For · Customers and visitors

Privacy Notice

Customers and visitors

Version
2.1.4
In effect since
Last updated
October 12, 2026

You are viewing a specific version of this document. View the current version

View the Spanish version

Courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

1. Data controller

KORU HOLDING, S.A.S., the company that operates the KORU brand, with address at Marie Curie 303, interior C13, Reforma y Ferrocarriles Nacionales, Toluca de Lerdo, Estado de México, C.P. 50070, is the data controller responsible for processing your personal data, in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexican Federal Law on the Protection of Personal Data Held by Private Parties).

Privacy contact: legal@korurent.com

2. Data we process

Website visitors:

  • IP address, device and browser type, language, pages visited and approximate location.
  • Precise device location, only if you allow it in your browser, to show you nearby vehicles and delivery points.
  • Contact form data: name, email and phone number.
  • Source of your visit, in KORU's own koru_attr cookie: campaign parameters, KORU short link, referring domain and landing page, with a random identifier. If you book, it is stored with your booking (section 10).
  • Only if you accept advertising cookies: Meta's advertising identifiers in your browser (the _fbp and fr cookies) and the actions you take on the site, such as searches, vehicles viewed, starting a booking or a payment, completed payments (amount and currency only), applications to register as a Partner and contacts via WhatsApp.

Customers:

  • Identification and contact: name, date of birth, email, phone number and profile photo (optional).
  • Data from your official ID and driver's license: name, document number, expiry date and verification result.
  • Rental data: dates, vehicle, delivery location, signed agreement, inspection photos, mileage, incidents and reviews.
  • Payment: last four digits of the card and the status of the payment, the deposit and refunds. Only Stripe processes the full card number.
  • Invoicing: RFC (Mexican tax ID), legal name, tax regime and tax address, when you request a CFDI (Mexican electronic invoice).
  • Evidence of the electronic signature: date, time, IP address, device and location at the moment of signing.
  • Recent searches and saved vehicles, if you are signed in.
  • Communications with our team. If you message us or comment on our social media or via WhatsApp, please also see the section «If you message us on social media or WhatsApp» of this notice: https://korurent.com/en/privacy-policy#redes-y-whatsapp

If you are also a Partner, your data as a Partner is governed by the Privacy Notice for Partners.

3. Biometric data (sensitive data)

To verify your identity, Didit compares a photo of your face (liveness check) with the photo on your ID. This biometric data is sensitive personal data, so it is processed only with your express consent, which you give on the verification screen before starting.

Didit captures and processes the images on its own platform. KORU keeps only the verification result and the document data needed for the agreement, not the images of your face.

If you do not give this consent, you can browse and book, but we will not be able to hand over a vehicle to you.

4. What we use your data for

Purposes necessary for the service:

  • Creating and managing your account.
  • Verifying your identity and driver's license and preventing fraud.
  • Managing bookings, payments, deposits, refunds and invoices.
  • Preparing, signing and keeping the rental or provider agreement.
  • Carrying out the handover, inspections and return, and handling incidents, damage and claims.
  • Paying Partners and complying with tax and legal obligations.
  • Sending you notices about your booking, your account and changes to this notice.
  • Keeping the Platform secure.
  • Serving you through our official channels (WhatsApp, Instagram, Facebook and the website), recognizing that you are the same person on any of them and keeping what we promised you (section 10).
  • Estimating your approximate region from your phone's area code, to serve you in your language and according to your destination, and for statistics by region.
  • Knowing which post, video, message or link brought you to book (attribution), with KORU's own koru_attr cookie and your booking data, so that we invest in what works.
  • Supporting our team with artificial intelligence tools that classify and summarize messages and prepare draft replies that a person reviews (section 10).

Additional purposes (you may object without affecting the service):

  • Sending you promotions and news.
  • Measuring use of the site to improve it, with analytics cookies that are activated only if you accept them.
  • Measuring and improving our advertising campaigns on Meta (Facebook and Instagram) and showing you KORU ads if you have already visited the site (remarketing), with advertising cookies that are activated only if you accept them.
  • Asking for your opinion about the service.
  • Inviting you, if you have already messaged us or rented with us, to sign up on korurent.com or to list your vehicle as a Provider (section 10).

To object to the additional purposes, write to legal@korurent.com. For promotions and invitations you can also use the unsubscribe link in each email or message us «NO ADS» (in Spanish, «NO PUBLICIDAD»). For analytics and advertising cookies, simply reject that category in the cookie banner or, at any time, through the «Cookies» link at the bottom of the page.

