Privacy Policy

We collect personal data that you provide to us or that arises from your use of the Services. What we collect depends on how you use GoRent.

If you rent a motorcycle through the rider app

• Full name, date of birth and residential address
• National Registration Identity Card (NRIC) or FIN number, and driving licence details (classes held, validity, demerit points), obtained through Singpass when you verify your identity
• Mobile number and email address
• Photographs you take in the app: identity documents and a selfie for manual verification, and photographs of the motorcycle's condition at pickup and return
• A short video of your face when you verify your identity and before you collect a motorcycle, and the pictures of your NRIC or FIN card and of your driving licence if you verify by photo. These are checked by our identity-verification partner Didit (see Section 3), and we keep one face photo from them for as long as your account exists
• Payment information, such as card details handled by our payment processor, or a PayNow transaction reference. GoRent never stores your full card number
• Vehicle rental history, bookings and transaction records
• Messages you exchange with a rental shop through the in-app chat, and feedback or support requests you send us
• Your device's location while the app is open, used on your device to show nearby shops and sort results by distance
• Device information, such as device model, operating system version, a device identifier and a push-notification token
• Images or videos captured during physical events, roadshows, interviews, or through app-based reporting (for example, accident claims)

If you work at a rental shop using the Partner app

• Your name, work email address and mobile number, as provided by the shop that added you
• Actions you take in the app, such as confirming a pickup or return, linked to your account

If you visit the website or join the waitlist

• Your email address, for early-access updates and launch communication
• Any information you choose to provide if you contact us directly

Across the Services we also collect information that does not identify you on its own, such as browser type, app version, crash reports and usage data, through analytics and diagnostic tools (see Section 3).

Unlocking with Face ID or a fingerprint is performed entirely by your device's operating system. GoRent only receives a pass or fail result from it. Our own face check is different: it compares a short video of your face with the face photo saved when you verified, and is carried out for us by Didit as described in Section 3.

We may use your personal data for the following purposes:

• To verify your identity, age and licence eligibility before you can rent
• To confirm that the person collecting a motorcycle is the verified account holder, by comparing a selfie with the face photo saved at verification, and to detect accounts opened with someone else's identity or by a person who has been blocked
• To process and manage bookings, payments, extensions, cancellations and refunds
• To carry out the handover of a motorcycle, including recording its condition at pickup and return
• To let you and the rental shop communicate about a booking
• To give the rental shop you book with the identity details it needs for your rental, such as checking your licence at pickup and passing on traffic fines incurred during the rental
• To communicate with you regarding your account, bookings or transactions
• To resolve disputes, provide support, and respond to queries or feedback
• To detect and prevent misuse, fraud, or unauthorised access to our platform, including binding a verified account to a device
• To understand how the Services are used and to improve their reliability, performance and user experience
• To administer contests, events, referral rewards or promotions
• To send you marketing materials if you have provided consent
• To comply with applicable legal and regulatory obligations

We may disclose your personal data to the following parties:

• Rental shops (vendors) listed on our platform, for the purposes of fulfilling your booking, handing over the motorcycle, passing on traffic fines and resolving disputes. The shop you book with sees the details it needs for your rental: your name, mobile number, NRIC or FIN number, date of birth, home address, motorcycle licence classes with the date you passed each one, licence validity, and the condition photographs. It sees your NRIC or FIN and your address only for its own bookings, from payment until 180 days after the rental ends, and it never sees your demerit points
• Payment processors (Stripe), insurers and logistics providers
• Identity-verification partners: Singpass, and Didit (Didit Protocol, S.L., Spain), which checks your identity documents (your NRIC or FIN card and your driving licence) and your face on our behalf. Didit processes the face videos and document images on servers in Ireland (European Union), keeps them for up to 90 days so we can review a check, and uses them for nothing else. Verification is powered by Didit; its Verification Privacy Notice is at https://didit.me/terms/verification-privacy-notice
• Service providers that host and operate the Services, including cloud hosting, messaging and push-notification delivery, product analytics (PostHog) and crash reporting (Sentry). Analytics and crash data are stored in the United States and are limited to usage events, technical diagnostics and an internal account identifier
• Government agencies or law enforcement if required under law
• Our related companies, subsidiaries, affiliates, and professional advisors
• Any other third-party service providers who support our operations, under binding data protection agreements

We do not sell your personal data, and we do not share it with advertising networks or data brokers. If personal data is transferred outside of Singapore, we will ensure the recipient provides a standard of protection comparable to that required under the PDPA.

If you have consented, we may send you promotional messages via email, SMS, or push notifications. You may withdraw your consent at any time by:

• Clicking the ‘unsubscribe’ link in our emails
• Adjusting your notification settings in the app
• Emailing us at dpo@gorent.sg

We adopt appropriate administrative, technical, and physical safeguards to prevent unauthorised access, collection, use, disclosure, or disposal of your personal data, including:

• Role-based access control
• Encrypted databases, encrypted connections and secure storage
• Regular security audits and access monitoring

We also limit access to your personal data to staff or authorised partners who need it for operational duties.

We retain personal data for as long as necessary to fulfil the purpose for which it was collected, or as required under applicable laws and regulations. Thereafter, data will be securely deleted or anonymised. Booking and payment records may be kept for as long as the law requires for accounting and dispute purposes.

The face photo saved when you verify is kept for as long as your account exists, so that the person collecting a motorcycle can be matched to it. When your account is deleted we delete that photo and ask Didit to delete its copies of your checks at the same time.

You have the right to:

• Access your personal data held by us
• Request correction of any inaccurate data
• Withdraw consent to the use of your personal data (subject to legal and contractual obligations)
• Delete your account. You can request deletion from inside the rider app under Settings, or by writing to us. We will remove your account and personal data, except for records we are legally required to keep
• File a complaint with the Personal Data Protection Commission (PDPC) if you believe your data has been mishandled

Requests may be submitted in writing to dpo@gorent.sg. We will respond within 30 days. If additional time is required, you will be notified accordingly.

If you have any questions or concerns about this Policy or how your personal data is handled, you may contact our appointed Data Protection Officer (DPO):

We may update this Privacy Policy from time to time to reflect legal or operational changes. The latest version will always be available on this page. Your continued use of the Services constitutes your agreement to the updated Policy.