United States and Mexico
Effective date: September 14, 2026
This Privacy Policy explains how RESVO ("we," "us," or "our") handles personal information through resvo.ai, app.resvo.ai, our related services, and our business communications. It explains your privacy rights and how to contact us. RESVO is our commercial name; the legal entity operating our services is identified below.
1 About RESVO and how to contact us
RESVO is the commercial name under which the following company, incorporated in Mexico, operates our services:
Legal entity responsible: Corporativo Balety, S.A.P.I. de C.V.
Mexican tax identification number (RFC): CBA200709NU5
Address: González Ortega 29, Interior E, Colonia Guadalajara Centro, Guadalajara, Jalisco, C.P. 44100, Mexico
Privacy and personal data requests: privacy@resvo.ai
Website: https://resvo.ai
Address correspondence to the person responsible for privacy. You may write in English or Spanish and request an accessible copy of this notice.
2 When this notice applies
RESVO's own business activities. We determine how personal information is used for our website, sales inquiries, demonstrations, customer subscriptions, business relationships, support, security, and administration. For these activities, we act as the data controller or responsible party, as applicable.
Information handled for rental companies. Rental companies and other business customers use RESVO to manage their operations. They decide why renter, driver, employee, supplier, and other operational information is collected and how it is used. We generally process that information ("Customer Data") on their behalf, as a processor or service provider, under their instructions and our agreement. A service provider classification under a particular law depends on the applicable contractual and legal requirements.
Customer Data may include the following, depending on the features and records the customer uses:
- Renter and driver profiles: names, contact details, addresses, date of birth, profile photographs, tax identifiers such as an RFC, identity and driver's license numbers, issuing country, expiration dates, document images, and review status or notes entered by authorized staff.
- Rental and contract records: booking dates and rental history, pickup and return locations, the vehicle assigned, contract terms and signatures, charges, payments, billing records, and related communications.
- Vehicle and incident documents: registration or circulation cards, ownership documents, insurance provider and policy details, inspection and condition photographs, and incident records. Vehicle information is personal information when it relates to an identifiable person.
- Other operational content: employee and supplier contact records, staff notes, attachments, and information submitted to configured AI features.
The customer determines which records are needed for its rental business and who may access them under its permissions and instructions. These examples do not mean every item is required for every renter or account.
If you rent a vehicle from a company using RESVO, that rental company's privacy notice governs its collection and use of your information. Send requests about its rental records to that company first. If you contact us, we can help identify the relevant customer and support its handling of the request. This does not limit rights you have directly against RESVO under applicable law.
This notice does not replace customer processing agreements or separate notices for employment or other activities that require a specific notice.
If you provide information about another person, you must have authority or another lawful basis to do so and provide the notices and obtain the consents required for your role. Authorized users must use information they access through RESVO only for permitted purposes. These responsibilities do not remove RESVO's own legal obligations.
3 Information we collect and where it comes from
Depending on how you interact with us, we collect the following information:
- Contact and account information: name, work email, telephone number, company, role, account identifiers, authentication information, permissions, and communication preferences.
- Business and transaction information: fleet size and operating needs you provide, demo and sales interactions, subscription details, purchases, invoices, tax information, billing addresses, payment status, and limited payment method information. Payment processors collect payment credentials through their payment interfaces.
- Communications and submitted content: messages, support requests, attachments, feedback, and information you provide during meetings or demonstrations. If a session is recorded or transcribed, we provide notice and obtain consent where required.
- Device and activity information: IP address, browser and device information, approximate location inferred from IP address, pages and features used, timestamps, referral and campaign information, cookie and advertising identifiers, performance measurements, and diagnostic logs.
- Session replay information: where enabled, recordings of interactions with website or application pages used to understand problems and improve usability. These may include page content, clicks, navigation, and technical information. Masking and filtering reduce collection of some information but do not make all telemetry anonymous.
- Preferences and inferences: information about interests in RESVO features or services inferred from business interactions and website activity.
Information comes from you, your organization and its authorized users, our websites and services, payment and technology providers, connected services you authorize, referral partners, and lawful business or public sources. We may combine these sources for the purposes described here.
We seek to keep personal information relevant, accurate, and current for its purpose. Please provide accurate information and tell us when it changes; correction requests may be sent through section 11. We limit collection and use to information needed for the purposes described in this notice.
