Privacy and cookies policy

Who is responsible

The controller of personal data processed on autalo.com is Moncaria LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA. For any privacy question or request, email support@autalo.com.

What data we process

• Server logs. When you open a page, our web server records technical request data: IP address, date and time, the page requested, the referring page and your browser's user agent. We use it to deliver the site, keep it secure and fix errors.
• Choices saved in your browser. Your language and currency choices are stored in your own browser (see Cookies and browser storage). They are not sent to us.
• Page ratings. If you rate a page, we store your rating for that page. To count one vote per visitor and limit abuse, we store a one-way hash made from your IP address, browser user agent and the page, not the IP address itself.
• Messages. If you email us, we process your email address and what you write, to answer you.
• Page usage (Microsoft Clarity). We use Microsoft Clarity on public pages to analyse page views, clicks, scrolling and session recordings. It loads after the page has finished loading and the browser is idle. Form input is masked by default; we do not disable that masking. Microsoft processes this data under its Privacy Statement. Microsoft Privacy Statement.

If you submit a home-page search with a destination and dates, your browser can save one last search: its destination identifier, pickup and return dates, save time and format version. The saved record is not sent automatically; submitting the ordinary search passes the chosen search parameters in the usual way.

What we don't do

• We don't sell personal data.
• We don't have user accounts and don't take payments.

The car search and booking form

The car search and booking form on our rental pages are provided by our booking partner, our booking partner. They load only on car rental pages; our homepage, destination directory and information pages don't load them. The booking service and its providers receive connection and interaction data and may use cookies or browser storage under their own policies.

Everything you enter to book (name, contact details, flight, payment) goes directly to the booking partner, which processes it as an independent controller under its own privacy policy, shown in the booking form. Autalo doesn't receive your payment details. The booking partner may share with us booking information needed to calculate our commission.

Why we process data and on what basis

• Delivering and securing the website (server logs): our legitimate interest in running a safe, working website (Art. 6(1)(f) GDPR).
• Page ratings: our legitimate interest in knowing which pages help readers, with abuse protection.
• Answering your messages and privacy requests: steps you ask us to take, our legitimate interest and our legal obligations (Art. 6(1)(b), (c) and (f) GDPR).
• Choices saved in your browser: needed to provide the function you asked for.

How long we keep data

• Server logs: 14 days, then deleted automatically.
• Page ratings: the rating and the vote hash are kept while the page is published; the daily abuse counter is reset every day.
• Emails: as long as needed to handle your request, and then no longer than required for our records.
• Browser storage: until you clear it in your browser.

The last-search record is valid for seven days from confirmation. Checking it does not extend this period. After expiry it is ignored and removal is attempted when it is next checked. A new confirmed search replaces it.

Service providers and transfers

Our website is hosted on servers of Hetzner Online GmbH in Germany, which processes data on our behalf. Our email is handled by our domain and email providers. As our company is based in the United States, data may be accessed from outside the European Economic Area; where the law requires it, we use appropriate safeguards such as standard contractual clauses.

Your rights

Depending on where you live, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to data portability. To use your rights, email support@autalo.com. We may ask you to confirm your identity.

You can also complain to your data protection authority, for example the authority of your EU country of residence or the UK Information Commissioner's Office.

Cookies and browser storage

We use browser storage for the choices below. With your consent, the OpenAI advertising pixel also sets the cookies described in the advertising section.

• Language (set by Autalo): the language version you chose in the menu. Kept until you clear it.
• autalo.currency (set by Autalo): the currency you chose for prices. Kept until you clear it.
• autalo.rated.<page> (set by Autalo): that you already rated a page, so we don't ask again. Kept until you clear it.
• autalo.sg (set by Autalo): a technical switch for the search suggestions. Kept until you clear it.
• Cookies and storage of the booking form (set by the booking partner and its providers, on car rental pages only): needed for the search and booking to work, under their own policies.

On your first visit we use your browser's preferred languages to open a matching language version, with English as the fallback. A direct link to a language version always keeps that language.

