Privacy Policy

This policy explains what CartBooker.com collects, why, how long we keep it, and the choices you have. We aim to collect only what we need to run the marketplace and get you a cart.

What we collect

• Booking details — your name, email, phone, delivery address (if applicable), dates, and cart choice.
• Account & sign-in — the email you sign in with, and — if you set one — a password (stored only as a one-way hash). You can also sign in with an emailed link or Google, in which case we store no password at all. Operators may enable two-step verification; its secret is stored encrypted.
• Driver’s licence, at handover — when you check in for a rental through our digital handover, the operator captures a photo of the lead driver’s licence to verify age and identity, along with your typed signature on the operator’s rental waiver and photos of the cart’s condition. This is the most sensitive data we hold, and it is treated accordingly — see How long we keep things below.
• Reviews — if you leave one after a completed rental, the text and first name you provide.
• Support & partner inquiries — anything you send us through a form or email.
• Technical — basic device/usage data your browser sends, used to keep the site working and secure.

How we use it

• To create, confirm, and manage your booking, and to send booking and sign-in emails.
• To share the details an operator needs to fulfill your rental (see below).
• To keep an evidence record of the handover — the signed waiver, licence verification, and condition photos protect both you and the operator if there is ever a dispute about the rental.
• To operate, secure, and improve the marketplace.

Who we share it with

To complete a booking, we share with the independent rental operator you booked from the details they need to fulfill it — your name, contact, dates, delivery address (if applicable), and the handover record for your rental. We also use service providers — email delivery, hosting, and payment processing (Stripe) — who handle data on our behalf under their own safeguards. We disclose information when required by law. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Text messages (SMS)

With your consent, we send booking-related text messages — booking confirmations, request updates, and messages from your rental operator (for guests), and booking and guest-message alerts (for operators). We do not send marketing texts. Consent is collected by an unchecked box you actively tick: guests at checkout next to the phone number field, operators in their dashboard settings next to the alert number field. Providing a phone number alone is not consent — a number given without ticking the box is used only for delivery coordination and never for texting.

Message frequency varies with your booking activity (typically a few messages per booking). Message and data rates may apply. Reply STOP at any time to opt out of texts, or HELP for help; you can also clear the number in your settings or email support@cartbooker.com. Opting out of texts never affects your booking — the same updates always arrive by email.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except for the messaging provider that delivers the texts on our behalf.

How long we keep things

Your rights & choices

Email us to access, correct, or delete your personal information, or to ask what we hold about you. We honor these requests regardless of which state you live in — including the rights provided by the California Consumer Privacy Act and the Florida Digital Bill of Rights — subject only to records we are legally required to keep (for example, tax records of a completed booking). We will never discriminate against you for exercising these rights, and since we don’t sell personal information, there is nothing to opt out of selling.

Cookies and analytics

We set functional cookies to keep you signed in and remember your session, analytics cookies so we can see which parts of the site are actually used and which are confusing, and — since August 2026, because we now advertise on Google — a conversion measurement cookie that tells us which of our own ads led to an enquiry. We do not build advertising profiles, we run no retargeting or remarketing pixels, and we do not sell or share what we collect.

Three tools are in use, and it is worth being precise about the difference:

• Google Analytics 4 — audience measurement: how many people arrive, from which sources, and which pages they read. It sets its own cookies and the data is processed by Google, so this one is not purely first-party. This property is linked to our Google Ads account so that enquiries can be counted against the ads that produced them. Google Signals and remarketing audiences remain switched off, so no cross-device advertising profile is built from it.
• Google Ads conversion tracking — when you arrive from one of our ads, Google tags that visit so that if you later ask an operator about dates, we can tell which ad brought you. It measures our own advertising only. We do not use it to build remarketing audiences, we do not upload customer lists to Google, and we do not send Google your email address or other identifiers from our records.
• PostHog — product analytics, proxied through our own domain, described in detail below.

PostHog acts as our data processor. It records the pages you visit, the buttons you use, and — on the general marketplace pages only — a replay of the interaction, so we can see where people get stuck. Three limits we hold ourselves to:

• What you type is never recorded. The contents of every form field are masked before anything leaves your browser — names, addresses, phone numbers, card details, signatures.
• Sensitive pages are never replayed at all. Recording is switched off on checkout, digital check-in and handover, sign-in and password pages, and your account area.
• We do not link analytics to a name unless you have an account with us, and then only to understand how that account uses the operator dashboard.

If you would rather not be measured at all, choose Decline on the cookie notice: that stores a preference which stops Google Analytics and the Google Ads conversion tag from loading at all and stops PostHog from starting, session replay included. Declining covers the advertising tag too — measuring our ads is not treated as an exception. An ad/tracker blocker or your browser’s privacy settings will also stop all three, and nothing about the site will stop working — no feature here depends on analytics. Google also publishes a browser add-on that opts you out of Google Analytics everywhere. If our use of these tools changes again — in particular if we ever enable remarketing audiences, upload customer data to an ad platform, or market outside the United States — this policy will change first and, where required, we will ask for your consent before setting anything.

Security

Data is encrypted in transit; passwords are hashed; two-factor secrets and connected-account credentials are encrypted at rest; access to handover records is limited to you (via your booking link), the operator, and our staff. No method is perfectly secure, but sensitive data here is minimized and short-lived by design. If a breach affecting your personal information ever occurs, we will notify you as Florida law requires.

Children

The service is for adults; it is not directed to anyone under 18, and drivers must be 21+.

Changes & contact

We may update this policy; the “last updated” date reflects the current version, and material changes will be flagged on this page. Privacy questions or requests? Email support@cartbooker.com. See also our Terms of Service and Cancellation Policy.