Government identifiers, financial information, precise locations, or communication contents can receive heightened protection under some laws. Ordinary RESVO account registration does not request health, genetic, religious, political, or sexual-life information. Do not send unnecessary sensitive information, card security codes, passwords, or authentication secrets in messages or uploads. If a particular workflow requires legally sensitive information, the responsible party must provide the required notice and obtain the required consent or establish another applicable legal basis.
4 Why we use information
Service and business purposes. We use information to respond to requests; arrange demonstrations; create and authenticate accounts; administer subscriptions and payments; provide, maintain, and troubleshoot the services; perform customer instructions; communicate about accounts and service changes; prevent misuse and fraud; manage permissions and records; investigate incidents; comply with legal obligations; and establish, exercise, or defend legal rights.
Optional purposes. We also use information for RESVO marketing, newsletters, invitations, voluntary surveys, campaign measurement, advertising, and recommendations about RESVO services. You may refuse these optional uses or withdraw consent where applicable without losing the underlying service. Necessary account, security, billing, and service communications may continue.
We rely on consent where required and on applicable legal exceptions for processing needed to perform a legal relationship, comply with law, or protect legally recognized interests. This notice itself does not replace express consent or another specific authorization required by law.
5 When we disclose information
We disclose information for the purposes above to the following recipients, as relevant:
- Service providers: providers of hosting, databases, authentication, storage, payments, email, messaging, customer relationship management, scheduling, support, analytics, diagnostics, and AI processing. Examples used in RESVO's operations include Supabase, Vercel, Stripe, Resend, PostHog, Sentry, and OpenAI. Providers receive information relevant to their functions, subject to the terms and safeguards applicable to those functions.
- Your organization and authorized recipients: workspace administrators, authorized colleagues, the rental company responsible for your records, and services or recipients connected or selected by that company or by you. Public or shared links can make the linked information available to their recipients; handle those links carefully.
- Advertising and measurement providers: Google, Meta, LinkedIn, OpenAI Ads, and other providers we identify when relevant. The information and choices involved are described in section 6. Advertising functions are distinct from Customer Data processing for a rental company.
- Professional advisers and authorities: legal, accounting, insurance, or other advisers, and public authorities where necessary for the relevant professional service, legal obligation, lawful request, investigation, or legal claim. This includes Mexico's Servicio de Administración Tributaria (SAT) when disclosure of tax or invoice information is legally required.
- Business transaction participants: parties and advisers involved in a proposed or completed merger, financing, reorganization, or sale of a business or assets, subject to appropriate confidentiality, notice, consent, and other legal requirements.
- Other recipients you authorize: where you direct a disclosure or provide the authorization required by law.
Some recipients, including payment processors and services you connect independently, may act as separate controllers for their own activities. Their notices govern those activities. Contact us for information about providers relevant to your service. This list is not a contractual subprocessor schedule.
6 Cookies, advertising and privacy choices
We and our providers use cookies, local storage, pixels, tags, and similar technologies for sign-in and security, preferences, analytics, diagnostics, advertising, and measuring what happens after an advertisement or referral. Some advertising integrations also send conversion events from our servers.
Advertising providers may receive online identifiers, IP and device information, browsing and campaign activity, and events such as a lead submission, demo booking, or customer conversion. Certain integrations use hashed contact information for matching. Hashing transforms information but does not necessarily make it anonymous. Providers may connect these data with information from other websites or services for measurement or advertising.
These advertising disclosures can qualify as a "sale," "sharing" for cross-context behavioral advertising, or "targeted advertising" under some US state laws, even without a monetary payment for the information. The relevant categories are contact and online identifiers, internet activity, commercial interaction information, and related interest inferences. The recipients are advertising and measurement providers.
Your choices. Contact privacy@resvo.ai with the subject "Privacy choices" to request limits on optional marketing or, where applicable, opt out of sale, sharing, or targeted advertising. Include the account or contact information relevant to your request so we can locate the records. Opting out does not stop essential service processing or all advertising.
You can block or delete cookies through your browser and use applicable advertising provider controls. Browser settings may affect functionality, may not stop server-side disclosures, and may need to be set separately for each browser or device. Deleting cookies may remove saved preferences. Our website does not currently respond automatically to "Do Not Track" or Global Privacy Control browser signals. You can submit a privacy request through the email above.
Marketing messages include an unsubscribe method where appropriate. You may also ask us directly to stop optional marketing. Refusing optional marketing or advertising does not prevent use of the core service.
7 AI features and connected services
When an authorized user uses an AI feature, RESVO and its AI processing providers may process the prompt, selected records, messages, attachments, images or voice input, generated output, and technical usage information needed for that feature. Examples include drafting, summarizing, extracting document fields, transcribing audio, and preparing permitted workflow actions.
