A checker designed to minimize data

Your selections are sent over HTTPS to the RentalRules decision API and used transiently to calculate the response. The public alpha does not create an account or intentionally write checker answers to the policy database or application logs.

Never enter card numbers, identification numbers or upload identity documents to this website. Available card room is entered only as a dollar amount for the estimate.

Operational infrastructure may record standard request metadata such as time, route, response status and network information. Optional first-party analytics run only after consent, respect Do Not Track and Global Privacy Control, and store daily aggregate page-view, checker-start, step-progress, checker-completion, anonymous supplier-verdict-state, official-source-click and booking-click counts without trip answers, clicked destinations or identifiers. Only the event name and broad page category are sent; no earlier steps are replayed after consent. When you run the checker with analytics consent on, one more daily aggregate count is added for the combination of airport, age band (18–20, 21–24 or 25+), licence-issuing country and card type (credit, debit or prepaid). Your exact age, trip dates, funds, name and any other answer are never sent, and the count is not linked to an identifier, IP address, cookie or user agent. Prefilled checker links (for example from an airport rules page) only set form defaults in your browser; nothing is sent until you run the check, and then only under the same consent rules. Your consent choice is saved locally in your browser. Saved results, email alerts and identity-document collection are not active.

When a page is opened from a link in ChatGPT, Perplexity, Microsoft Copilot, Google Gemini or Claude, our server adds one to a daily aggregate count for that day, the assistant's name and the broad page category (for example airport, guide or compare). The browser's referrer, or a utm_source=chatgpt.com tag on the link, is read only to recognise the assistant and is not stored. We do not store your IP address, user agent, cookies, the referring or landing URL, query strings or any identifier, and nothing is written to your device, so this count does not need the analytics consent choice. It is skipped when Do Not Track or Global Privacy Control is on and for automated or synthetic sessions.

After you choose Allow analytics, Google Analytics 4 uses cookies and receives page-category and action events, such as checker completion and booking-link clicks, along with standard device/network information. We send only broad page categories, not URL query strings, referrers, exact trip answers, contact details or booking references. Google advertising storage and personalization are disabled. Earlier consent to anonymous first-party counts does not authorize this integration: we ask again. Decline prevents loading the Google tag. Do Not Track, Global Privacy Control and detected synthetic sessions also prevent loading it. To withdraw consent, clear this site's stored data in your browser and choose Decline on your next visit. Google's privacy policy applies to its processing.

Discover Cars buttons first pass through a CanIRentACar redirect (/go/discovercars) and then open a separate website. The redirect takes only the page type, airport and supplier name already shown on the page; with analytics consent, and not when Do Not Track or Global Privacy Control is on, it adds one to a daily aggregate counter for that page type, airport and supplier, without storing your IP address, user agent, cookies, referrer or any identifier. The Discover Cars link includes our affiliate ID, a placement code and, where relevant, the airport destination. Other checker answers are not included. We do not load Discover Cars scripts, widgets or cookies on this site. Discover Cars may use referral cookies and process information under its own privacy and cookie policies after you visit it. See our affiliate disclosure for how commissions and referral tracking work.

The optional “Also compare on Booking.com Cars” link goes directly to Booking.com through our CJ Affiliate tracking link and does not pass through a CanIRentACar redirect. We add no renter answers to it. Only after you choose Allow analytics, and not when Do Not Track or Global Privacy Control is on or for automated or synthetic sessions, your browser sends a small count request to /api/booking-click when you click it, containing only the page type where the link appeared and, where relevant, the airport code. The server accepts only allowlisted values and adds one to a daily aggregate counter for that day, page type and airport, which also keeps the time of the first and latest counted click for that row. It does not store your IP address, user agent, cookies, referrer, clicked URL or any identifier; the network address used for temporary rate limiting is not saved. Booking.com and CJ Affiliate operate their own cookies and privacy policies once you open the link.

The report-error form stores the selected airport, supplier, report text, optional official source URL, related policy version when supplied, status and audit timestamps. It does not request a name or email. Do not place personal, booking, card or identity information in the report.

The contact form stores the selected topic, message text, a content hash used to detect duplicate submissions, the reference ID, review status and timestamps. The editor’s protected inbox also records a resolution note and reviewer when a message is closed. We do not request a name, email, phone number or document upload, and the form cannot send a personal reply.

Do not include personal details, booking references, home addresses, or card, passport or licence numbers in either public form. Obvious email addresses and some long number patterns are rejected by the contact form, but this is not a guarantee that all personal information can be detected. Message text is not intentionally copied into application error logs. Abuse controls use temporary request-level limits and database-wide volume limits; the inquiry record does not store your IP address.

Policy evidence, audit records, editorial inquiries and correction workflow records are retained for traceability. Closed messages may remain in the editorial record; no automatic deletion period is currently promised. Anonymous correction text may be removed from active workflow after review, while the minimal append-only audit event remains. Infrastructure request logs are governed by the hosting provider’s operational retention. Last internally reviewed: 19 October 2026.