City Spin Car Rental — Privacy Policy
Last updated: 23 September 2026
City Spin Car Rental ("City Spin", "we", "us") operates the City Spin iOS app and cityspinja.com. This policy explains what the app collects, why, who else sees it, how long we keep it, and how to delete it.
Contact: cityspin.booking@gmail.com · WhatsApp +1 876 580 2417 · Phone +1 876 393 0103 1 Red Sea Drive, Kingston 11, Jamaica.
1. What we collect
We only collect what a car rental needs. There is no advertising, no tracking across apps or websites, and no sale of personal information.
Account and contact details
| Data | Why |
|---|---|
| Email address | Sign-in, booking confirmations |
| Full name | Rental agreement, identifying you at pickup |
| Phone number | Contacting you about your rental |
Driver eligibility
| Data | Why |
|---|---|
| Date of birth | Jamaican rental rules: drivers must be 25+, or have held a licence 3+ years |
| Driving licence issue date | The same eligibility rule |
| Licence issuing country | Verifying a foreign licence is acceptable |
Documents (sensitive)
| Data | Why |
|---|---|
| Photo or PDF of your driver's licence | Legal requirement to verify the driver before handing over a car |
| Photo or PDF of proof of address | Fraud prevention, required by our insurer |
Documents are uploaded directly to Google Firebase Storage under a private path tied to your account. They are readable only by you and by City Spin staff. They are never public, never indexed, and never shared with anyone outside City Spin except as described in section 3.
Booking and payment
| Data | Why |
|---|---|
| Pickup and return dates, locations, and any hotel/villa address | Fulfilling the rental |
| Flight number (airport pickups only) | Meeting delayed flights |
| Notes you add to a booking | Servicing your request |
| Amounts paid and refunded, PayPal order and capture identifiers | Receipts, refunds, accounting |
We never see or store your card number. Payment is taken on PayPal's own checkout page. We receive only a transaction identifier and the amount.
Device and technical
| Data | Why |
|---|---|
| Firebase Cloud Messaging token | Sending push notifications about your booking |
| Authentication session token | Keeping you signed in |
The app requests camera and photo library access only when you choose to add a licence or proof-of-address image. Declining means you cannot complete a booking, because we cannot verify your eligibility without those documents. We do not collect location data, contacts, health data, or advertising identifiers. The app contains no third-party analytics or advertising SDKs.
2. How we use it
- To check you are eligible to drive under City Spin's age and licence rules.
- To take payment, hold the car for your dates, and issue receipts and refunds.
- To let staff review your documents and approve or decline a booking.
- To notify you when your booking status changes.
- To keep accounting records of money taken and refunded, as required by law.
We do not use your information for automated decision-making that produces legal effects. A member of staff reviews documents and approves or declines each booking. Returning customers whose documents have already been verified may have subsequent bookings confirmed automatically; staff can still review and decline any booking.
3. Who else processes your data
We do not sell your data or share it for advertising. We use these processors:
Google (Firebase) — authentication, Firestore database, Storage for your documents, and Cloud Messaging for notifications. Data is held in Google's us-east1 region (South Carolina, USA). See Google's Firebase privacy documentation and Google's Privacy Policy.
PayPal — payment processing. When you pay, you are on PayPal's own page and PayPal acts as an independent controller of the information you give it. See PayPal's Privacy Statement.
Railway — hosting for the City Spin API, which processes booking data in transit.
Data is transferred to and stored in the United States. If you are in the UK, EU or EEA, these transfers rely on the processors' standard contractual clauses.
We may also disclose information where required by law, or to protect our rights, property or safety.
4. How long we keep it
| Data | Retention |
|---|---|
| Licence and proof-of-address documents | Until you delete your account; deleted immediately on request |
| Profile: name, email, phone, DOB, licence dates | Until you delete your account |
| Push notification tokens | Until you delete your account or sign out of that device |
| Booking and payment records | Kept after account deletion, with your personal details removed, for accounting and tax purposes |
When you delete your account, past bookings are anonymised, not erased: the customer name is replaced with "Deleted customer", email and phone are emptied, and flight number and notes are removed. What remains is the vehicle, dates, amounts paid and refunded, and PayPal transaction identifiers. This is the minimum needed to keep lawful financial records and cannot identify you.
5. Deleting your account
In the app: Account → Delete account, then confirm. This is two taps from the main navigation and needs no email, phone call or form.
Deleting your account permanently:
- deletes your profile record (name, email, phone, date of birth, licence dates, licence country, notification tokens, verification status);
- deletes every licence and proof-of-address file you uploaded;
- deletes your sign-in credentials, so the account no longer exists;
- anonymises your past bookings as described in section 4.
You must cancel or complete any upcoming trip first — the app tells you which. This is because a live rental is a contract in progress.
Deletion is immediate and cannot be undone. You can also email cityspin.booking@gmail.com and we will do it for you.
6. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict processing, and to complain to a data protection authority.
You can view and correct your details in Account → Driver details and documents, and delete everything as described above. For anything else, email cityspin.booking@gmail.com.
7. Children
City Spin does not rent to anyone under 25 unless they have held a licence for 3 or more years, and never to anyone under 18. The app is not directed at children and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.
8. Security
Traffic is encrypted in transit with HTTPS. Documents are stored in private Firebase Storage paths readable only by you and City Spin staff, enforced by server-side security rules rather than by the app alone. Staff access requires a separate privileged role on the account. No system is perfectly secure, but we limit what we collect and who can reach it.
9. Changes
We will update this page and change the date at the top when this policy changes. Material changes will be announced in the app.
10. Contact
City Spin Car Rental, 1 Red Sea Drive, Kingston 11, Jamaica cityspin.booking@gmail.com · WhatsApp +1 876 580 2417 · +1 876 393 0103