Last updated: September 2026
Who we are
DECK is operations software for rent a car companies, based in Dubai, United Arab Emirates. In this policy, DECK means us. For anything about your data, write to info@deck.ae and a person will answer.
Two kinds of data, and they are not the same
This is the most important thing on the page, so it comes first.
Your data. Your name, your email, your phone number, your company details and what you do inside the panel. We decide how this is handled, so for this data we are what the law calls the controller.
Your renters' data. Passports, Emirates IDs, driving licences, phone numbers, signatures and rental history belong to the people who hire cars from you. That data is yours, not ours. You decide what goes in and what comes out; we only hold it and process it on your instructions. For that data you are the controller and we are the processor.
What this means in practice: we do not sell it, we do not mine it, we do not use it to train anything, and we do not look at it except when you ask us for support and we need to. If you close your account, it leaves with you.
What the website collects
The pages you are reading now, on deck.ae, collect almost nothing. There is no contact form and no newsletter. If you message us on WhatsApp or send an email, we have whatever you wrote and the number or address you wrote it from.
We count page views and see which pages people read, so we know which guide was worth writing. It is measured without cookies and without building a profile of you, and it cannot be used to identify a visitor.
What the panel collects
Inside the panel, at app.deck.ae, DECK holds what running a rental business needs and nothing decorative:
- Your account: name, email, phone number, and the password or Google sign-in you use to get in.
- Your company: trade name, TRN, address, logo and the signature that goes on your agreements.
- Your fleet: plates, models, Mulkiya and insurance details, mileage, fuel and damage.
- Your renters: name, nationality, date of birth, passport or Emirates ID number, driving licence details, phone, email, and the documents you scan or upload.
- Your rentals: dates, prices, deposits, signatures, tolls, fines and the agreements themselves.
Scanning a document with a phone
DECK can read a passport, an Emirates ID or a driving licence through a phone camera and fill the customer's details in for you. Because that is somebody's identity document, here is exactly what happens to it.
The photograph is sent to a document reading service to be turned into text. That request carries an explicit instruction that the provider may not keep the image or use it to train a model, and we send that instruction on every single request. The photograph itself is held only while the scan is open. The moment you confirm the result, or cancel, it is deleted from our storage.
What stays afterwards is the text you confirmed, on the customer record, where you can see it and edit it. The extracted result is stored encrypted until you confirm it, and is erased at that point.
Where it is kept
Everything the panel holds lives on our own servers in Dubai, United Arab Emirates. Your renters' documents do not leave the country to sit on a disk somewhere else.
Two exceptions, both narrow and both named above: a document photograph travels to the reading service for the seconds it takes to read it, and transactional email leaves through our email provider. Nothing else moves.
How it is protected
- Passport, Emirates ID and driving licence numbers are encrypted in the database with AES-256-GCM. The plain number is not stored in any column. When the panel needs to find a customer by document number it searches a one-way fingerprint of it, never the number itself.
- Everything in transit runs over TLS.
- Every business is isolated at the database level, so one company's query cannot reach another company's rows.
- Backups are encrypted and taken daily.
- Every create, update and delete is logged with who did it and when.
Who else touches it
DECK runs on a small number of suppliers, and the list is short on purpose. What each one does:
- Cloud infrastructure in Dubai. The servers the panel and the database run on. This is where your data lives.
- An email provider. Sends transactional email: sign-in codes, signing links, team invitations.
- A document reading service. Turns a document photograph into text, under the no-retention instruction described above, and nothing else.
- A website host. Serves this marketing site and provides the cookieless analytics. It never touches panel data.
None of them are allowed to use your data for their own purposes, and none of them are allowed to keep it beyond the job.
We do not publish the supplier names here, for the same reason we do not publish our infrastructure diagram. If you are a customer, or deciding whether to become one, and you want the names before you trust us with a passport, ask and you will get them: info@deck.ae. We will also tell you before we change one.
How long we keep it
While your account is open, we keep what you put in, because a rental history that quietly deletes itself is worse than useless.
When you close your account, we delete your data within 30 days. The one thing we have to hold on to is records tied to invoicing and tax, which UAE law requires us to keep for five years. Those are kept for that reason and nothing else.
You can export your data at any time while the account is open, and you do not need to ask us to do it.
Your rights
Under UAE data protection law you can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to how we use it. Write to info@deck.ae and we will action it.
If the request is about a renter's data rather than your own, ask the rental company that holds it. They are the controller of it; we will help them answer you.
Cookies
This website sets no cookies at all. The panel sets one: the cookie that keeps you signed in. There is no advertising cookie anywhere and nothing follows you off the site, which is why you have not been asked to dismiss a banner.
Changes
If this policy changes in a way that matters, we will say so on this page and change the date at the top. We will not quietly widen what we do with your data and leave you to notice.