5. Who we share your data with

We share your data, without needing your consent, when necessary to perform the agreement or comply with the law:

  • With the Partner who owns the vehicle you rent: your name, contact details and booking details, only to hand over and receive the vehicle. The Partner is obliged not to use them for other purposes.
  • With the partner insurer and its adjusters: to issue the coverage for your rental and handle claims.
  • With competent authorities, when required by law or court order, including the Servicio de Administración Tributaria (Mexican tax authority).

Only with your consent, which you give by accepting advertising cookies in the cookie banner:

  • With Meta Platforms, Inc. (Facebook and Instagram), headquartered in the United States: the identifiers and actions described in «Data we process», together with your IP address and data about your browser and device, to measure our campaigns and show you KORU ads. Meta also processes them under its own privacy policy. If you reject that category, we do not send this data to Meta.

We do not sell your personal data.

6. Providers that process data on KORU's behalf

These providers use your data only to deliver the contracted service to us:

  • KORU HOLDING LLC (Delaware, United States), a KORU company: operates our applications on Meta, TikTok and Google and carries out the analytics of our channels and campaigns, only on our instructions.
  • Supabase: database, authentication and file storage.
  • Vercel: website hosting and performance measurement.
  • Stripe: processing of payments, deposits and refunds.
  • Didit: verification of identity, driver's license, liveness and phone number.
  • Resend: sending transactional emails and, unless you have unsubscribed, news and invitations.
  • Google and Apple: sign-in, if you choose that option.
  • Google Analytics: usage statistics, only if you accept analytics cookies.
  • CARTO, OpenStreetMap and Frankfurter: maps, address search and exchange rates (they receive no data from your account).
  • Contabo (servers in St. Louis, United States): KORU's server, which runs the customer service inbox, our customer follow-up system (CRM), automations and the internal assistant Hermes.
  • Cloudflare (R2 service, United States): encrypted backups of that server.
  • Chatwoot Inc. (United States): only the delivery of notifications from the customer service mobile app used by our team; it does not store the conversations.
  • Anthropic (United States): artificial intelligence (Claude models) to summarize conversations, identify commitments and dates, prepare draft replies that a person reviews, analyze the conversation history and run the internal assistant Hermes.
  • TypeSafe AI (United States): artificial intelligence to classify messages by intent, urgency, type of contact and stage.
  • Telegram: internal messaging of the KORU team; it carries internal alerts, which contain no customer data, and Hermes's answers, which may include excerpts of conversations.

Some of these providers store information on servers outside Mexico, mainly in the United States, with contractual security measures.

7. How long we keep your data

  • Agreements, payments and invoices are kept for up to 10 years, due to obligations under the Código de Comercio (Commercial Code) and the Código Fiscal de la Federación (Federal Tax Code).
  • Account data is kept while the account is active. When you close it, the data is blocked and deleted once the legal periods end.
  • Inspection photos are kept as long as they may be needed to clarify damage or claims.
  • Conversations through our channels, commitments and follow-ups, notices to Providers and the decisions of the artificial intelligence tools are deleted after 24 months without activity.
  • Your unified contact record is anonymized after 24 months without activity: your phone number, email, notes and identifiers on each platform are deleted, and only the area code, approximate region and type of audience remain, for statistics.
  • The copy of your bookings in our customer follow-up system (CRM) is blocked after 24 months and deleted after 72 months. The Platform's agreement, payments and invoices follow the period in the first point.
  • Click records of our short links are deleted after 12 months; technical identifiers of comments on our posts, after 7 days; and our server logs, after 90 days.
  • The examples we use to evaluate the automated assistant are kept for no more than 24 months.
  • The server's encrypted backups are renewed periodically: what is deleted from the system disappears from the backups when they are replaced.
  • We suspend these deletions while a law requires us to keep the data or while an ARCO rights request is being processed.

8. Your rights (ARCO) and how to exercise them

You may access your data, rectify it, cancel it or object to its processing, as well as revoke your consent or limit its use.

Send your request to legal@korurent.com with:

  • Your name and your account email.
  • A copy of your ID (or that of your representative and the document that proves the representation).
  • The right you wish to exercise and the data it refers to.

We will reply within a maximum of 20 days from receipt of your request and, if appropriate, we will give effect to it within the 15 days following our reply. If the circumstances justify it, we may extend each period once for an equal period; we will let you know within the original period. Before handing over your data we will verify your identity or that of your representative.

