Legal
Last updated: October 2026
RideLanna connects riders with independent scooter and motorbike rental shops in Chiang Mai, Thailand. This policy explains exactly what personal data we hold, why we hold it, who else sees it, and how to get a copy of it or have it deleted. We have tried to write it plainly rather than defensively.
RideLanna is a rental marketplace based in Chiang Mai, Thailand. Rentals and payments are handled directly between riders and shops. Contact: hello@ridelanna.com.
“RideLanna”, “we”, “us” refers to the team operating RideLanna from Chiang Mai, Thailand. We are the data controller for the data described here. For any privacy question, or to exercise any right below, write to hello@ridelanna.com. We answer within 30 days, usually much sooner.
Account, booking and service information, grouped by purpose. Optional analytics and anonymous page counts are explained below.
We do not collect rider payment-card details: nothing is charged online, you pay the shop directly. We do not scan or store a copy of your passport. We do not track your GPS location. Google Ads measurement is optional and requires its own consent, as explained below.
We store partnership business identity and signatory authority, email-code verification results, agreement versions, booking events, and pickup and return status. Riders pay shops directly; RideLanna does not collect rental payments. Commission records include amounts, due dates and payment or adjustment references. Vehicle condition checks are handled directly by the shop and rider; the platform does not require condition reports or photos. Any reports submitted under an earlier process remain private archives. Access is restricted to the rental’s parties and authorised administrators; partnership documents are restricted to their signatory and administrators.
We never sell, rent or trade your data. We send no third-party marketing. We hand data to authorities only where the law actually requires it.
When you type into a place-search field, the search text is sent from your browser to Photon (komoot), which uses OpenStreetMap data. The service receives your IP address as part of that request. We do not request your device’s GPS location. You can enter an address manually if a place is missing. The address you submit is saved with the relevant profile, shop details or booking.
We are based in Thailand and our database is hosted in Japan. Our hosting and email providers operate internationally, which means your data may be processed outside your own country, including outside the European Economic Area. Where that happens we rely on our providers' standard contractual protections.
Under Thailand's Personal Data Protection Act, and under the GDPR if you are in the EEA or the UK, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can withdraw consent at any time.
Email hello@ridelanna.com and we will act on it. We assess account deletion requests and remove unnecessary personal details; where a rental has already happened we may need to keep the agreement itself for the period above, because it is a record of a contract between you and a shop, and we will tell you if that applies.
Every newsletter includes a one-click unsubscribe link. Emails about a booking you made are not marketing and do not carry one, since you need them to collect your bike.
If you think we have handled your data badly, please tell us first, we would rather fix it. You also have the right to complain to Thailand's Personal Data Protection Committee, or to your national data protection authority if you are in the EEA or the UK.
We remember your analytics choice for 180 days. Accepting analytics allows a first-party random identifier, kept for up to 180 days, to connect your visits, searches and booking steps in this browser. A shared session identifier in local storage expires after 30 minutes of inactivity or 24 hours. Events can include your account role, but not your account ID, email or name. This helps us understand where riders and shops have difficulty using the service. You can refuse optional analytics without affecting your bookings.
We count page views, approximate time on a page, maximum scroll progress and Core Web Vitals performance measurements whether you accept or refuse optional analytics. Without optional consent, a random identifier is kept in session storage only until you close that browser tab, and expires after 30 minutes of inactivity or 24 hours. It lets us count unique tab sessions without a cookie; it does not identify a person or recognise you in another tab, browser or device. The event contains a page category, coarse browser and device categories, the referring website’s domain and technical performance values. It does not contain your account ID, IP address, exact location, full referring URL or document identifiers. After optional consent we also collect validated campaign labels (utm_source, utm_medium and utm_campaign), never other URL parameters. Repeated visits and some automated traffic can affect the count.
Our PostHog analytics events exclude passwords, names, emails, phone numbers, delivery addresses, licence numbers, documents, payment references and text entered into forms. Session replay and automatic form capture are disabled. The persistent identifier and shared session storage are cleared when you change your choice to refuse. Anonymous tab-based page counting continues. You can exclude this browser from all analytics in Privacy choices; this exclusion is remembered for one year. Changing a preference does not erase events already received. Contact us if you want previous analytics data deleted.
Google Ads has a separate choice, remembered for 180 days. Your previous consent to site analytics does not authorise Google Ads. Choosing analytics only leaves Google Ads disabled. The Google tag loads only after you explicitly accept advertising measurement; refusing does not prevent you from browsing or booking.
After acceptance, Google can receive advertising click identifiers (gclid, gbraid or wbraid), public page categories and the referring website’s domain. Google also receives technical connection information, including your IP address and browser information, when your browser contacts its services. First-party Google advertising cookies such as _gcl_aw or _gcl_au may link an ad click to a later booking request; their default lifetime is generally 90 days. We do not send names, emails, phone numbers, licence details, booking addresses, sign-in tokens, private document URLs or form contents. Personalised advertising, Google Signals and enhanced conversions using customer details are disabled.
After a booking request is saved, we may send a conversion event with an opaque, hashed reference to prevent duplicate counts. This measures a request, not a confirmed or paid rental. We send no rental amount or commission as advertising revenue.
You can withdraw advertising consent in Privacy choices. We disable subsequent measurement events and clear Google advertising cookies accessible on our domain. Google may receive the consent-state update when the tag was already loaded. This does not delete data Google has already received. See Google’s Privacy Policy and Google’s advertising data information for its processing and international transfers.
Traffic is encrypted in transit. Shop passwords are hashed, never stored in readable form, and riders have no password at all. Sign-in links are stored hashed, expire in 30 minutes, and work exactly once.
RideLanna is not directed at anyone under 18, we do not knowingly collect data from minors, and no shop on the platform may rent to one.
We will update this policy as the product changes and revise the date above. If a change is material we will email people who have an account.
Questions about your data? Write to hello@ridelanna.com.
