Privacy and uninstall - Plugixa Car Rental

A rental desk holds personal data by nature: the name, email address and phone number of everyone who books a car, and with some features their age, an address or a signature. This page lists what is stored, where, what leaves your server, and what deleting the plugin removes.

What is stored

Everything is kept in your own WordPress database, in the plugin’s own tables. Their names start with your database prefix (shown here as {prefix}) followed by plugixacarrental_.

Table	Holds	Personal data
bookings	Every booking: reference, status, car, pickup and return locations and times, prices, payment method and payment status	Yes. Customer name, email address, phone number, notes, the answers to your custom fields, the cancellation details, and the WordPress user ID of a signed-in customer
booking_items	The price lines of each booking	With Pro, the delivery or collection address PRO and the driver’s age behind a surcharge PRO
payments	One row per payment or refund: method, transaction ID, amount, currency, status, a note and what the payment provider answered	Linked to a booking
invoices	Each issued invoice, with a copy of the booking as it was billed	Yes. The copy holds the customer’s name, email address and phone number, and never changes once issued
coupons, coupon_redemptions	Coupons, and which booking used which coupon	Linked to a booking
extras, form_fields	Your extras and your custom questions	No
vehicle_categories, vehicle_models, vehicle_units, unit_blocks	Your fleet	No
locations, location_closures, one_way_fees	Your locations	No
rate_plans	Your rates	No

Pro PRO adds these tables when it is installed:

Table	Holds	Personal data
pricing_rules	Pricing rules	No
tax_rates	Tax rates	No
inspections	Pickup and return inspections: odometer, fuel, damage, photos, notes	Yes. The name of the person who signed, and links to the signature and the signed agreement
calendar_imports, calendar_import_events	The calendar feeds you added and the times they block	No customer details are kept, only start and end times

Most tables also store the user ID of the staff member who created and last changed each row.

Files PRO

Inspections store the customer’s signature and the signed rental agreement (a PDF) in a folder of their own, wp-content/uploads/plugixa-car-rental-private/, not in the media library. The folder refuses web requests on Apache and LiteSpeed, and every file has a random 32-character name, so on servers that ignore that rule there is still nothing to guess. The files are served only to your staff and to the holder of the booking’s link.

Inspection photos are different: they are ordinary images in the media library, chosen or uploaded there by your staff.

Options

Option	Holds
plugixa_car_rental_settings	Everything on the Settings screen, including the browser key of the Map PRO, which is not encrypted because every visitor’s browser receives it anyway
plugixa_car_rental_apps	Which features are switched on in the App Manager
plugixa_car_rental_gateway_credentials	API keys and tokens for Stripe, PayPal, Twilio, Vonage, Telegram and Google PRO, encrypted
plugixa_car_rental_calendar_key PRO	The secret part of your calendar feed addresses
plugixa_car_rental_db_version, plugixa_car_rental_module_set, plugixa_car_rental_caps_backfilled	Housekeeping markers

Temporary data

Transient	Holds	Lifetime
plugixa_car_rental_rl_...	Rate-limit counters for the public routes. The key is a hash of the visitor’s address and the route, never the address itself.	One hour
plugixa_car_rental_account_page	Which page shows the customer booking page	One day
plugixa_car_rental_booking_page PRO	Which page holds the booking form, for the map’s Book here buttons	One day, or until a page is saved
plugixa_car_rental_route_... PRO	The driving distance and time for a delivery address. The key is a hash, the value holds only the distance and time.	30 days

What is not stored

• Card details. With Stripe PRO the customer types them on Stripe’s own page. They never reach your site.
• Visitor IP addresses. The rate limiter keeps a hash, as above.
• The customer’s booking link. A booking made on the site is handed a random token once. Only a hash of it is stored, so a copy of the database does not open anybody’s booking.
• Cookies. The booking form and the customer booking page set none, and send their requests without the visitor’s cookies.

Who can see the personal data

Inside wp-admin, only users with the plugin’s capabilities. On activation they are given to the administrator role and nobody else. Grant them to other roles with a role editor:

Capability	Allows
plugixa_car_rental_manage	Opening the admin app
plugixa_car_rental_view	Reading records
plugixa_car_rental_create	Creating records
plugixa_car_rental_edit	Changing records
plugixa_car_rental_delete	Trashing records
plugixa_car_rental_export	CSV export
plugixa_car_rental_manage_settings	The settings

On the site, a customer sees only their own booking, through the link in their email. A customer who lost the email can ask for the link again with the booking’s reference and email address; the link is then sent to that email address, never shown on the page.

Data requests from customers

The plugin registers with WordPress’s own privacy tools, so you answer a customer’s request the same way as for the rest of your site. Both tools list the plugin as Car rental bookings.

A customer has no WordPress account here, so bookings are found by the email address given on the booking. Every booking made with that address is included, the ones in the trash too, because a trashed booking still holds the customer’s details.

Giving a customer a copy

1. Open Tools -> Export Personal Data in WordPress.
2. Enter the customer’s email address and send the request. WordPress emails the customer a link to confirm it.
3. Once confirmed, download or email the file from the request list.

Each booking appears in the file under Car rental bookings with:

Item	Notes
Reference, status	The status as stored, such as completed or no_show.
Name, email, phone	The customer’s details on the booking.
Pickup (UTC), Return (UTC)	The rental’s start and end, in UTC.
Total	The amount and its currency, such as 325.98 EUR.
Notes	What the customer wrote in “Anything we should know?”.
Booked (UTC)	When the booking was made.
Your own questions	Each answer to a custom field, under the field’s label, such as Flight number. Empty answers are left out.
Delivery address, Collection address PRO	When the car was delivered or collected. See Delivery.

