Legal matters

Bluefin Rentals is operated by Bluefin Rentals LLC, of Saint Paul, MN. We decide what information is collected through this site and how it's used. Questions about it, or requests about your information, go to bluefinbiz@gmail.com or (612) 718-5602.

Renting a car requires a valid license, so before your first trip you verify your identity through Stripe Identity, a service of Stripe, Inc. You photograph the front and back of your license and take a selfie. Stripe checks that the license is genuine and compares your selfie with the photo on your license using facial recognition. That comparison is done by Stripe, not by us, and Stripe asks for your consent before it starts. How Stripe handles it is in Stripe's privacy policy.

Stripe keeps the photos and the selfie. We can view them through Stripe while reviewing a booking or a claim, but we don't download or store them ourselves.

From the verification, we keep: your name as it appears on the license, date of birth, license number, the state and country that issued it, its issue and expiry dates, the address on it, and when it was verified. We use these to confirm you can rent, to check the license at pickup, to deal with accidents, damage, tolls and tickets, and to stop someone we've blocked from booking again under a new account.

These details are held in a part of our database that can only be read by our server and shown to the owners of Bluefin Rentals. They aren't included when we export customer lists.

• Sign-in cookies. When you sign in, cookies keep you signed in. They're necessary for the site to work and aren't used for anything else.
• Your browser's own storage remembers a contact-form message you haven't sent yet, until you close the tab.
• Stripe runs on the checkout and payment pages, and collects information about your device and browser to prevent fraud, under Stripe's privacy policy.
• Google Fonts. The site's typeface is loaded from Google, which receives your IP address and browser details when it does.
• Server logs. Our hosting provider records each request to the site, including your IP address, browser and the page asked for. The logs are kept for 7 days.

We don't use analytics, advertising cookies, tracking pixels or anything that follows you across other sites.

• to take and manage your bookings, pickups, returns, extensions and extras;
• to check you're eligible to rent, and to verify your license;
• to take payments, place and release deposit holds, charge for costs your trip causes, and give refunds;
• to email you about your bookings: confirmations, arrival instructions, receipts and changes;
• to deal with accidents, damage, insurance claims, tolls, tickets and citations;
• to prevent fraud and misuse, including blocking accounts and licenses from booking;
• to answer your questions and resolve disputes, including chargebacks;
• to keep business, tax and accounting records the law requires; and
• to keep the site working and secure.

We don't send marketing emails, and we don't sell your information or use it for targeted advertising.

Only these, and only what each needs:

• Stripe: payments, saved cards and identity verification.
• Supabase: our database, sign-in and file storage (including trip photos).
• Railway: hosts the site.
• Google: our email (Gmail) and the site's fonts.
• Mapbox: finds delivery addresses on the map.
• Toll agencies, police and courts, when a toll, ticket or citation from your trip is transferred to you, or as the law requires.
• Insurers and their adjusters, after an accident or damage on your trip.
• Police, if a car isn't returned or is stolen.
• [Owner decision: whether unpaid charges may be passed to a collection agency]
• Anyone who buys the business, who would then be bound by this policy for the information they receive.

• Bookings, payments and receipts: they're financial records, kept for [Owner decision: number of years, at least what tax law requires].
• License details from verification: while your account is open, and [Owner decision: how long after your last trip or after you close your account].
• Records of a blocked account or license: for as long as we need them to prevent fraud, even if the account is closed. That is what makes a block work.
• Trip photos and videos: [Owner decision: how long after a trip, and longer while a claim or dispute is open].
• ID photos and selfies: held by Stripe under its own retention rules; we can ask Stripe to delete them.
• Server logs: 7 days.

The site is served only over an encrypted connection. Each customer can read only their own bookings and details; the database enforces this, not just the pages. License details, block records and our notes are in tables only our server can read, and only the owners can open them, through pages that check who's asking every time. We never hold your full card number or your ID photos.

No system is perfectly secure. If your information is involved in a data breach, we'll tell you as the law requires.

You can see and change your contact details on your profile at any time. Email us at bluefinbiz@gmail.com to:

• get a copy of the information we hold about you;
• correct something that's wrong; or
• close your account and delete your information.

We'll answer within 45 days. We confirm a request comes from you by replying to the email address on your account. When we delete an account we keep what the law requires us to (payment and tax records), what we need for an open claim or dispute, and any record of a block. We'll tell you what we kept and why.

Depending on where you live, privacy laws (such as the Minnesota Consumer Data Privacy Act) may give you further rights, including the right to appeal if we turn down a request. We won't treat you differently for using any of these rights.

This site is for adults who can rent a car. It isn't meant for children, and we don't knowingly collect information from anyone under 18. If you think a child has given us information, contact us and we'll delete it.

Our database and file storage are in the United States (Ohio). The other services in section 6 are US companies and may process information in other countries under their own safeguards.

When we change this policy we update it here and change the date at the top. If a change affects how we use information we already hold, we'll email account holders before it takes effect.

Bluefin Rentals LLC, Saint Paul, MN. bluefinbiz@gmail.com, (612) 718-5602.