Movialy — Privacy Policy
Last updated: 24 September 2026
This Privacy Policy explains how Red Friend Co., Ltd., trading as Movialy ("Movialy", "we", "us", "our"), collects, uses, discloses, and protects personal data in connection with the website at movialy.com, the application at movialy.app, the public booking websites that rental operators publish under movialy.app, and the links sent to renters from the application (together, the "Service").
We process personal data in accordance with applicable law, including Thailand's Personal Data Protection Act (PDPA) and, where applicable, the EU and UK General Data Protection Regulation (GDPR).
Capitalized terms not defined here have the meaning given in our Terms of Service.
1. Our Two Roles: Controller and Processor
Movialy plays two distinct roles, depending on the data concerned.
(a) Data controller. We decide how and why we process personal data about our own customers and their representatives: the owners, managers, and staff of rental businesses who use a Movialy Account, the people who contact us, and visitors of movialy.com. This Privacy Policy governs that processing. We are also a controller for the optional improvement of automatic reading described in Section 5, where a customer enables it.
(b) Data processor. Rental businesses use the Service to manage their own clients (the renters): names, contact details, identity and driving documents, photographs, bookings, and payments. This data may be entered by the rental business, or by the renter through a public booking website or a link sent by the rental business. For this data, the rental business is the data controller, and we process it only on its documented instructions, under our Data Processing Addendum.
If you are a renter and have a question about your data, please contact the rental business you dealt with: it is the controller of your data. If you contact us, we will forward your request to that business.
2. Personal Data We Collect as Controller
2.1 Account and identity data
When a business registers or an Authorized User is added, we collect: company name, name of the responsible person, names and usernames of Authorized Users, email address, telephone number, postal address, country, role, and login credentials. Passwords are stored in hashed form by our authentication provider. If you enable device sign-in (passkeys), we store only the public key of your device, never your fingerprint or face data.
2.2 Billing and transaction data
We keep records of Wallet top-ups, promotional credits, usage and option charges, invoices, and receipts. We do not store payment card numbers: card and PromptPay payments are handled directly by our payment processor, Omise (Opn Payments). When you buy Hardware, we collect the delivery name, address, telephone number, and shipment tracking details.
2.3 Usage, security, and technical data
We collect technical information such as IP address, device and browser type, sign-in attempts, error logs, and the history of changes made in the Account, for security, fraud prevention, troubleshooting, and improvement of the Service.
2.4 Support data
When you contact support or send a Help request, Suggestion, or Bug Report, we collect the content of your message and related context (such as your company code and the booking number concerned). Bug reports may create a ticket in ClickUp. Support messages may be translated automatically with our AI providers so that our team can read and answer them.
2.5 Preferences
Interface preferences, such as language and filters, are stored locally in your browser. See our Cookie & Local Storage Policy.
2.6 Website visitors
On movialy.com, we process the technical data necessary to deliver the pages. We do not use third-party advertising or analytics cookies by default.
3. How and Why We Use Personal Data as Controller
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and administer your Account and provide the Service | Performance of a contract |
| Process Wallet top-ups, issue invoices, and debit usage and option charges | Performance of a contract |
| Sell and deliver Hardware | Performance of a contract |
| Provide customer support and answer requests | Performance of a contract / legitimate interests |
| Secure the Service, prevent fraud and abuse, and keep change and audit logs | Legitimate interests / legal obligation |
| Improve and develop the Service | Legitimate interests |
| Send service communications (for example low Wallet balance, changes to the Service, security notices) | Performance of a contract / legitimate interests |
| Comply with legal, tax, and accounting obligations | Legal obligation |
| Send marketing communications, where applicable | Consent / legitimate interests (you can opt out at any time) |
| Improve automatic reading with training samples, only where the customer has enabled it (Section 5) | Legitimate interests, on the customer's instruction |
Under the Thai PDPA, we rely on the corresponding bases: contractual necessity, legitimate interest, legal obligation, and, where required, consent.
4. Artificial Intelligence Features
The Service includes optional AI-assisted features:
- reading of mileage and fuel level from photos of vehicle dashboards;
- reading of identity and driving documents (driver's licence, passport, identity card) submitted for a booking;
- vehicle suggestions and document classification;
- generation of vehicle thumbnail images;
- automated translation of labels, email templates, and support messages.
To produce these results, the relevant images and text are sent to our AI providers: Alibaba Cloud (Qwen models) as the primary provider and Anthropic (Claude models) as a fallback. Vehicle thumbnail images are generated through the Lovable AI Gateway. Data is sent to these providers only to return the requested result, under their business terms.
AI results are an aid and may contain errors: they must be reviewed and confirmed by the user. Customers can disable AI features in the Service settings.
5. Improving Automatic Reading (Optional, Disabled by Default)
A customer may choose to help us improve automatic reading by enabling the corresponding option in its settings. This option is disabled by default.
Where it is enabled, we keep, for ninety (90) days, the photos of dashboards and identity documents read by the Service, together with the values read and the corrections made by the user, in order to measure and improve reading accuracy. After ninety days, these samples, including the image files, are deleted automatically.
These samples are accessible only to authorized Movialy personnel, are never sold, and are used for no other purpose. Disabling the option stops the collection of new samples; samples already collected are deleted at the end of their ninety-day period, or earlier on request to privacy@movialy.com.
The customer that enables this option is responsible for informing its renters in accordance with applicable law.
