keeps the name of the agent who performed the inspection. Purpose: allow anyone to check that a report has not been modified since it was sealed. Legal basis: legitimate interest (evidence of report integrity). Retention: the fingerprint is kept without time limit. 6. Security and technical logs Data: IP address, date and time, browser type, errors, authentication logs. Purpose: security, abuse prevention, diagnostics. Legal basis: legitimate interest. Retention: limited period set by our hosting providers, 12 months at most. 7. Audience measurement (only if enabled) If enabled, we use Plausible, a cookie-free audience measurement tool hosted in the European Union. Private pages (sign-in, customer area) are excluded, and only page addresses without URL parameters are sent. Legal basis: legitimate interest. Statistics are aggregated. You may object (see “Objecting to audience measurement”). None of this processing relies on your consent.
Reports sent to support
Data: the free-text description you enter in a support report and, where applicable, the contact email you provide. Do not enter health data, identity documents or any other unnecessary data in the description. Purpose: analyze and resolve the reported problem, and reply to you. Legal basis: legitimate interest (providing support and service quality) or performance of the contract. Retention: 2 years from the creation of the report; if the agency is deleted, reports are deleted 30 days after the deletion (see “Account deletion”).
Objecting to audience measurement
When enabled, audience measurement (Plausible) works without cookies and relies on our legitimate interest. You have the right to object at any time, without giving a reason. The button below saves your choice in this browser’s local storage (key fleedy_analytics_optout): as long as it is present, no event is sent, and no measurement script is loaded from the next page load onwards. The choice applies to this browser only; clearing browser data removes it.
Renter data (Fleedy as processor)
On behalf of rental companies, Fleedy hosts and processes: renter identity and contact details, driving licence information, photos of identity documents, photos of the vehicle and damage, signatures (images), mileage, fuel level, inspection notes and PDF reports. Purpose: carry out and document the rental company’s departure and return inspections. Legal basis and information of individuals: defined by the rental company, as data controller. Retention periods applied on the rental company’s instructions: • source photos, signatures and identity documents: deleted automatically by our servers as soon as the return report is sealed; if a technical incident occurs, deletion is retried automatically; at the latest one year after the inspection is sealed; • damage photos: deleted one year after the inspection is sealed; • hosted PDFs: deleted one year after the inspection is sealed; • renter personal data: anonymized one year after the linked inspection is sealed, or one year after the client record is created if no inspection is retained; the renter’s name is then removed from the fingerprint record; • rental left open for more than 2 years without a return inspection: considered abandoned, its data becomes eligible for anonymization; • integrity fingerprint: kept without time limit for public verification, together with the name of the agent who performed the inspection; • inspection metadata: kept, notes are cleared. Exercising rights: renters should first contact the rental company, which may forward the verified request to support@contact.fleedy.app with the inspection or client reference.
Account deletion
When a staff member deletes their account, their profile is anonymized and their access is permanently blocked; the agency’s data does not change. If the sole administrator deletes their account, the agency is deactivated, all its members are anonymized and lose access, the Stripe subscription is canceled and the agency’s information is erased. A 30-day grace period then starts; at its end, all of the agency’s personal data is purged: clients, identity documents, photos, signatures, PDFs, logo and support reports, whatever the status of rentals. The Fleedy platform administrator can also delete a customer agency, on request or when necessary: deletion is then immediate, with no grace period, and member accounts are deleted. Inspections (with no personal data left after the purge), vehicles, integrity fingerprints and audit logs are not deleted at that time, nor is the proof of acceptance of the terms (see above); renters’ personal data follows the retention schedule above. Export your PDF reports before deleting your account.
Biometrics and automated decisions
Fleedy carries out no biometric processing: the signature is an image drawn on screen and photos of identity documents are kept as plain images, with no facial recognition or extraction of biometric data. Fleedy makes no automated decisions that produce legal effects on individuals.
Processors and recipients
We use the following providers, which act on our instructions: • Supabase: database, authentication and file storage. Data hosted in the European Union (Germany, Frankfurt). • Vercel: website hosting. United States. • Stripe: subscription payments. Ireland and United States. Stripe also acts as a data controller for its own legal obligations, including fraud prevention. • Resend: transactional emails and contact form messages. United States. • Plausible: cookie-free audience measurement, only if enabled. European Union. WhatsApp links on the site are plain links: by clicking one, you leave Fleedy and WhatsApp (Meta) then processes your data under its own terms. The site loads no WhatsApp script. We do not sell personal data.
Transfers outside the European Union
Some providers (Vercel, Stripe, Resend) may process data in the United States. These transfers are governed by the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses. Application data (accounts, inspections, photos, reports) is hosted in the European Union.
Your rights
For processing where we are the controller, you have the rights of access, rectification, erasure, restriction, objection (in particular to processing based on legitimate interest) and portability. To exercise them, write to support@contact.fleedy.app. If we have reasonable doubts, we may ask for proof of identity. We reply within one month. For renter data, please contact the rental company first.
Security and data breaches
We protect data through: encrypted connections (HTTPS), hashed passwords, role-based access control, isolation of data between agencies (row-level security rules in the database), administration keys never exposed to the browser, and automatic purging of expired data. In the event of a personal data breach, we notify the CNIL within 72 hours where the law requires it, inform the individuals concerned if the risk is high and, for renter data, notify the rental company without undue delay.
Contact and complaints
Questions about personal data: support@contact.fleedy.app You may also lodge a complaint with the CNIL: www.cnil.fr (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).