Customer instructions, permissions, configuration, and the customer agreement govern processing of Customer Data. This notice does not authorize unrelated training of general-purpose AI models. Provider-specific retention and data use terms depend on the service and account configuration, including a customer-managed provider account where supported. Contact us for details relevant to your configuration.
AI output can be inaccurate. Rental commitments, commercial exceptions, and other consequential actions remain subject to authorized staff or configured workflow controls. Contact the rental company about a decision concerning your rental, and contact us about personal information processed in RESVO's own capacity.
If you connect a service, we process the account information, access permissions, tokens, and selected service data needed to operate that connection. For example, a Google Calendar connection uses the connected account identity and calendar access to mirror rental bookings into dedicated calendars and, when configured, send event invitations. You may disconnect a connection in RESVO or revoke permission with the provider. Disconnecting does not necessarily delete existing records or copies already shared; deletion requests can be sent through the channels in this notice.
Camera, microphone, file, and notification access is used for the features you choose and is subject to the permissions available on your device or browser. This notice does not grant unrestricted access to your device.
8 International processing
RESVO is established in Mexico. Information may be processed in Mexico, the United States, and other countries where our providers operate. Those countries may have different privacy laws. We apply the contractual, organizational, consent, and other measures required for the processing or transfer concerned. A foreign processing location does not remove rights available under applicable law. Section 12 explains additional Mexican transfer rules.
9 Retention and deletion
We retain personal information for the time needed for the purposes described in this notice, subject to legal requirements and our contractual obligations. The period depends on the information, the service, the duration of the relationship, required accounting and tax records, legal claims, security needs, and applicable deletion requests.
For example, account and subscription records are retained for service administration and applicable recordkeeping obligations; communications for responding and following up; diagnostic records for investigating faults and security issues; and marketing records for permitted communications and honoring suppression requests. Cookie and local-storage lifetimes depend on their function; these lifetimes do not necessarily equal server-side retention periods.
Customer Data retention is governed by the customer agreement, lawful instructions, and any relevant feature settings. When information is no longer needed, it is deleted or de-identified, subject to legally required blocking, restricted retention, and backup cycles. Information retained for a legal obligation or claim is limited to that purpose. Contact privacy@resvo.ai for information about a particular record or category.
You may request closure of your own RESVO account and deletion of associated personal information through privacy@resvo.ai. Closing an account does not by itself erase a rental company's operational records or information that must lawfully be retained. Requests concerning Customer Data are handled with the responsible rental company as explained in section 2.
10 Security
We use administrative, technical, organizational, and applicable physical measures designed to protect information against unauthorized access, loss, alteration, and misuse. Measures depend on the information and the service.
Access to personal information is restricted according to authorized roles and work requirements. Personnel authorized to handle it must maintain confidentiality and may use it only for authorized purposes. The confidentiality obligation continues after their relationship with us ends.
No system or transmission method is completely secure. We address security incidents and provide notifications required by applicable law and our customer agreements.
11 How to make a privacy request
Email privacy@resvo.ai or write to our address in section 1. State your name, a reply address, your country and US state if relevant, your relationship with RESVO or the rental company, and the right or action you are requesting. Describe the records if needed to locate them. You do not need to create an account to submit a request.
We may request proportionate information to verify identity or a representative's authority before disclosing, correcting, or deleting information. Do not send a full identity document with an initial ordinary email; we will explain any verification needed and how to provide it. Opt-out requests are not subject to identity verification where applicable law prohibits that requirement.
We respond through your chosen channel where practicable and explain any denial, legal exception, or need for additional information. Requests are generally free, subject only to charges expressly permitted by law. We do not unlawfully discriminate or retaliate because you exercise privacy rights. You may also raise a concern with the competent privacy regulator or attorney general.
12 Additional information for Mexico
For processing subject to Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares, RESVO's legal entity identified in section 1 is the responsible party for the own-business activities described in this notice. Sections 1, 3, 4, and 5 identify the responsible party, information, purposes, and recipients.
ARCO rights. You may request access to your personal data and information about its processing; correction of inaccurate or incomplete data; cancellation, subject to applicable blocking and retention rules; or objection to processing in the cases provided by law. You may also withdraw consent without retroactive effect and request limits on use or disclosure.
Use the channels in section 11, identifying the ARCO right or other request. Include the identification or representation evidence required by law through the verification method we arrange. For correction, describe the requested change and provide supporting documentation. You do not need to identify specific records to request access.