Some data cannot be cancelled while there is a legal obligation to keep it. For example, a signed agreement cannot be modified or deleted; in that case we block it and use it only to comply with the law or defend rights.

If you believe your rights were not respected, you may contact the personal data protection authority, the Secretaría Anticorrupción y Buen Gobierno.

To request deletion of your data, including data we obtained through our social media and WhatsApp, follow the instructions in the section «How to delete your data»: https://korurent.com/en/privacy-policy#eliminar-datos

9. Cookies and similar technologies

We use cookies and local storage needed for the site to work; KORU's own koru_attr cookie, which records which post, message or link you came from in order to know what brought each booking (KORU's own measurement, without your name, email or phone number); and, only with your consent, analytics and advertising cookies. With advertising cookies, the Meta pixel obtains identifiers from your browser and the actions you take on the site, to measure our campaigns on Facebook and Instagram and show you KORU ads. See the details in our Cookie Policy (version 3.1): https://korurent.com/en/cookie-policy. You can change your choice at any time through the «Cookies» link at the bottom of the page.

10. If you message us on social media or WhatsApp

This section applies to anyone who messages us or comments on our official channels, even without an account on korurent.com. Anything not stated here is governed by the rest of this notice.

Channels and customer service inbox:

  • Our official channels are Instagram (@korurent), Facebook (KORU page) and WhatsApp (+52 55 4443 2191). Messages arrive in KORU's own customer service inbox, installed on our server; our team also accesses it through that inbox's mobile app.
  • We process your identifier on the platform, your name or username, your public profile photo, your phone number (on WhatsApp), the content and attachments of your messages and their date and time, to answer your questions, give quotes, take bookings and provide support.
  • Our WhatsApp number is connected to Meta's WhatsApp Business Platform, and chats are also handled from the WhatsApp Business app. Once 24 hours have passed since your last message, we only write to you with templates approved by Meta.
  • Meta (Instagram, Facebook and WhatsApp) carries and processes the messages as a platform, under its own terms and privacy policies. KORU HOLDING LLC, a KORU company, operates the KORU applications on Meta that this inbox runs on (section 6).

Automated messages and phrases to decide:

  • A rule-based automated assistant suggests KORU-approved replies to our team. If you comment a keyword on one of our posts, we send you a single private direct message with the information you asked for.
  • Later on, only if it passes an evaluation with our own data, the assistant may answer clear cases on its own in Spanish and English, always with approved texts; in French, Italian and German it will keep only suggesting replies to our team. The assistant never gives prices or decides on rentals, payments, deposits or the verification of your identity.
  • At any time you can write in the chat, in your language:

– «human» (humano, humain, Mensch, umano): a person will assist you.

– «NO AI» (SIN IA, SANS IA, OHNE KI, SENZA IA): your conversation is no longer processed with artificial intelligence.

– «NO ADS» (NO PUBLICIDAD, PAS DE PUBLICITÉ, KEINE WERBUNG, NIENTE PUBBLICITÀ): we do not send you advertising or invitations.

– «DELETE MY DATA» (ELIMINAR MIS DATOS, SUPPRIMER MES DONNÉES, MEINE DATEN LÖSCHEN, CANCELLA I MIEI DATI): we start the deletion of your data (section 11).

Artificial intelligence:

  • TypeSafe AI (United States) classifies messages by intent (price, booking, requirements, Provider, among others), urgency, type of contact and stage.
  • Anthropic (United States, Claude models) summarizes conversations, identifies commitments and dates, prepares draft replies that a person reviews and helps us analyze the conversation history to improve our service.
  • Artificial intelligence does not make decisions with legal effects on you: it does not decide on rentals, payments, deposits or the verification of your identity. With «NO AI» you can exclude your conversation.

Internal assistant Hermes:

  • Hermes is an internal assistant that runs on our server with Anthropic models and is used only by the authorized person of KORU's management, via Telegram. It consults, without being able to modify them, our customer follow-up system and the history of KORU's business WhatsApp chats, in which emails and phone numbers are hidden. Its answers may include excerpts of conversations with customers. Hermes does not write to or answer customers.
  • Telegram carries those answers. The automated internal alerts we send through Telegram contain no customer data.

