Privacy Policy
1. Who we are
Arion ("Arion," "we," "us," or "our") operates a self-drive vehicle rental platform in Vietnam, including a website and app for booking rentals, an AI trip-planning assistant, and the supporting owner/operations tools our staff use to manage bookings. This policy covers all of those, together referred to as the "Service."
2. Personal data we collect
| Category | Examples | When collected |
|---|---|---|
| Identity & contact details | Full name, phone number, email, home/delivery address | Account creation, booking, public booking requests |
| Government identity documents | CCCD/CMND, passport, VNeID, driver's license, and a verification selfie | Identity verification before a rental is confirmed |
| Booking & rental records | Vehicle selected, pickup/return dates and locations, delivery preference, rental agreement, handover and return condition reports, vehicle photos taken at handover/return, odometer readings, damage notes | Throughout the booking and rental lifecycle |
| Vehicle location & telemetry | GPS location, speed, and related telemetry from the tracking device installed in the rented vehicle | Continuously while a vehicle is checked out on an active rental, for vehicle safety, recovery, and fee-calculation purposes (e.g. distance-based charges) |
| Payment information | Bank transfer reference details and deposit/payment status. We do not process card payments directly — rental deposits and fees are settled by bank transfer and manually reconciled by our staff. | At booking and during the rental |
| Trip-planning & assistant data | Messages you send our AI trip-planning assistant, trip preferences (destinations, budget, dates), and any flight or accommodation options you search for or select | When you use the trip-planning assistant |
| Google Calendar data | If you choose to connect Google Calendar, we request permission to create and update calendar events for your locked trip itinerary. We do not access any other part of your Google account. | Only if you explicitly connect your Google Calendar |
| Device & usage data | IP address, browser type, pages visited, and similar diagnostic data | Automatically, when you use our website or app |
3. How we use personal data
- To create and manage your account and process bookings, including verifying your identity before handing over a vehicle.
- To generate rental agreements, handover/return reports, invoices, and receipts.
- To operate, locate, and secure our vehicle fleet, including responding to accidents, breakdowns, theft, or unauthorized use, and to calculate distance-based fees under your rental agreement.
- To provide the AI trip-planning assistant — building draft itineraries, searching flights and accommodation, computing driving routes, and (only with your consent) syncing your itinerary to Google Calendar.
- To communicate with you about bookings, disruptions (e.g. a flight delay or cancelled reservation affecting your trip), support requests, and service updates.
- To detect and prevent fraud, abuse, and security incidents, and to enforce our Terms of Service.
- To comply with legal obligations, including tax, accounting, and record-keeping requirements applicable to vehicle rental businesses in Vietnam.
4. Who we share data with
We do not sell personal data. We share personal data only as needed to provide the Service:
- Service providers who process data on our behalf — cloud hosting and database infrastructure (Cloudflare, Supabase), which store the data described above.
- AI and mapping providers — trip-planning messages are sent to a third-party language-model provider to generate responses; place names and locations you mention are sent to a routing/geocoding provider (OpenRouteService) to compute directions and to a search provider (Brave Search) to find accommodation options. These providers process the specific data needed to answer that request; we do not send them your identity documents or payment information.
- Google — only if you connect Google Calendar, to create/update the calendar events you've authorized.
- Flight and accommodation partners — when you search or book flights or accommodation through the assistant, the relevant search/booking details are shared with those travel providers to return results and complete bookings.
- Legal and safety purposes — with law enforcement, insurers, or other third parties where required by law, to protect our vehicles, or to protect the rights and safety of Arion, our customers, or the public (for example, sharing a vehicle's location if it is reported stolen).
- Business transfers — if Arion is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.
5. Data retention
We retain booking records, identity documents, and rental agreements for as long as needed to fulfil the purposes described above and to meet our legal and tax record-keeping obligations, after which they are deleted or anonymized. Vehicle location/telemetry data tied to a specific rental is retained for a limited period after the rental ends, primarily to resolve disputes about fees or vehicle condition. Trip-planning chat history is retained for as long as your trip plan is active plus a reasonable period afterward, unless you ask us to delete it sooner.
6. Your rights
Subject to applicable law — including Vietnam's Personal Data Protection Decree (Decree 13/2023/ND-CP) — you may have the right to:
- Ask what personal data we hold about you and request a copy of it.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your personal data, subject to our legal retention obligations (for example, we cannot delete records we're required to keep for tax purposes).
- Withdraw consent for anything we process on the basis of your consent (such as the Google Calendar connection), which you can also do at any time from within the app.
- Object to or ask us to restrict certain processing.
To exercise any of these rights, contact privacy@arionauto.net. We may need to verify your identity before acting on a request.
7. Security
We use industry-standard safeguards — including encrypted connections, access controls, and restricted internal access to identity documents and payment information — to protect personal data. No system is perfectly secure, and we cannot guarantee absolute security, but we work to keep data protected and to respond quickly if something goes wrong.
8. International data transfers
Some of our service providers (cloud hosting, AI, and mapping providers) may process data on servers located outside Vietnam. Where this occurs, we take steps to ensure the provider offers an appropriate level of protection for the data.
9. Children's privacy
The Service is intended for adults capable of entering into a vehicle rental agreement. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly.
11. Contact us
Questions about this policy or how we handle your data: privacy@arionauto.net.