6. Sub-Processors and Third Parties
We use trusted service providers to operate the Service and share personal data with them only as necessary, under appropriate contractual safeguards.
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. (via Lovable Cloud) | Database, authentication, file storage, server functions | United States / EU (per project configuration) |
| Cloudflare, Inc. | Hosting and delivery of the application and websites, edge functions, caching | United States; global edge network |
| Alibaba Cloud (Qwen models) | AI reading of dashboards and identity documents, classification, suggestions, translation | Singapore |
| Anthropic, PBC (Claude models) | AI fallback for the same features | United States |
| Lovable AI Gateway | Generation of vehicle thumbnail images | United States / EU |
| Lovable (email service) | Delivery of emails sent by the Service (notifications, booking and check-out emails) | United States / EU |
| Omise / Opn Payments | Card and PromptPay payment processing | Thailand / Singapore |
| ClickUp | Support tickets and bug reports | United States |
| Nager.Date | Public-holiday data by country (no personal data sent) | European Union |
| FlagCDN | Flag icons of the language selector, loaded by your browser | Global CDN |
We may also disclose personal data where required by law, to enforce our Terms, to protect the rights and safety of users, or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this Policy.
We will notify customers of changes to our sub-processors as described in the Data Processing Addendum.
7. Third-Party GPS Platforms
A customer may enter, in a vehicle record, the address and login credentials of a GPS tracking platform it uses. These credentials are stored with the vehicle record, as provided by the customer, to give quick access to that platform from the Service. They are visible to the customer's Authorized Users who can view the vehicle, and to Movialy platform administrators for support. The GPS platform is chosen by the customer and is not a Movialy sub-processor. We recommend using credentials with the lowest privileges the platform allows.
8. Public Booking Websites and Renter Links
Rental businesses may publish a public booking website under movialy.app and send personal links to their renters (for example to complete a booking, provide documents, or view rental information). Personal data collected through these websites and links is processed on behalf of the rental business, which is the controller and the publisher of its website. A renter's personal link is deactivated a configurable number of days after the end of the rental (60 days by default, 120 days maximum).
9. International Data Transfers
The Service relies on infrastructure located in several countries, including the United States, the European Union, and Singapore. Where personal data is transferred across borders, we put in place the safeguards required by applicable law, such as Standard Contractual Clauses under the GDPR, or the mechanisms recognized under the Thai PDPA. Details are available on request.
10. Data Retention
We keep personal data only as long as necessary for the purposes described in this Policy:
- Account data: for the life of the Account. After termination, Customer Data remains available for export for thirty (30) days; account data is then deleted or anonymized within ninety (90) days, unless a longer period is required by law.
- Billing, invoices, and Wallet transactions: at least five (5) years, and up to seven (7) years where required by Thai tax and accounting law.
- Support data: twenty-four (24) months.
- Change history: history of bookings and financial lines, twenty-four (24) months; history of vehicles and clients, six (6) months.
- Check-in and check-out photos: full-resolution photos are kept for at least thirty (30) days after the end of the rental, or three hundred sixty-five (365) days if the Comfort Pack was active when the check-out was recorded, and are never removed while the booking is not closed. They are then replaced by a reduced-resolution copy kept as proof for as long as the booking remains in the Account.
- Vehicle reference photos: removed one hundred eighty (180) days after the vehicle's last rental, unless the Comfort Pack is active.
- Renter links: deactivated as described in Section 8.
- Automatic-reading training samples (where enabled): ninety (90) days.
- Demonstration environment: deleted automatically on a daily reset.
- Technical and security logs: as long as necessary for security, troubleshooting, and legal purposes.
When retention is no longer required, we delete or anonymize the data.
11. Security
We implement technical and organizational measures appropriate to the risk, including:
- encryption in transit (HTTPS/TLS);
- tenant isolation enforced at the database level (Row Level Security by company);
- role-based access control combining roles and per-feature permissions, re-verified on the server and, for financial records, in the database itself;
- signed, time-limited links for access to stored photos and documents;
- change logging for bookings, financial lines, clients, and vehicles;
- sign-in protection: session expiry, password reset, limitation of repeated sign-in attempts, and optional device sign-in (passkeys);
- restricted platform administrator access: a small number of Movialy administrator accounts can access customer Accounts solely for support, maintenance, security, and billing; such access is logged.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Your Rights
Subject to applicable law, you may have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data;
- restrict or object to certain processing;
- receive your data in a structured, machine-readable format (portability);
- withdraw your consent at any time, where processing is based on consent;
- lodge a complaint with a supervisory authority: in Thailand, the Personal Data Protection Committee; in the EU or the UK, your local data-protection authority.
To exercise these rights, contact privacy@movialy.com. We will answer within the time required by applicable law. If your request concerns data for which a rental business is the controller, we will forward it to that business.
13. Cookies and Local Storage
The Service uses only the browser storage necessary to keep you signed in, remember your preferences, and run the application. We do not use third-party advertising or analytics cookies by default. See our Cookie & Local Storage Policy.
14. Children
The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children through our own features. Rental businesses are responsible for the data of their renters, including any minor listed in a booking.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will publish the updated version with a revised "Last updated" date and, where changes are material, notify customers through the Service or by email.
16. Contact
Data controller: Red Friend Co., Ltd. (trading as Movialy)
Address: 424/93 M.10 Nongpure, Banglamung, Chonburi 20150, Thailand
Privacy contact: privacy@movialy.com
Support: In-app support, available on every page of the Movialy application