Privacy Policy

HeyCarla ("we," "us," or "our") is committed to safeguarding your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use our services (the "Services"). It also outlines your rights under applicable data protection laws.

This Privacy Policy applies to personal data collected through our website, through our AI voice-enabled reservation system for car rental businesses, and any other interactions you may have with us.

By using our Services, you acknowledge that you have read and understood the practices described in this Privacy Policy. If you have any questions, please contact us using the details in Section 12.

Data Controller: HeyCarla

Contact Email: hello@heycarla.ai

We are responsible for determining the purposes and means of processing the personal data that we collect from or about you in connection with the Services.

We may collect and process the following categories of personal data, both through our website and through our AI voice-enabled reservation system:

• Identification Data: Such as name, email address, postal address, and phone number.
• Account Information: Usernames, passwords, and account preferences for our Services.
• Voice Interaction Data: Audio recordings or transcripts captured when you or your customers use our AI voice-enabled reservation system (e.g., phone reservations or voice-based inquiries at car rental locations).
• Communication Data: Correspondence via email, website forms, support inquiries, voice calls, and any other method of communication.
• Transaction Data: Payment information, billing address, and purchase or subscription history, if applicable.
• Technical Data: IP address, browser type, device information, time zone settings, cookies, and similar technologies to track website usage and user preferences.
• Usage Data: Information about how you use our Services, including page visits, button clicks, voice commands, and other interactions.

We will only collect and process special categories of personal data if we have obtained your explicit consent or are otherwise legally permitted to do so.

We collect personal data from and about you using several methods, including:

Direct Interactions

When you fill out forms on our website, register for an account, book a demo, or contact us directly. When you or your customers provide information through our AI voice-enabled car rental reservation system.

Automated Technologies

We use cookies, server logs, and similar technologies to automatically collect technical information when you visit our website or interact with our Services.

Voice Interaction Technologies

Our AI voice-enabled reservation system may record or transcribe voice input from callers to car rental businesses using our Services. This may include reservation requests, vehicle preferences, pickup and drop-off details, and other information shared verbally.

Third-Party Sources

We may receive personal data about you from trusted third parties (e.g., analytics providers, payment services, rental management system integrations), subject to those third parties having the right to share such data with us.

We only process your personal data where the law allows. This may include:

• Consent: Where you have explicitly consented to receive marketing communications, to use certain features of our AI voice-enabled reservation system, or where consent is otherwise required by law.
• Contract: Where processing is necessary for the performance of a contract with you (e.g., providing our AI reservation service to your car rental business) or to take steps at your request before entering into a contract.
• Legal Obligation: Where we need to comply with a legal or regulatory obligation.
• Legitimate Interests: Where processing is necessary for our legitimate interests (or those of a third party), provided these interests do not override your fundamental rights and freedoms.

We may use personal data we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve our Services, including troubleshooting, data analysis, and quality control. This includes operating and enhancing our AI voice-enabled reservation system for car rental businesses.
• Reservations and Account Management: To manage reservations made through our system, user accounts, respond to inquiries, and keep track of your interactions with us.
• Payments and Billing: To process subscription payments, issue receipts or invoices, and maintain records of transactions.
• Marketing and Communications: To send you promotional messages, product updates, or other information that may interest you, subject to your preferences and consent where required by law.
• Compliance and Fraud Prevention: To comply with legal obligations, prevent fraud, enforce our terms and conditions, and protect our rights, privacy, safety, and property.
• Analytics: To analyze usage and trends, including voice interaction patterns, to improve user experience and tailor our Services for the car rental industry.

We will only share your personal data in the following circumstances:

Service Providers

We engage trusted third-party service providers (e.g., payment processors, IT hosting, analytics providers, AI transcription services, rental management system integrations) who perform services on our behalf. They are required to process your data in accordance with this Privacy Policy and applicable data protection laws.

Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, personal data held by us may be transferred to the buyer or other relevant third party.

Legal Obligations

We may disclose personal data if required to do so by law or where we believe disclosure is necessary to protect our rights or comply with a judicial proceeding, court order, or legal process.

Text Messaging (SMS)

Where you consent during a phone call to receive a text message from us — for example, a secure link to complete a car rental reservation — we use your mobile phone number solely to send the message you requested. We share your mobile number only with the SMS service provider that transmits that message on our behalf, and only to deliver it.

No mobile information — including phone numbers collected for text messaging, text messaging opt-in data, and consent — will be sold, rented, shared, or disclosed to any third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

These messages are transactional only; we do not send marketing or recurring text messages. You may reply STOP at any time to opt out, or HELP for help. For full details on our messaging practices, see our SMS Consent & Messaging Policy.

We do not sell or rent your personal data to third parties.

We may transfer personal data to countries outside your jurisdiction that may not have the same level of data protection laws. Where we do so, we ensure there is an appropriate level of protection in place — for example, through Standard Contractual Clauses or equivalent safeguards recognized by applicable law.

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including to satisfy any legal, accounting, or reporting obligations. Specific retention periods depend on the nature of the data and the context in which it was collected. This includes any audio recordings or transcripts captured through our AI voice-enabled reservation system.

When we no longer need to process your personal data, we will either delete or anonymize it.

We implement appropriate technical and organizational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures may include encryption, firewalls, secure servers, and access controls.

While we strive to protect your personal data, the transmission of data over the internet or by voice technologies cannot be guaranteed to be completely secure.

Under certain circumstances, you have the following data protection rights:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any incomplete or inaccurate data we hold about you.
• Right to Erasure ("Right to be Forgotten"): Ask us to delete or remove personal data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: Request that we suspend the processing of your personal data in certain scenarios.
• Right to Data Portability: Receive a copy of your personal data in a structured, commonly used, and machine-readable format, and transfer it to another data controller.
• Right to Object: Object to processing of your personal data where we are relying on legitimate interests.
• Right to Withdraw Consent: Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please use the contact details in Section 12. You also have the right to lodge a complaint with the relevant supervisory authority in your country of residence.

If you have any questions, concerns, or wish to exercise your data protection rights, please contact us:

HeyCarla
Email: hello@heycarla.ai

Our Services are not directed to, nor do we knowingly collect personal data from, children under the age of 16 (or other age as required by local law). If we become aware that a child under this age has provided us with personal data, we will take steps to delete such information. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any updates will be posted on our website, and we will indicate the date of the latest revision. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data.