One contact across all channels:

  • Our customer follow-up system (CRM), on our server, recognizes that you are the same person on WhatsApp, Instagram, Facebook and the website using your phone number in international format, your identifier on each platform and, only to link them, your email. It stores data about the conversations (not the text of the messages), what KORU promised you and when, follow-ups, notices to Providers and the decisions of the artificial intelligence tools.
  • When you ask for an urgent rental, we notify the relevant Provider via WhatsApp with a template that contains only the city, the vehicle and the dates, with no payment data.
  • From the country code and area code of your phone number we estimate your approximate region (for example, «Puerto Escondido, Oaxaca»), based on Mexico's National Numbering Plan. We do not use your GPS location or your IP address for this.

Where your booking came from:

  • KORU's own koru_attr cookie (first-party, which the page's scripts cannot read, lasting 90 days) stores the first and the last source of your visit: campaign parameters (UTM), the KORU short link, the referring domain (not the full address), the landing page (without parameters) and a random identifier. It does not store your name, email or phone number. Details are in the Cookie Policy.
  • If you book, that source is stored with your booking and, in summary form (campaign and short link), in the payment data at Stripe.
  • When a booking is paid or cancelled, the website notifies our CRM with: rental identifier, status, city, vehicle type, dates, total and currency, your email and an encrypted fingerprint of it, your phone number and the source of the booking.
  • If you arrive from WhatsApp, we ask for your mobile number to complete the booking. Sales closed via WhatsApp are also recorded on the Platform with the source of the contact.
  • The links we share in messages, bios and videos go through our own redirector (flows.korurent.com), which records each click: time, source network, approximate country (calculated from the IP address, which is not stored) and device type.
  • The statistics of our own Instagram and Facebook accounts (reach, views and interactions) are aggregated and do not identify anyone.

Analysis of past conversations:

  • Using the backups of KORU's WhatsApp (conversations since October 2025), we identified the business chats and analyzed them with TypeSafe AI and Anthropic to understand frequent questions, response times and the reasons why a rental does not go ahead, and to improve the way we reply. From this we produced a service guide, saved replies and a set of examples to evaluate the automated assistant. The reports contain only aggregated figures and examples without personal data.

Invitations (additional purpose):

  • If you have already messaged us or rented with us, we may invite you to sign up on korurent.com or to list your vehicle as a Provider: by email, at most one every 14 days, and via WhatsApp, where we first ask you with a template whether you want to receive news and send you the invitation only if you accept. We do not invite anyone who has unsubscribed or has a rental in progress.
  • You can object before or after receiving it: use the unsubscribe link in each email, message us «NO ADS» (in Spanish, «NO PUBLICIDAD» or «BAJA») or write to legal@korurent.com. Objecting does not affect the service.

Google services:

  • Today we do not use Google services to autocomplete addresses. If we do so in the future, we will update this notice beforehand.

The retention periods for this data are in section 7.

11. How to delete your data

You can ask us to delete your data, even if you do not have an account on korurent.com, including the data we obtained through our social media and WhatsApp:

  • By email: write to legal@korurent.com with the subject «Data deletion» and give your name and the phone number, email or username you used to message us.
  • By message: write «DELETE MY DATA» (or «ELIMINAR MIS DATOS», «SUPPRIMER MES DONNÉES», «MEINE DATEN LÖSCHEN» or «CANCELLA I MIEI DATI») in the WhatsApp, Instagram or Facebook chat where you talked to us.

Deadlines: we will reply within a maximum of 20 days from receipt of your request and, if appropriate, we will carry it out within the 15 days following our reply. If the circumstances justify it, we may extend each period once for an equal period; we will let you know within the original period. We may ask you to confirm that the account, number or email is yours.

What we delete: your unified contact record, your identifiers on each platform, the index of your conversations, commitments and follow-ups, notices to Providers and the decisions of the artificial intelligence tools that refer to you. If you also have an account on korurent.com, your request is handled for it as well under section 8.

What we keep: the agreements, payments, invoices and booking data that the law requires us to keep (section 7). We block them, no longer linked to your contact, use them only to comply with the law or defend rights, and delete them when those periods end. Deleted data disappears from the backups when they are replaced.

Messages that remain on Instagram, Facebook or WhatsApp depend on those platforms; you can delete them from your app.

12. Security

We apply administrative, technical and physical measures to protect your data: encryption in transit, profile-based access control, activity logging and review of providers. If a breach occurs that significantly affects your rights, we will inform you without delay so that you can take action.

13. Minors

The Platform is intended for people over 18 years of age. We do not knowingly collect data from minors. If we detect an account belonging to a minor, we will cancel it.

14. Changes to this notice

We will publish any change on this page with its update date. If the change affects the purposes or requires new consent, we will inform you by email or in your account and ask you to accept it.