Privacy Policy
What we collect, why we collect it, and what you can ask us to do with it.
Last updated 10 August 2026
CAROD operates a marketplace connecting licensed PCO drivers with professional fleet owners. This policy explains how we handle personal data when you use thecarod.co.uk. We are the data controller for the data described below.
What we collect
- Account details — your name, mobile number and email address.
- Verification documents — your driving licence, PCO/PHV licence and, where required, proof of address, together with their expiry dates.
- Booking records — the vehicles you request, rental dates, and the fleet owner you rent from.
- Payment records — amounts, dates and outcomes. Card details are handled by Stripe and are never stored on our systems.
- Technical data — IP address and basic device information used to keep the service secure.
Why we use it
We use your data to verify that you are licensed to drive a private hire vehicle, to pass a booking request to a fleet owner, to take payment, and to meet our record-keeping obligations. Verification documents are used for that purpose alone.
Our lawful bases are performance of a contract (operating your booking), legitimate interests (preventing fraud and misuse of the platform), and legal obligation (retaining transaction records).
Who we share it with
- Fleet owners — when you request a vehicle, the fleet owner sees your name, contact details and whether your licences are verified. They do not receive copies of your documents unless there is a specific reason for it.
- Stripe — to take payments and pay fleet owners.
- Twilio — to send the one-time codes you sign in with.
- Supabase — where your documents and our database are hosted.
We do not sell your data, and we do not use it for advertising.
How long we keep it
Verification documents are kept while your account is active and for a period afterwards so that we can evidence that a rental was properly authorised. Superseded documents are retained as history rather than deleted, so that a past approval can still be explained. Transaction records are kept for six years, as UK tax rules require.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@thecarod.co.uk and we will respond within one month.
If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Documents are stored in access-controlled storage, sessions are signed and expire after seven days, and every administrative decision about your account is logged with the identity of the person who made it.