We communicate our ARCO determination within 20 business days after receipt of the request and, if appropriate, implement it within 15 business days after communicating the response, subject to legally applicable procedures. Each period may be extended once for an equal period where justified. Access may be provided electronically after identity verification. Consent withdrawal and limitation requests use the same contact channel; we explain any processing that must continue by law or to fulfill an existing legal relationship.
Optional purposes. You may refuse the optional purposes in section 4 when information is collected or later by contacting privacy@resvo.ai. If this notice was not provided directly or personally, you have five business days from its availability to communicate refusal of unnecessary purposes, without limiting your ability to refuse them later. Refusal does not affect necessary services.
Consent and sensitive information. Financial or patrimonial data require express consent unless a legal exception applies. Legally sensitive data require express written consent unless an exception applies. Where applicable, a separate consent mechanism identifies the information and purpose concerned; accepting this notice alone does not substitute for that mechanism.
Transfers. Disclosures to a processor acting on our behalf are distinguished from transfers to independent recipients. Domestic or international transfers may proceed without consent only when a statutory exception applies, including certain legal obligations, qualifying group-company transfers, or transfers necessary for the relevant legal relationship. When consent is required, you may accept or refuse through the specific consent mechanism before the transfer or communicate your choice to privacy@resvo.ai. Refusal prevents that optional transfer. The notice and authorized purposes are communicated to recipients as required by law. Optional advertising transfers remain subject to these requirements.
If you believe your rights have been violated, you may seek protection before the Secretaría Anticorrupción y Buen Gobierno or the competent authority that succeeds it, through its official channels at https://www.gob.mx/buengobierno.
13 Additional information for the United States
Rights vary by state and by whether a law applies to RESVO, the relevant information, and your relationship with us. Depending on applicable law, you may have rights to confirm processing; access and obtain a portable copy; correct inaccuracies; delete information; opt out of sale, sharing, targeted advertising, or certain profiling producing legal or similarly significant effects; and limit or require consent for specified uses of sensitive information. Some states also provide information about categories or identities of third-party recipients. These rights are subject to statutory conditions and exceptions.
California. Where the CCPA applies, the categories in section 3 describe the information collected for our own business activities; section 4 describes its purposes and section 5 its business-purpose disclosures. These categories also describe the preceding 12 months of such activities. Relevant categories include identifiers; customer-record information; commercial information; internet or network activity; approximate geolocation; audio or visual information when provided or recorded with required notice; professional information; and inferences. Sensitive information can include account access credentials and financial or identity information where processed. It is used for the service, security, verification, and legally permitted purposes described in this notice. Section 6 describes categories disclosed for advertising that may constitute sale or sharing and how to opt out. We do not knowingly sell or share information of people under 16.
For business-purpose disclosures, contact, account, professional, and commercial information may go to service providers and the relevant organization; billing information to payment providers and advisers; device, activity, approximate location, and diagnostic information to hosting, analytics, and security providers; and communications, submitted audio or visual content, and related inferences to the service, communication, support, or AI providers needed for that function. Necessary information may also be disclosed for the legal, corporate transaction, or authorized-recipient circumstances in section 5.
California residents may also contact privacy@resvo.ai about applicable direct-marketing disclosure rights under California's Shine the Light law. Authorized agents may submit requests subject to legally permitted proof of authority and verification.
Timing and appeals. For requests under applicable US state privacy laws, we generally respond within 45 calendar days, or sooner when required. If a lawful extension is needed, we explain the reason and expected timing. Opt-out requests are handled within applicable shorter deadlines. If we deny a request, you may appeal by replying or emailing privacy@resvo.ai with the subject "Privacy appeal." Include the original request and why you disagree. We respond within the applicable appeal deadline, generally 45 calendar days. If an appeal is denied, we explain how to contact the relevant state attorney general or regulator where required.
14 Children, external services and changes
RESVO's business services are intended for adults and are not directed to children under 18. If you believe a child has provided personal information directly to RESVO, contact privacy@resvo.ai so we can investigate and take appropriate action. Rental companies remain responsible for lawful collection of information about people included in their records, including any minors.
Links, embeds, and independently operated services may be governed by their own notices. Review those notices when using such services.
We update this notice by posting the revised version through our website and changing its effective date. For material changes, we provide additional notice or obtain consent where required. Changes do not remove rights that apply by law or authorize a materially different use without the notice or consent legally required. The English and Spanish versions describe the same policy; mandatory local law applies if there is an inconsistency. Contact privacy@resvo.ai with any question or request.