In the European Economic Area, the United Kingdom and Switzerland, Microsoft Clarity works without cookies when consent has not been given. We do not grant consent on your behalf or show a new consent banner for Clarity. Elsewhere, Clarity may use cookies under its own policy.

We also measure successful booking confirmations in site analytics. To avoid repeat counts, browser storage autalo.confirmed-orders.v1 keeps the recent booking references on this device until you clear it. The booking reference is sent to site analytics together with the confirmation as an internal key, and is not shown to other visitors. Browser storage autalo.first-touch.v1 keeps the source, medium and campaign tags (utm_source, utm_medium, utm_campaign) of the link you first arrived by for one month, and they are sent with the confirmation to show which campaign brought the booking.

autalo.last-search: one last confirmed home-page search, saved in this browser to let you restore its destination and dates. It does not contain prices, availability, payment details or your name.

How to control storage

You can view and delete cookies and site data in your browser settings. Clearing site storage also resets your advertising choice. Use the button in the advertising section of this page to change your choice or withdraw consent. Blocking the booking form’s scripts or storage may stop search or booking from working. Leaving a page does not delete third-party data already stored.

Children

Autalo is meant for adults planning a car rental. We don't knowingly collect data from children.

Security

The website is served over an encrypted connection (HTTPS). Access to our servers is limited to the people who run them.

Changes to this policy

We update this policy when our website or the law changes, for example before adding any new tool that processes personal data. The date at the top shows the latest version.

AI assistants and Agent API

AI assistants such as ChatGPT, Claude and Perplexity can request car offers through Autalo's Agent API. This section also covers searches sent to that API through MCP. A search can include pick-up and return locations, dates, driver age, currency, language and filters. These are search criteria: the API does not accept names, contact details or payment details, and rejects unknown fields.

To limit request frequency, the API uses a temporary salted hash of your IP address in memory, with a window of about one minute. This rate limiter does not write IP addresses to disk.

A booking link at autalo.com/go/… uses a random code associated with the selected search used to open that car's booking form. We save that search, including locations, dates, car, language, currency and channel. The search can be recovered using the code for up to 30 days after the link is created. This recovery deadline does not guarantee deletion: searches whose recovery deadline has passed are removed from the saved file when a new link is created, so data may remain on disk longer.

For click tracking, we save only a counter by channel, such as api, mcp-chatgpt or mcp-claude. These counters contain no IP address, search request or booking-link code. The channel is passed to our booking partner as a referral label.

Booking and payment take place in our booking partner's form on autalo.com, under the partner's privacy policy, as described in the section on the car search and booking form.

Advertising measurement (OpenAI)

With your consent, we load the OpenAI advertising pixel to measure page visits, car searches, car selections and openings of the booking form that may be attributed to ads. OpenAI receives the event, page path or catalogue car ID, advertising identifiers and technical connection/browser data. Page visits, searches, car selections and opening the form do not themselves confirm a booking or payment. Our own event calls do not include rental dates, full query strings, contact details or payment details. If automatic advanced matching is enabled for the pixel, its SDK can detect supported contact details on the page and hash them in your browser to match events to ads. It sends these hashes, not the raw contact values.

The pixel loads only after you allow advertising cookies. It uses first-party cookies __oppref (30 days after capture of an advertising click identifier) and __obref (365 days after creation). Browser restrictions may shorten these lifetimes. Your choice is saved as autalo.ads-consent.v1 in local storage for 180 days. Use the button in the advertising section of this page to change your choice or withdraw consent. Withdrawal stops future measurement and asks the SDK to remove its attribution cookies; it does not erase events already sent.

OpenAI processes the data under its privacy policy. Advertising measurement is based on your consent. The car search and booking form work if you reject it. OpenAI.

After the booking partner’s form shows a successful confirmation, we also measure that confirmation and use its booking ID to identify the same event across repeat displays. This is the confirmation shown by the partner’s form, not an independent server-side payment reconciliation.