Privacy Policy

Who we are

“RideLanna”, “we”, “us” refers to the team operating RideLanna from Chiang Mai, Thailand. We are the data controller for the data described here. For any privacy question, or to exercise any right below, write to hello@ridelanna.com. We answer within 30 days, usually much sooner.

What we collect

Only what a booking actually needs. Grouped by why it exists:

• Your account. Email address, and your name. Riders sign in with a link we email, so we hold no rider password.
• What a shop needs to hand you a bike. Phone number, the number of your International Driving Permit, and where you are staying. Shops need these to meet you, to check you may legally ride, and to complete their own paperwork.
• Your bookings. Dates and times, the bike, the price, delivery address, and any note you add for the shop.
• Your signed rental agreement.When you accept a shop's terms before booking, we store a frozen copy of everything you agreed to, together with the date, time and the IP address you accepted it from. That IP is the evidence that the agreement was signed, which is what makes it worth anything to you in a dispute.
• Waitlist and sign-in records. If you join the waitlist we store your email, whether you are a rider or a shop owner, and your IP address. When you request a sign-in link we store the request and your IP. Both exist to stop someone flooding the site or using your email to send themselves links.
• One cookie. A sign-in cookie that keeps you logged in for 30 days. Nothing else.

We do not collect card or bank details, and we never will for rentals: nothing is charged online, you pay the shop directly. We do not scan or store a copy of your passport. We do not track your location, and we run no advertising or cross-site tracking.

Why we are allowed to hold it

• To perform your booking. Your account and booking data, and your signed agreement, exist because you asked us to arrange a rental. Without them there is no booking.
• Our legitimate interest in a working, safe service. The IP addresses on sign-in requests and the waitlist protect accounts and prevent abuse. The stored agreement protects both you and the shop.
• Your consent. The waitlist and the newsletter, which you can withdraw from at any time without affecting anything else.

Who else sees it

• The shop you book with. Once a shop confirms your booking it sees your name, phone number, IDP number, delivery address and the dates. It needs these to hand you the bike. A shop does not see your details before it confirms, and never sees bookings made with other shops.
• The companies that run the site for us. Vercel (hosting), Supabase (database, hosted in Tokyo) and Resend (email delivery). Each processes data only on our instructions.

We never sell, rent or trade your data. We send no third-party marketing. We hand data to authorities only where the law actually requires it.

Where your data goes

We are based in Thailand and our database is hosted in Japan. Our hosting and email providers operate internationally, which means your data may be processed outside your own country, including outside the European Economic Area. Where that happens we rely on our providers' standard contractual protections.

How long we keep it

• Account and booking records, including signed agreements, for as long as your account is open, and for two years after your last rental so that a dispute or an insurance claim can still be settled.
• Sign-in links, 30 minutes, then they are dead. Sign-in attempt records, a short rolling window used for rate limiting.
• Waitlist and newsletter, until you unsubscribe or ask us to delete it.

Your rights

Under Thailand's Personal Data Protection Act, and under the GDPR if you are in the EEA or the UK, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can withdraw consent at any time.

Email hello@ridelanna.com and we will act on it. Deleting your account removes your personal details; where a rental has already happened we may need to keep the agreement itself for the period above, because it is a record of a contract between you and a shop, and we will tell you if that applies.

Every newsletter includes a one-click unsubscribe link. Emails about a booking you made are not marketing and do not carry one, since you need them to collect your bike.

If you think we have handled your data badly, please tell us first, we would rather fix it. You also have the right to complain to Thailand's Personal Data Protection Committee, or to your national data protection authority if you are in the EEA or the UK.

Cookies

This site sets one cookie, the sign-in cookie described above, which is strictly necessary to keep you logged in. We set no advertising, analytics or cross-site tracking cookies. If we ever add analytics, we will ask you first and update this page.

Security

Traffic is encrypted in transit. Shop passwords are hashed, never stored in readable form, and riders have no password at all. Sign-in links are stored hashed, expire in 30 minutes, and work exactly once.

Children

RideLanna is not directed at anyone under 18, we do not knowingly collect data from minors, and no shop on the platform may rent to one.

Changes

We will update this policy as the product changes and revise the date above. If a change is material we will email people who have an account.

Contact

Questions about your data? Write to hello@ridelanna.com.