Privacy policy

Last updated: 22 October 2026

Who we are

DECK is a product of RETA LLC, a company based in the United Arab Emirates. It is operations software for rent a car companies, and in this policy DECK means us. For anything about your data, write to info@deck.ae and one of our employees will answer.

Two kinds of data, and they are not the same

This is the most important thing on the page, so it comes first.

Your data. Your name, your email, your phone number, your company details and what you do inside the panel. We decide how this is handled, so for this data we are what the law calls the controller.

Your renters' data. Passports, Emirates IDs, driving licences, phone numbers, signatures and rental history belong to the people who hire cars from you. That data is yours, not ours. You decide what goes in and what comes out; we only hold it and process it on your instructions. For that data you are the controller and we are the processor.

What this means in practice: we do not sell it, we do not mine it and we do not use it to train anything. People at DECK look at it only to answer you when you ask for support, to review a blacklist flag, and to find and fix a problem in the panel, which can mean watching a recording of the panel's screen, as described under Who else touches it. If you close your account, we delete it as described below.

A small part of what passes through DECK we use to run DECK itself, and for that part we are the controller: error reports and screen recordings, so we can find and fix problems; how much of each paid service each company used, so we know what DECK costs to run; and the list of accounts on DECK, so we can support them and manage subscriptions.

What the website collects

The pages you are reading now, on deck.ae, collect almost nothing. There is no contact form and no newsletter. If you message us on WhatsApp or send an email, we have whatever you wrote and the number or address you wrote it from.

We count page views and see which pages people read, so we know which guide was worth writing. It is measured without cookies and without building a profile of you, and it cannot be used to identify a visitor.

What the panel collects

Inside the panel, at app.deck.ae, DECK holds what running a rental business needs and nothing decorative:

Your account: name, email, phone number, and the password or Google sign-in you use to get in. For each signed-in session we keep the time, the IP address and the browser, so a session that is not yours can be spotted. We also keep a record of who on your team did what and when, such as a hand-over, a return, a payment or a card charge.
Your team: the name, email and mobile number of each person you invite, and the role you give them.
Your company: trade name, TRN, address, logo, the signature that goes on your agreements, your accountant's email if you send them packs, the names of your bank accounts with the last four digits of each IBAN, and the Stripe key you connect, stored encrypted.
Your fleet: plates, models, Mulkiya and insurance details, mileage, fuel and damage.
Your renters: name, nationality, date of birth, gender, address, passport or Emirates ID number, driving licence details, phone, email, and the documents you scan, upload, forward to DECK on WhatsApp or bring in from TARS.
Your rentals: dates, prices and any change to a price with its reason, deposits, signatures, photos, videos, tolls, fines, payments and the agreements themselves.
Card payments, if you connect Stripe: for each saved card its brand, last four digits, expiry and whether it came from a wallet such as Apple Pay, with a record of the renter's consent (which text they accepted, when, and from which IP address); and each charge, refund, payment link and dispute. Never the full card number or the security code.
Your accounting: invoices, receipts, expenses and the documents attached to them, and the bank statements you import.
Your government accounts, if you connect them: your Salik and TARS sign-in details, stored encrypted; for Darb, your username and the session Darb opens when you sign in, never your password. RTA fines need no sign-in.

Documents read by AI

DECK can read a passport, an Emirates ID or a driving licence through a phone camera and fill the customer's details in for you. It can also read a receipt or a supplier invoice you add to your accounting, and a bank statement in PDF. Because these are somebody's identity document or your company's finances, here is exactly what happens to them.

The image or PDF is sent to a document reading service: an AI model reached through a provider based in the United States, which passes the request to a company that runs the model, outside the UAE. Every request carries an instruction that it may only be handled by a company that does not collect it or use it to train a model.

For an identity document: if you cancel the scan, the photographs are deleted straight away. If you confirm it and save the customer, the photographs are kept on the customer record, encrypted, as the copy of the document you checked. If you confirm it but do not save anything, they are deleted within two days.

The extracted text is stored encrypted until you confirm it and erased at that point. What stays is the text you confirmed, on the customer record, where you can see it and edit it.

For a receipt, an invoice or a statement, what DECK reads is shown to you first, and nothing goes into your books until someone on your team confirms it. An uploaded document that nobody attaches or discards is removed after 30 days. The descriptions on the lines of an imported bank statement are stored encrypted.

