Privacy Policy - RentalDisputes

1. Who We Are

RentalDisputes ("we", "us", "our") is a legal information platform operated from Estonia, European Union. We help European consumers dispute unfair rental car damage charges using AI-powered case analysis and dispute letter generation.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), we are the data controller responsible for your personal data.

2. What Data We Collect

We collect and process the following categories of personal data:

Data category	Examples	Source
Contact information	Name, email address	Lead form submission
Case details	Rental company name, country, incident description, amounts claimed, rental agreement numbers	Provided by you during intake
Uploaded documents	Rental agreements, damage claims, invoices, photos, police reports	Uploaded by you
Communication data	Email correspondence related to your case	Email communication
Payment data	Payment status, transaction references (we do not store card numbers)	Stripe (payment processor)
Usage data	Page visits, form submissions, case status	Generated during service use

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR:

Contract performance (Art. 6(1)(b)): Processing is necessary to provide you with our dispute analysis and resolution services. When you submit a case assessment request, we process your data to fulfil that service request.
Legitimate interest (Art. 6(1)(f)): We may process aggregated, anonymised data to improve our service, train our models, and compile case outcome statistics.
Legal obligation (Art. 6(1)(c)): We may process data where required by applicable law, such as tax and accounting obligations.

4. How We Use Your Data

We use the data we collect for the following purposes:

Dispute analysis: Analysing your documents and case details to assess the strength of your dispute.
Letter generation: Generating legally grounded dispute letters tailored to your case, rental company, and jurisdiction.
Case management: Tracking the progress of your dispute and sending you relevant updates.
Payment processing: Calculating and collecting success fees upon resolution.
Service improvement: Analysing anonymised case outcomes to improve the accuracy and quality of our service.

5. AI Processing Disclosure

Your case data, including uploaded documents and case details, is processed using artificial intelligence provided by Anthropic (Claude API). This means:

Your case information is sent to Anthropic's API for analysis and document generation.
Anthropic processes this data solely to generate responses for our service and does not use it to train their models (per Anthropic's commercial API terms).
No human at Anthropic reviews your data in the ordinary course of service delivery.

We use AI to generate case assessments and dispute letters. These outputs are based on the information you provide and our legal knowledge base. While we strive for accuracy, AI-generated content should be reviewed by you before use.

6. Data Sharing

We share your personal data only with the following parties and only as necessary to provide our service:

Recipient	Purpose	Data shared
Anthropic (Claude API)	AI-powered case analysis and document generation	Case details, document contents
Amazon Web Services (SES)	Lead form email notification delivery	Name, email, rental company, charge amount
Stripe	Payment processing for success fees	Email, transaction amount
Google (Analytics/Ads)	Website analytics and ad conversion tracking	Anonymised usage data, conversion events
Meta (Facebook/Instagram)	Ad conversion tracking	Anonymised conversion events

We do not sell your personal data. We do not share your data with any other third parties, advertisers, or data brokers.

7. Data Retention

We retain your personal data as follows:

Active cases: Data is retained for the duration of your dispute and case management.
Resolved cases: Case data is retained for 2 years after the date of resolution, to allow for any follow-up and to comply with legal retention requirements.
After retention period: All personal data associated with your case is permanently deleted. Anonymised, aggregated statistics (e.g., success rates by company and jurisdiction) may be retained indefinitely.
Payment records: Retained as required by Estonian tax and accounting law (generally 7 years).

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): You may request a copy of all personal data we hold about you.
Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interests.
Right to restrict processing (Art. 18): You may request that we limit how we use your data.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint: You may file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

9. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at:

Email: privacy@rentaldisputes.co

We will respond to your request within 30 days. We may ask you to verify your identity before processing your request. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS) and at rest.
Secure document storage with access controls.
Access to production systems restricted to authorised personnel only.
Regular review of security practices and access controls.
Use of reputable, GDPR-compliant infrastructure providers.

11. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA):

Anthropic (AI processing) is based in the United States. Transfers to Anthropic are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring an adequate level of data protection.
Stripe (payments) processes data in accordance with their GDPR compliance framework, including SCCs for international transfers.

We do not transfer your personal data to any country outside the EEA without appropriate safeguards in place.

12. Children's Data

Our service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or by posting a notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us:

Data Protection Officer
RentalDisputes
Email: privacy@rentaldisputes.co
Estonia, European Union

15. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
www.aki.ee