Privacy Policy

This Privacy Policy explains how MasterClass Car Rental Service ("we", "us", "our") collects, uses, stores, and protects information through the MasterClass Car Rental mobile app.

The app is used by our business to manage car rentals, customers, payments, vehicle condition records, staff access, and GPS-tracked vehicles. We do not sell personal information, and we do not use advertising or third-party analytics tracking in the app.

1. Who We Are

• Business: MasterClass Car Rental Service
• Physical address: No1 5th street Harare showgrounds
• Privacy contact: masterclasscarrental@gmail.com
• Phone: 0774361810

2. Information We Collect

Customer and rental information:

• full name, phone number, and physical address
• next-of-kin name, relationship, and phone number for emergencies
• national ID number
• driver's licence number and licence expiry date
• customer face photo captured with consent for identity verification
• rental dates and expected return date
• odometer readings and distance driven
• rental charges, deposits, payments, balances, and receipts
• customer signature on the rental agreement
• vehicle condition photos and rental hand-over/return notes

We do not store card numbers, mobile-money PINs, bank passwords, or other payment account passwords.

Vehicle and GPS information:

• current or recent vehicle location
• vehicle speed and movement status, where available
• tracker odometer, battery, ignition, and related telemetry, where available
• route or trip history from the tracking provider, where available

Staff information:

• staff name and role/permission level
• sign-in PIN stored as a secure one-way hash
• activity/audit records showing important staff actions

Technical crash diagnostics:

After the current terms are accepted, release builds automatically send technical crash diagnostics to Firebase Crashlytics. These may include a privacy-sanitised Dart error category and stack trace, app package and version, crash timestamp, device model and operating-system information, available resources, relevant application state, and random Crashlytics/Firebase installation identifiers.

We do not enable Google Analytics and do not intentionally attach customer names, national IDs, licence details, GPS locations, passwords, PINs, payment details, or API tokens to crash reports.

3. Why We Use This Information

• to identify customers and verify rental eligibility
• to contact the customer's nominated next of kin after an accident or emergency
• to compare a customer with their stored face photo during future rentals, fraud checks, disputes, or recovery matters
• to prepare rental agreements and receipts
• to manage vehicle hand-over and return
• to calculate charges, deposits, balances, and payments
• to manage bookings and vehicle availability
• to protect and recover vehicles if they are stolen, overdue, or misused
• to resolve disputes about condition, payments, or rental terms
• to maintain tax, accounting, and business records
• to secure staff access and maintain an audit trail
• to detect, diagnose, and fix app crashes and reliability problems

4. GPS Vehicle Tracking

Customers are informed that rental vehicles may be GPS tracked.

While a vehicle is on hire, we may view the vehicle's live or recent location. This is used only for legitimate business purposes, including confirming vehicle whereabouts, recovering a vehicle, investigating non-return, checking usage against the rental agreement, and protecting the fleet.

We do not sell or publish a customer's location. We may share location information only where needed to recover a vehicle, protect our legal rights, or comply with the law.

5. Where Information Is Stored

• On our business devices: the app is offline-first and keeps data in private app storage on the device.
• In our private cloud database and storage: when cloud sync is enabled, operational records, vehicle photos, customer face and ID/licence images, signatures, claim evidence, and rental condition photos may be synced to Supabase so our authorised business devices stay up to date. Media is stored in a private bucket that requires an active company account.
• In backup files: authorised staff may create password-encrypted backups for disaster recovery. Android automatic cloud backup and device-transfer backup are disabled for the app.
• With GPS tracking services: vehicle tracker data is processed by Traccar or another configured GPS tracking service.
• With map/address services: map display, traffic, navigation, Street View, and reverse geocoding may use Google Maps and OpenStreetMap Nominatim. These services receive coordinates needed to display maps, surroundings, routes, or addresses, not the customer's full identity.
• With payment services later: if electronic payments are enabled in future, payment requests may be sent through Paynow or another payment provider.
• With Firebase Crashlytics: technical crash reports and random installation identifiers are processed by Google Firebase for app reliability support.

6. Who We Share Information With

We do not sell personal information.

We may share limited information with Supabase, Traccar or the configured GPS tracking provider, Google Maps, OpenStreetMap Nominatim, Google Firebase Crashlytics, Paynow or another payment provider if electronic payments are enabled later, and law enforcement, insurers, legal advisers, or recovery agents where necessary to recover a vehicle, resolve a dispute, protect our rights, or comply with law.

7. Data Retention

We keep rental, customer, payment, and vehicle records for as long as reasonably needed for business, accounting, legal, dispute-resolution, and vehicle-security purposes.

Some information may be retained longer where required by law or where it relates to an active dispute, unpaid balance, accident, insurance matter, or vehicle recovery case.

Firebase states that Crashlytics keeps crash stack traces and associated Crashlytics/Firebase installation identifiers for 90 days before beginning removal from live and backup systems.

8. Security

• app access controlled by staff PINs and optional device biometrics
• staff PINs stored as one-way secure hashes
• private app storage on the device
• HTTPS connections for cloud sync and online services
• role-based staff permissions inside the app
• password-encrypted backups for disaster recovery
• fleet reminders are off by default and require an explicit opt-in
• crash reporting is disabled until the current terms are accepted

No system is perfectly secure, but we aim to use reasonable technical and organisational safeguards.

9. Customer Rights

Subject to applicable law, customers may request to access information we hold about them, correct inaccurate information, delete information where we are not legally or commercially required to keep it, or ask questions about how their information is used.

Staff members and customers can review the deletion process and submit a request on our Account and Data Deletion page. An owner can also delete and anonymize a staff login directly in the app under Settings > Staff accounts.

10. Children

Our vehicle rental services are intended for licensed drivers. We do not knowingly collect information from children under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and publish the new version at the same web address.

12. Contact

If you are not satisfied with our response, you may contact the relevant data protection authority in Zimbabwe.