Where it is kept

DECK runs on Amazon Web Services. This is where each part of it sits:

The panel's servers and database: Frankfurt, Germany.
Documents, photos, videos and other files: the United Arab Emirates, with a standby copy in Frankfurt so that an outage in one region does not lose them.
Backups: daily snapshots of the database in Frankfurt, kept for 14 days, and a nightly copy of the database, encrypted, and of the files, in Ireland, locked against deletion for 30 days.
Outgoing email: sent from Frankfurt.
Error reports and screen recordings: Frankfurt, Germany.

Germany and Ireland are in the European Union, where the GDPR applies, and our agreement with Amazon includes data protection terms. We plan to bring the servers and database to the UAE when Amazon's UAE region can run them, and we will update this page when that happens.

Some things leave these places. For the length of a single task, a document image or PDF goes to the reading service and a TARS submission goes to the RTA. Other things are copied out and kept by someone else: if you connect Stripe, a renter's name and email, and in a dispute the evidence, go to your own Stripe account; WhatsApp messages, and the files your team sends to DECK's WhatsApp number, pass through WhatsApp; and RETA's Administration Panel receives blacklist flags for review, the list of DECK accounts and each company's usage counts. Each one is described below.

How it is protected

Passport, Emirates ID and driving licence numbers are encrypted in the database with AES-256-GCM. The plain number is not stored in any column. When the panel needs to find a customer by document number it searches a one-way fingerprint of it, never the number itself.
Stored copies of identity documents, signed agreements, accounting documents, the descriptions on bank statement lines, accountant packs, the Stripe key you connect and your government sign-in details are encrypted by DECK with the same method. Files forwarded to DECK's WhatsApp number, and everything else, are encrypted at rest by the storage they sit on.
Everything in transit runs over TLS.
DECK never receives or stores a full card number or a card's security code. Renters type their card on Stripe's own page, and DECK keeps only the card's brand, last four digits and expiry.
Every business is isolated at the database level, so one company's query cannot reach another company's rows.
Backups are taken every night, encrypted, and locked against deletion for 30 days.
Only DECK's own engineers can reach the production systems, and only to support you or keep the service running.

Who else touches it

DECK runs on a small number of suppliers, and the list is short on purpose. What each one does, and where:

Cloud infrastructure. Runs the servers, the database, document storage, backups and outgoing email, in the places listed above. This is where your data lives.
A network security provider. Every request between the panel and our servers passes through it, so it can block attacks, and it runs the check on the sign-up page that tells a person from a bot. It carries the traffic through its data centres, which are spread around the world, and does not keep it.
A website host. Serves the panel's pages and this website, and provides this website's cookieless analytics. The data you enter in the panel goes to our servers, not to the host. The one exception is the panel's error reports and screen recordings, which pass through the host on their way to the error monitoring service and are not stored there. The host's servers that do this may be outside the UAE and the European Union.
A document reading service. Reads identity documents, receipts, invoices and bank statements, under the instruction described above, outside the UAE.
Stripe, if you connect your Stripe account. Stripe is your payment provider, under your own agreement with Stripe. DECK uses your key to save renters' cards, charge and refund them when your team asks, create payment links, read Stripe's fees and prepare dispute evidence, as described under Card payments.
WhatsApp, a Meta service. Carries the signing links and team messages DECK sends from its WhatsApp number, and the files your team sends to that number, as described under WhatsApp.
RETA's Administration Panel. Receives the blacklist flags DECK reviews, as described under The Blacklist Network. Every five minutes it also receives the list of DECK accounts: each person's name and email, their role, when they signed up and last signed in, how often they sign in, and their company's name, TRN, plan, trial dates and number of cars. Every hour it receives how much of each paid service each company used each day. It receives nothing about your renters except the blacklist flags.
A UAE network provider. Carries DECK's connections to the Salik, Darb, RTA and TARS portals, so they see a connection from the UAE. The connections are encrypted end to end.
An error monitoring service. Receives error reports from the panel and our servers, in Frankfurt, Germany. A report holds the technical details of what went wrong and your account and company IDs, never your name or email. It also receives a recording of the panel's screen, so we can see how a problem happened. The recording shows the panel as it was: the details shown and typed there, customer details and documents among them. Every signed-in session is recorded unless your company has asked us to stop, and we stop for any company that asks. Card fields, passwords, sign-in codes, QR codes, and links that open an agreement, a phone scan or an accountant pack are never recorded, and neither is the page where a renter signs. Renters using their own phone are not recorded at all. People at DECK watch a recording only to find and fix a problem, one the error reports show or one you tell us about. The service keeps reports and recordings for 90 days, and we delete them sooner if you ask.
Google, only if you choose to sign in with Google.

