Privacy Policy

This policy explains what CartBooker.com (CartBooker, LLC, “we”) collects, why, who processes it for us, how long we keep it, and the choices you have. We collect only what we need to run the marketplace and get you a cart.

What we collect

• Booking details: your name, email, phone, delivery address (if applicable), dates, and cart choice.
• Account and sign-in: the email you sign in with and, if you set one, a password (stored only as a one-way hash). You can also sign in with an emailed link or with Google, in which case we store no password. Operators may enable two-step verification; its secret is stored encrypted.
• Driver’s licence, at handover: where an operator uses our digital handover, the operator captures a photo of the lead driver’s licence to verify age and identity, along with your typed signature on the operator’s rental waiver and photos of the cart’s condition. The licence photo is read by an AI service provider to pull out the name, state, dates and last four digits for the check. This is the most sensitive data we hold; see How long we keep things.
• Reviews: if you leave one after a completed rental, the text and first name you provide.
• Messages to us: what you send through a form, by email, in a text or voicemail to our booking line, or in a chat with Birdie.
• Technical data: your IP address, browser and device type, and the pages you request, which our hosting provider logs to deliver and secure the site. If you accept analytics cookies, also the measurements described under Cookies and analytics.

How we use it

• To create, confirm and manage your booking, and to send booking and sign-in emails and texts.
• To share with the rental operator the details they need to fulfill your rental (see below).
• To keep an evidence record of a handover (signed waiver, licence check, condition photos) that protects you and the operator if there is a dispute about the rental.
• To answer your questions by chat, text, phone or email.
• To operate, secure, fix and improve the marketplace, and, only if you accept, to measure how the site and our own Google ads perform.

Who we share it with

Rental operators. To complete a booking we give the independent operator you booked with the details they need: your name, contact details, dates, delivery address (if applicable) and the handover record for your rental.

FareHarbor. Some listings are booked through FareHarbor, the operator’s own booking system. Nothing from FareHarbor loads when you view a listing. When you press the booking button, FareHarbor’s booking window opens (on our page on wide screens, on fareharbor.com on phones) and FareHarbor collects your booking and payment details itself, as an independent company under its own privacy policy. FareHarbor runs its own analytics and error monitoring inside that window. We may be paid when you book there, and we never receive your payment details. Other listings link to partner booking sites, which work the same way.

Service providers who process data on our behalf, only to provide their service to us:

We also disclose information when the law requires it. We do not sell your personal information.

Birdie chat, texts and calls

Birdie, the chat on our pages, is an automated assistant. What you type is sent to our AI service providers (OpenRouter, which routes the request to an OpenAI model) to write the reply, and if you leave a contact so we can follow up, it is stored and emailed to our team. The same applies to texts to our booking line, (239) 376-5999: replies are drafted by the same AI providers and our staff can read the conversation and take over. Calls to that number are answered by a recorded message; if you leave a voicemail, it is recorded (up to two minutes) and transcribed by Twilio, and the recording and transcript go to our team. Do not share card numbers or other sensitive details in a chat, text or voicemail.

Text messages (SMS)

With your consent, we send booking-related text messages: booking confirmations, request updates and messages from your rental operator (for guests), and booking and guest-message alerts (for operators). We do not send marketing texts. Consent is collected by an unchecked box you actively tick: guests at checkout next to the phone number field, operators in their dashboard settings next to the alert number field. Providing a phone number alone is not consent; a number given without ticking the box is used only for delivery coordination and never for texting. If you text us first, we reply to that conversation.

Message frequency varies with your booking activity (typically a few messages per booking). Message and data rates may apply. Reply STOP at any time to opt out of texts, or HELP for help; you can also clear the number in your settings or email support@cartbooker.com. Opting out of texts never affects your booking; the same updates always arrive by email.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except for the messaging provider that delivers the texts on our behalf.

