Privacy and cookies policy

Who is responsible

The controller of personal data processed on autalo.com is Moncaria LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA. For any privacy question or request, email support@autalo.com.

What data we process

• Server logs. When you open a page, our web server records technical request data: IP address, date and time, the page requested, the referring page and your browser's user agent. We use it to deliver the site, keep it secure and fix errors.
• Choices saved in your browser. Your language and currency choices are stored in your own browser (see Cookies and browser storage). They are not sent to us.
• Page ratings. If you rate a page, we store your rating for that page. To count one vote per visitor and limit abuse, we store a one-way hash made from your IP address, browser user agent and the page, not the IP address itself.
• Messages. If you email us, we process your email address and what you write, to answer you.
• Page usage (Microsoft Clarity). We use Microsoft Clarity on public pages to analyse page views, clicks, scrolling and session recordings. It loads after the page has finished loading and the browser is idle. Form input is masked by default; we do not disable that masking. Microsoft processes this data under its Privacy Statement. Microsoft Privacy Statement.

What we don't do

• We don't sell personal data.
• We don't have user accounts and don't take payments.

The car search and booking form

The car search and booking form on our rental pages are provided by our booking partner, Localrent. They load only on car rental pages; our homepage, destination directory and information pages don't load them. The booking service and its providers receive connection and interaction data and may use cookies or browser storage under their own policies.

Everything you enter to book (name, contact details, flight, payment) goes directly to the booking partner, which processes it as an independent controller under its own privacy policy, shown in the booking form. Autalo doesn't receive your payment details. The booking partner may share with us booking information needed to calculate our commission.

The booking partner's privacy policy

Localrent is operated by Renot Software OÜ, Tallinn, Estonia. Read its privacy policy before entering personal information in the booking form.

Why we process data and on what basis

• Delivering and securing the website (server logs): our legitimate interest in running a safe, working website (Art. 6(1)(f) GDPR).
• Page ratings: our legitimate interest in knowing which pages help readers, with abuse protection.
• Answering your messages and privacy requests: steps you ask us to take, our legitimate interest and our legal obligations (Art. 6(1)(b), (c) and (f) GDPR).
• Choices saved in your browser: needed to provide the function you asked for.

How long we keep data

• Server logs: 14 days, then deleted automatically.
• Page ratings: the rating and the vote hash are kept while the page is published; the daily abuse counter is reset every day.
• Emails: as long as needed to handle your request, and then no longer than required for our records.
• Browser storage: until you clear it in your browser.

Service providers and transfers

Our website is hosted on servers of Hetzner Online GmbH in Germany, which processes data on our behalf. Our email is handled by our domain and email providers. As our company is based in the United States, data may be accessed from outside the European Economic Area; where the law requires it, we use appropriate safeguards such as standard contractual clauses.

Your rights

Depending on where you live, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to data portability. To use your rights, email support@autalo.com. We may ask you to confirm your identity.

You can also complain to your data protection authority, for example the authority of your EU country of residence or the UK Information Commissioner's Office.

Cookies and browser storage

Autalo itself doesn't set cookies. We store a few choices in your browser's local storage, only to provide functions you use:

• Language (set by Autalo): the language version you chose in the menu. Kept until you clear it.
• autalo.currency (set by Autalo): the currency you chose for prices. Kept until you clear it.
• autalo.rated.<page> (set by Autalo): that you already rated a page, so we don't ask again. Kept until you clear it.
• autalo.sg (set by Autalo): a technical switch for the search suggestions. Kept until you clear it.
• Cookies and storage of the booking form (set by the booking partner and its providers, on car rental pages only): needed for the search and booking to work, under their own policies.

On your first visit we use your browser's preferred languages to open a matching language version, with English as the fallback. A direct link to a language version always keeps that language.

In the European Economic Area, the United Kingdom and Switzerland, Microsoft Clarity works without cookies when consent has not been given. We do not grant consent on your behalf or show a new consent banner for Clarity. Elsewhere, Clarity may use cookies under its own policy.

How to control storage

You can view and delete cookies and site data in your browser settings. Deleting Autalo's storage only resets your language and currency choices. Blocking the booking form's scripts or storage may stop the search or booking from working. Leaving a rental page doesn't delete data already stored by third-party services.

Children

Autalo is meant for adults planning a car rental. We don't knowingly collect data from children.

Security

The website is served over an encrypted connection (HTTPS). Access to our servers is limited to the people who run them.

Changes to this policy

We update this policy when our website or the law changes, for example before adding any new tool that processes personal data. The date at the top shows the latest version.

AI assistants and Agent API

AI assistants such as ChatGPT, Claude and Perplexity can request car offers through Autalo's Agent API. This section also covers searches sent to that API through MCP. A search can include pick-up and return locations, dates, driver age, currency, language and filters. These are search criteria: the API does not accept names, contact details or payment details, and rejects unknown fields.

To limit request frequency, the API uses a temporary salted hash of your IP address in memory, with a window of about one minute. This rate limiter does not write IP addresses to disk.

A booking link at autalo.com/go/… uses a random code associated with the selected search used to open that car's booking form. We save that search, including locations, dates, car, language, currency and channel. The search can be recovered using the code for up to 30 days after the link is created. This recovery deadline does not guarantee deletion: searches whose recovery deadline has passed are removed from the saved file when a new link is created, so data may remain on disk longer.

For click tracking, we save only a counter by channel, such as api, mcp-chatgpt or mcp-claude. These counters contain no IP address, search request or booking-link code. The channel is passed to our booking partner as a referral label.

Booking and payment take place in our booking partner's form on autalo.com, under the partner's privacy policy, as described in the section on the car search and booking form.