Apart from Stripe, which works for you under your own agreement with it, and WhatsApp, which Meta runs under its own terms, we choose suppliers whose terms stop them using your data for their own purposes.

We do not publish the other supplier names here, for the same reason we do not publish our infrastructure diagram. If you are a customer, or deciding whether to become one, and you want the names before you trust us with a passport, ask and you will get them: info@deck.ae. We will also tell you before we change one.

Card payments

If you connect your own Stripe account, DECK can save a renter's card when they sign, let your team charge it later for fines and tolls, send a payment link, refund a charge and help you answer a dispute. Stripe is your payment provider and you are the merchant: the money goes from the renter's card to your Stripe account. DECK is not a payment provider and never holds or moves the money.

Before a renter saves a card, they read and accept a consent text in your company's name that says what the card may be charged for: traffic fines, Salik and Darb, and never damage, deposits or rental fees. They then type the card on Stripe's own page. DECK receives from Stripe the card's brand, last four digits and expiry, and keeps a record of the consent: the version of the text, the time and the IP address it was given from. Stripe receives the renter's name and email from DECK, never the IP address.

A card is only charged when someone on your team presses the button for it, and the renter gets an itemised receipt by email after each charge or refund. If a card cannot be charged, or your team prefers it, they can send the renter a payment link instead, and the renter pays on Stripe's page. Stripe's fee for each charge, and for a lost dispute, is read from Stripe and recorded as an expense in your accounting.

If a renter disputes a charge with their bank, DECK prepares the evidence and places it in your Stripe account: the receipt, the signed agreement, the renter's name and email, the rental dates, and the consent record with its IP address while that is still kept. Someone on your team decides whether to submit it or accept the dispute. If nobody has done either two days before Stripe's deadline, DECK submits the prepared evidence for you, so the deadline is not missed. Stripe passes the evidence to the renter's bank.

DECK has its own WhatsApp number, run through WhatsApp's business service, which Meta operates. DECK uses it for three things:

Signing links. When your team sends an agreement by WhatsApp, DECK sends each person who has to sign a message with their first name, your company's name, the car and its plate, how long the link lasts, and the link to sign.
Your team's phones. When you add a team member's mobile number, DECK sends that phone a message with your name and your company's name, asking whether to link it to your company. They accept or reject it there, and can unlink it later by sending Leave.
Files from your team. Once a phone is linked, its owner can forward photos and PDFs to DECK's number, and DECK places them in your company's WhatsApp Media inbox, which the owner, managers and accountants can open and drivers cannot. Files from a phone that is not linked to a team are not kept.

Meta handles these messages under its own terms for WhatsApp. The files stay in your DECK account until someone deletes them in the panel, and the stored file is erased 7 days after that.

Government systems you connect

If you connect your Salik or Darb account, DECK uses it only to read your own tolls, your balance and the cars on the account. It never tops up, pays or changes anything there. RTA fines are looked up by the plates of the cars in your fleet. DECK sends nothing about your renters to Salik, Darb or RTA.

If you connect TARS, DECK submits a rental to the RTA when someone on your team presses the button for it, as Dubai rental rules require: the renter and every additional driver (names, nationality, date of birth, gender, address, phone, email, identity document and driving licence details, and the document images), the car, the signature and the hand-over and return details. A new rental is never submitted without that press. When your team completes or cancels a rental that is on TARS, DECK sends the close or the cancellation to TARS.

Whenever DECK reaches TARS for your team, and whenever someone presses a button to bring records in from TARS, DECK reads your cars, your customers with their document images, and your contracts with the fines and Salik tolls TARS lists for them, and adds them to your panel.

The Blacklist Network

Rental companies using DECK can rate a renter and record what went wrong on a rental, such as unpaid amounts, damage, fines or misuse of the car. When another company using DECK checks a renter with the same passport, Emirates ID, driving licence number or phone number, it sees the rating, the reasons, a blacklist flag if one was set, the amount and the date.

From DECK's records it never sees the renter's name, document number or contact details, or which company made the record. Records are matched by a one-way fingerprint of the passport, Emirates ID, driving licence number or phone number, and they are kept for 24 months.

Ratings and reasons without a blacklist flag are shared without review. A blacklist flag is reviewed by DECK first, and other companies see it as a blacklist flag only once it has been approved. For that review, DECK's moderation team receives the reporting company's name and TRN, the renter's name, the document type, the last three characters of the document number, the last three digits of the phone number, the rating, the reasons, the amount and the rental dates. The review runs on RETA's Administration Panel. Copies sent for review are deleted 90 days after the decision, or after the flag is withdrawn.