Cookies and analytics

Nothing that measures you or our ads runs until you choose Accept on the cookie banner. Until then, and whenever you choose Decline, no Google Analytics, Google Ads or PostHog code is loaded and none of their cookies are set. You can change your mind at any time with Cookie settings (also in the footer of every page). Declining or withdrawing stops measurement immediately in the page you are on and deletes the cookies and stored data those tools had set.

Browser privacy signals. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as Decline, even if you accepted before. In California a GPC signal is also your request to opt out of the sale or sharing of personal information, and we honor it as one.

Cookies and storage we set or allow:

If you accept, three tools run:

• Google Analytics 4: audience measurement (how many people arrive, from which sources, and which pages they read). Data is processed by Google. Google Signals and ad personalisation are switched off in our tag, so no cross-device or remarketing profile is built from it.
• Google Ads conversion tracking: when you arrive from one of our ads, Google can tell us that the visit led to a booking step, a booking click or a call tap. It measures our own advertising only. We run no remarketing audiences, upload no customer lists, and send Google no email address, phone number or other identifier from our records. We use Google Consent Mode, so these tags know your choice.
• PostHog: product analytics (pages viewed, buttons used, page speed), so we can see where people get stuck. It runs through our own domain (cartbooker.com/ingest), which means a tracker blocker may not stop it; the cookie banner does. PostHog processes the data for us in the United States. Session replay (video-like recordings of a visit) is switched off. Form fields and Birdie chats are excluded from capture. If you have an account, we link analytics to an internal account number, never to your email.

Google also offers a browser add-on that opts you out of Google Analytics on every site. Nothing on CartBooker depends on analytics; the site works the same whichever you choose. If we ever want to use data for advertising beyond measuring our own ads, this policy will change first and we will ask for your consent.

How long we keep things

Your rights and choices

Email support@cartbooker.com to access, correct or delete your personal information, to get a copy of it, or to ask what we hold about you. We honor these requests wherever you live, subject only to records the law requires us to keep (for example, tax records of a completed booking). We will confirm your identity by writing from the email address on your booking or account. We will never treat you differently for exercising these rights.

California residents

Under the California Consumer Privacy Act (as amended by the CPRA) you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights. You may use an authorized agent; we may ask the agent for your signed permission and ask you to confirm your identity directly.

• Categories we collect, from you, your device and the operator you book with: identifiers (name, email, phone, IP address, account number); commercial information (bookings and payments); internet activity (pages viewed, and with your consent analytics events); approximate location derived from your IP address; audio (voicemails you leave); and, at handover only, sensitive personal information (driver’s licence details). We use them for the purposes in How we use it and keep them for the periods in How long we keep things.
• Sale and sharing. We do not sell personal information and have not done so in the past 12 months. The only disclosure that could count as “sharing” for cross-context behavioral advertising is Google Ads conversion measurement, which runs only after you press Accept. To opt out, choose Decline in Cookie settings or turn on GPC in your browser. We do not knowingly sell or share the personal information of anyone under 16.
• Sensitive personal information (a driver’s licence) is used only to verify age and identity for the rental, as the law permits, and never to infer anything about you.

Visitors outside the United States

CartBooker lists rentals in the United States and is run from the United States, where your information is processed. The cookie banner asks everyone, wherever they are, before any analytics or ad measurement runs. If data protection law where you live gives you further rights, write to us and we will honor them.

Security

Data is encrypted in transit; passwords are hashed; two-factor secrets and connected-account credentials are encrypted at rest; access to handover records is limited to you (through your booking link), the operator and our staff. No method is perfectly secure, but sensitive data here is minimized and short-lived by design. If a breach affecting your personal information ever occurs, we will notify you as the law requires.

Children

The service is for adults; it is not directed to anyone under 18, and drivers must be 21 or older.

Changes and contact

We may update this policy; the “last updated” date shows the current version, and material changes will be flagged on this page. Privacy questions or requests: email support@cartbooker.com. See also our Terms of Service and Cancellation Policy.