You can still open each booking, or use Export CSV on a filtered Bookings list, when you only need a quick look.

Erasing a customer’s data

1. Open Tools -> Erase Personal Data in WordPress.
2. Enter the customer’s email address and send the request, then wait for the customer to confirm it.
3. Click Erase personal data on the confirmed request.

Erasing anonymises a booking, it does not delete it. The booking stays in your history with its dates, car, locations and money, so your reports and availability stay right, and loses everything that says who it was:

Data	After erasing
Customer name	Replaced by WordPress’s placeholder text
Email address	Replaced by WordPress’s placeholder address, so the booking no longer matches the customer
Phone number	Emptied
Notes	Emptied
Answers to your custom fields	Removed
Delivery and collection address PRO	Removed. The line keeps its price and reads Delivery or Collection.
Link to a signed-in customer’s WordPress account	Removed

Only finished bookings are anonymised: Completed, Cancelled, Expired or No-show. Two kinds are kept as they are, and the eraser tells you why for each one, by reference, in the request’s messages:

Kept	Message
A booking that is still open: Pending, Confirmed, Picked up or Returned	“kept because the rental is still open. Erase again once it is closed or cancelled.”
A finished booking with an issued invoice	“kept because an invoice was issued for it, and an invoice is a tax record that cannot be changed.”

For an open rental, run the erase again once the booking is completed or cancelled. An invoiced booking keeps the customer’s details for as long as your tax law requires the invoice; the invoice’s own copy of the buyer never changes.

The eraser does not touch:

• the driver’s age behind a surcharge PRO, which is kept on the surcharge line without a name;
• the name of the person who signed an inspection PRO, the signature and the signed agreement, or inspection photos in the media library. Delete those yourself if your records allow it;
• payments and refunds, including the note and the payment provider’s answer stored with each;
• emails already sent, and anything already sent to a payment provider or another outside service.

To remove a finished booking completely instead, move it to the trash and delete it for good from there. A booking with payments recorded against it cannot be deleted for good: it is kept as a financial record and can stay in the trash.

Your privacy policy

The plugin adds a suggested paragraph to WordPress’s privacy policy guide, under Settings -> Privacy, headed Plugixa Car Rental. It says what a booking stores, why, and that a customer can ask for a copy or for erasure, except for open bookings and bookings with an invoice. Copy it into your privacy policy and adjust it to your business. If you use a Pro service, see What leaves your server and mention it there too.

What leaves your server

The free plugin

No rental data is sent anywhere. No vehicle, location, booking or customer record leaves your site. Fonts and icons are served from your own site; nothing is loaded from a CDN or from Google Fonts.

The only outside contact is the plugin’s licensing and update service. On activation you are shown an opt-in screen. If you skip it, nothing identifying you is sent. Checking for an update sends your site address, the plugin version and, in Pro, your licence key. The plugin’s readme.txt lists what an opt-in sends.

The emails the plugin sends go through wp_mail(), so they leave by whatever mail setup your site already has.

Pro services PRO

Each service is off until you switch its feature on and enter your own account keys for it, and each receives only what that feature needs.

Service	When it is contacted	What it receives
Stripe	A customer chooses to pay by card, or you refund a card payment	The booking reference, the amount and currency, the customer’s email address and the addresses to return to. A refund sends the payment’s ID and the amount.
PayPal	A customer chooses PayPal, or you refund one	The booking reference and ID, the amount and currency and the addresses to return to. A refund sends the capture ID and the amount. Test mode uses PayPal’s sandbox.
Twilio or Vonage	A booking reaches a status you chose for text messages	The customer’s phone number, your sender number and your message, filled in with the booking’s details
Telegram	A booking reaches a status you chose for alerts	Your message for that event, filled in with the booking’s details, which can include the customer’s name
Google Routes API	A customer enters a delivery or collection address	That address and your location’s address. Each answer is kept for 30 days.
Google Maps JavaScript API	A visitor opens a page with the map shortcode, or a booking form showing the map. It is the visitor’s browser that contacts Google, not your server.	Your browser key, and what any browser sends: the visitor’s IP address, the page’s address and the part of the map being looked at. Nothing is loaded from Google on a page without a map.
Calendar feeds you add	Once an hour	Nothing. The plugin only reads the address you pasted in.

Deactivating

Deactivating stops the plugin and clears its scheduled events. It deletes nothing. Activate it again and everything is where you left it.

Deleting

By default, deleting the plugin from the Plugins screen removes its files and keeps all your data: fleet, bookings, payments, invoices and settings. Install it again and it picks up where you left off.

Erasing the data

To remove everything, open Settings -> Uninstall, turn on Delete all rental data when the plugin is deleted, save, and then delete the plugin.

With the switch on, deleting the plugin:

1. Drops every table whose name starts with {prefix}plugixacarrental_, including Pro’s and any left over from an older version.
2. Deletes every option and transient whose name starts with plugixa_car_rental_, including the settings, the stored API keys and the rate-limit counters.
3. Deletes the private files folder with every signature and signed agreement PRO.
4. Removes the plugin’s capabilities from every role and user.

Erasing cannot be undone. Take a backup of the database first if you might want the data later.

When the switch is ignored

The data is kept, even with the switch on, when:

• Another copy of the plugin is installed, active or not. Pro installs as a second copy beside the free one, and both use the same tables. Deleting the free copy after moving to Pro therefore never erases what Pro runs on.
• The user deleting the plugin may not activate plugins.

What an erase leaves behind

• Inspection photos PRO in the media library. They are ordinary attachments; delete them there.
• The pages where you placed the booking form or the customer booking page. Their shortcodes then print as plain text.
• Emails already sent, and anything already sent to a Pro service.

See also Settings and Troubleshooting.