Privacy Policy

SkyRental operates a SaaS platform that runs (a) a public listing platform where anyone may browse vehicle listings without registering, and (b) a B2B gated lead distribution service that shares customer trip requests with verified business subscribers. SkyRental does not process rental payments, hold deposits, escrow funds, or take commissions on rentals. We are the data controller for personal data processed on the platform, except where a subscriber acts as an independent controller for their own customer relationships (see section 8).

We use personal data to operate and improve the platform, verify business identity, distribute leads to eligible subscribers, process our own subscriptions and product purchases, prevent fraud and abuse, send service notifications, respond to support requests, and meet legal, tax, and accounting obligations. We do not pay out rental revenue between users; rental payments happen directly between subscriber and end customer.

Where required, we rely on: performance of a contract (operating your account, subscription, and purchases), legitimate interests (platform security, anti-fraud, product analytics, protecting our rights), legal obligation (tax, accounting, lawful requests), and consent (optional marketing communications, which you may withdraw at any time).

Subscribers intentionally publish business information to attract customers. Business name, logo, city/area, listing photos, listing prices, listing descriptions, and the contact phone number attached to a listing are shown on public pages and can be viewed by anyone, including non-registered visitors. Do not upload information you do not want to be publicly visible.

Trip requests submitted by end customers are visible only to subscribers whose plan grants access to the relevant lead category. End customers are informed at submission that their request will be shared with eligible subscribers so they can respond. When a subscriber responds, the subscriber's business name, logo, and the contact phone on the relevant listing may be shared with the end customer to allow the transaction to proceed. Subscribers must use this data only to respond to that specific lead (see Terms, section 11).

We collect aggregated and pseudonymous data about how the platform is used, including clicks, searches, filters, and page interactions, to operate, secure, and improve the service. We do not run advertising trackers and do not sell personal data.

Once an end customer's data is shared with an eligible subscriber under section 6, and once a subscriber begins communicating with an end customer, the subscriber becomes an independent data controller for that relationship. Subscribers are responsible for their own lawful basis, retention, security, and responses to privacy requests concerning the customer data they receive. SkyRental remains controller for platform-side processing (account, gating, security, billing).

We rely on third-party providers to run the service, including cloud hosting and database (Lovable Cloud), authentication, email delivery, error monitoring, and AI features used for search matching and support. Subprocessors are bound by confidentiality and data-protection obligations consistent with this policy. We do not list providers we do not actually use; the current subprocessor list is available on request.

Some subprocessors may process data outside Mongolia. Where this happens, we rely on provider-level safeguards (such as standard contractual clauses or equivalent measures) to protect the data.

• Account, listing, and business profile data: retained for as long as your account is active. After account closure, data is retained only as required for tax, accounting, and audit purposes (typically up to 10 years under Mongolian law).
• Uploaded listing photos: automatically deleted seven (7) days after the associated listing is unpublished or the account is closed. Photos of currently published listings are retained for as long as the listing remains active.
• Leads and trip requests: retained for up to 24 months after the request is closed, then anonymized or deleted.
• Invoices and transaction records: retained for the period required by tax and accounting law.
• Support tickets and messages: retained for up to 24 months after closure.
• Server, security, and audit logs: retained for up to 12 months for security and fraud investigation.

You may request earlier deletion, subject to legal retention requirements.

We use industry-standard measures including encryption in transit, role-based access control, row-level security on the database, hashed passwords, signed-URL access to private storage, security-definer functions to gate privileged operations, authentication controls, monitoring, backups, and internal audit logs. No internet service can be guaranteed 100% secure; please report suspected vulnerabilities through the in-app support system.

Subject to local law, you may request access to, correction of, deletion of, or export of your personal data, and may object to or restrict certain processing. Where applicable, you also have the right to lodge a complaint with a competent data-protection authority. Requests can be submitted through the in-app support system or the contact channels in section 18. We will respond within the timeframes required by applicable law.

We may disclose personal data where required by law, court order, subpoena, regulatory request, or lawful request from law enforcement, and where necessary to establish, exercise, or defend legal claims, prevent fraud, or protect the rights, property, or safety of SkyRental, our users, or the public.

If SkyRental is involved in a merger, acquisition, reorganization, financing, or sale of assets, personal data may be transferred to the successor or acquirer as part of that transaction, subject to the protections of this Privacy Policy or an equivalent policy adopted by the successor.

The platform may contain links to third-party websites and services (for example, map tiles, external company links, or admin-configured support links). We are not responsible for the privacy practices of those third parties; please review their policies before providing data.

The platform is intended for businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided personal data, contact us and we will delete it.

We use strictly necessary cookies and local storage to keep you signed in and to remember preferences (currency, language, role). We may use privacy-respecting analytics to understand aggregate usage. We do not run advertising trackers.

We may update this Privacy Policy. Material changes will be highlighted in-app or by email. The "Last updated" date reflects the latest revision.

For privacy questions or to exercise your rights, contact us through the in-app support system, the contact information on our Support page, or the address shown on your invoice. Non-paying users can reach us through the in-app Support page without an invoice.