Each record is made by the rental company, which is responsible for it. Renters are told about the network in the rental agreement they sign. If you are a renter and you think a record about you is wrong, write to info@deck.ae and we will review it with the company that made it.

If you rent a car from a company that uses DECK

The rental company decides what it collects about you and why; DECK holds it for them and does what they ask. Everything on this page about renters' data applies to yours. To see, correct or delete it, ask the rental company. If you cannot reach them, write to us and we will pass your request on and help them answer.

The company may send you the agreement to sign by email, or by WhatsApp from DECK's number. DECK also emails you on the company's behalf: a reminder if you have not signed, the signed copy, a notice if the agreement is cancelled, card receipts, refund receipts and payment links, and, if the company turns them on, notices of fines recorded against your rental. When you sign or pay on your own phone, nothing you do there is recorded.

If the company asks you to save a card, you type it on Stripe's page, not on DECK. DECK keeps only the card's brand, last four digits and expiry, and the record of your consent. The IP address in that record is erased 210 days after the car is returned. To withdraw the consent, contact the rental company. If you dispute a charge with your bank, the company's evidence, including the signed agreement, goes to the company's Stripe account and from there to your bank.

How long we keep it

While your account is open, we keep what you put in, because a rental history that quietly deletes itself is worse than useless. A few things have their own limits:

Stored copies of identity documents are deleted automatically when their retention period ends.
Files forwarded to DECK's WhatsApp number stay until someone deletes them in the panel; the stored file is erased 7 days later.
A document uploaded to your accounting that nobody attaches or discards is removed after 30 days.
An accountant pack sent by email can be downloaded for 7 days, and the file is deleted a day after that.
The IP address recorded with a card consent is erased 210 days after the car is returned. Messages Stripe sends DECK about payments are deleted after 90 days, or after a year if one could not be processed, and closed payment links after a year. The payments themselves stay in your books.
The contact details you entered for a team member are deleted when they leave your team, or 7 days after an invitation that was never accepted runs out.
A customer with no rentals can be deleted from the panel at any time. A customer with rental history is archived instead, because the signed agreements and invoices attached to it have to be kept.
Blacklist Network records are kept for 24 months, and the log of checks against them for 90 days.
Copies of blacklist flags sent for review are deleted 90 days after the decision, or after the flag is withdrawn.
Error reports and screen recordings are kept for 90 days.
Server logs are kept for 90 days.
Usage counts, which hold company and account IDs and numbers but nothing about your renters, are kept in detail for 24 months and as daily totals after that.

When you close your account, tell us at info@deck.ae. We delete your data within 30 days, and encrypted backups expire on their own within 70 days after that. Error reports, screen recordings and server logs run out on the schedule above, and usage counts are kept as described there. What is in your own Stripe account is between you and Stripe. The one thing we have to hold on to is records tied to invoicing and tax, which we keep for as long as UAE tax law requires, for that reason and nothing else.

Before you go, download what you want to keep. Signed agreements, invoices and receipts can be downloaded one by one, and the accounting for any month, quarter or year as a pack with an Excel workbook, CSV files and PDFs.

Your rights

Under the UAE Personal Data Protection Law you can ask what we hold about you, ask for a copy of it, ask for it to be corrected or deleted, ask us to limit how we use it, and object to how we use it. Write to info@deck.ae and we will act on it. If you are not satisfied with our answer, you can complain to the UAE's data protection authority.

If the request is about a renter's data rather than your own, ask the rental company that holds it. They are the controller of it; we will help them answer you.

Cookies

This website sets no cookies at all. The panel sets two, and both do the same job: keeping you signed in. It also remembers a few settings in your browser, such as which camera you used last. Error monitoring adds no cookie: it keeps a few small entries in the browser's session storage, which are cleared when you close the tab. There is no advertising cookie anywhere and nothing follows you off the site, which is why you have not been asked to dismiss a banner. When a renter saves or pays with a card, they do it on Stripe's page, which sets Stripe's own cookies under Stripe's policy.

Changes

If this policy changes in a way that matters, we will say so on this page and change the date at the top. We will not quietly widen what we do with your data and leave you to notice.

On 22 October 2026 we added card payments through your own Stripe account, WhatsApp, receipts, invoices and bank statements read for your accounting, what RETA's Administration Panel receives, and what DECK brings in from TARS. We also corrected four things: every signed-in panel session is now recorded unless your company asks us to stop, a rental goes to TARS only when your team presses the button, server logs are kept for 90 days rather than 30, and we no longer offer to send a copy of all your data when you leave, because DECK has no tool that makes one. What you can download yourself is listed above.

Privacy policy.