Privacy notice

This notice explains what personal data SupercarMenu uses, why, and for how long. You can browse and compare prices without telling us who you are. We use no advertising or analytics cookies and we build no profile of you. We keep personal data about you only if you send us a form or an email, sign in for a rental company, or work for a rental company we write to. If one person runs a rental company, its company page can also hold personal data about that person.

Who is responsible

SupercarMenu is run by MB SupercarMenu. MB SupercarMenu decides how your personal data is used and is responsible for it (the “controller”). In this notice, “we” means MB SupercarMenu.

• Postal address: Vilniaus g. 16, Vilnius, Lithuania
• Email: hello@supercarmenu.com

We have not appointed a data protection officer. Send every privacy question to the email above. Operator details are also in the legal notice.

Our legal bases

The law lets us use personal data only for a reason it accepts. Each section below names one of these:

• Agreement: we need the data to do what you asked us to do under an agreement with you (GDPR Article 6(1)(b)).
• Legal duty: a law requires it (GDPR Article 6(1)(c)).
• Legitimate interest: we need it to run and protect the website, and we have weighed this against your interests and rights (GDPR Article 6(1)(f)).

When you visit the website

Our host, Cloudflare, receives your IP address, technical details of your browser and the page you ask for. Every website host needs these to deliver a page and to block attacks.

• Why: to show you the website and keep it safe.
• Legal basis: legitimate interest.
• How long: our own code keeps no log of visits. The request logs we can read in Cloudflare are kept for up to 7 days.

To count visits we use Cloudflare Web Analytics. It sets no cookie, does not store your IP address and builds no profile of you; we see only totals, such as which pages are read, from which country, on which kind of device and which website sent the visit. We have added no advertising and no tracking pixels to our pages or our emails. Fonts, pictures and the search all come from our own domain, so no other company learns about your visit from them.

Cookies and storage in your browser

We use no advertising or analytics cookies, so there is no cookie banner. Your browser keeps only these items, each needed for something you asked for:

• Compare list (scm-compare-v2): up to 3 cars you chose to compare. It stays on your device and is never sent to us. A compare link you share holds only the names of the car pages.
• Light or dark look (sm-theme): your choice. It stays on your device.
• Car version (scm-variant): when you open a version of a car, your browser remembers it for the next page only, then deletes it.
• Opening animation (sm-drive): on the home page, so the opening animation plays only once while the browser tab is open. It is deleted when you close the tab.
• Sign in cookie (__Host-scm_session): only for people who sign in for a rental company. It keeps you signed in. It ends when you sign out, after 7 days without use, and after 30 days at most.
• Test access cookie (__Host-scm_preview): only for people who enter our test password while the website is closed to the public. It lasts 30 days and holds no personal data.

The compare list and your light or dark choice stay until you clear them in your browser. The law does not require consent for storage that is strictly needed for something you asked for. If we ever want to add any other cookie, we will ask you first, and you can withdraw that consent at any time.

The spam check on forms

The sign in form, the form to claim a company page and, once reviews open, the review and report forms use Cloudflare Turnstile to tell people from bots. Ordinary pages do not load it. When you click into one of these forms, or open the report form, your browser loads the check from Cloudflare (challenges.cloudflare.com). It reads your IP address and technical details of your browser and device. This happens before you press the send button. What you type is sent to us only when you press it. Our server then sends the check result and your IP address to Cloudflare to confirm the check.

• Why: to keep spam and fake accounts out.
• Legal basis: legitimate interest. Reading your browser for this check is strictly needed for the form you chose to use.
• How long: we store nothing from the check.

Clicks to rental companies

When you open a rental company’s website from a price list on a car page, a company page or the compare page, your browser sends us a short note. It holds the company, the address of the page you were on, the type of page, the row position, whether your screen is phone sized or larger, and the number of rental days you chose on a car page. We add the time. We set no cookie and store no IP address and no browser details with it. The note does not say who you are.

• Why: to know which links renters use and how many visits we send each company. We may tell a company its own totals.
• Legal basis: legitimate interest.
• How long: 24 months, then deleted.

To stop abuse, your IP address is used in coded form, for up to one minute, to limit how many notes one connection can send. We do not store it.

The company gets nothing about you from us. Its website sees only that you came from supercarmenu.com, not which page, and we add no tracking codes to the link. Once you are on its website, its own privacy rules apply.

Reviews

Reviews are not open yet. When they open, this is what we will collect. The rules for reviews are in the review policy.

• What you give us: a display name, your email, a star rating, a title, your text, the month of your rental, what happened to your deposit, the car if you choose one, and the confirmations you tick.
• What we add: a coded copy of your IP address, a coded copy of your email (so that each person has only one live review of each company), the result of an automatic check that marks possible problems such as phone numbers, links or insults, and our moderation decision and notes.
• What is public: your display name, rating, title, text, rental month, deposit outcome, car and the date. Your email is never public, and we do not give it to the company.
• Why: to confirm your email, check and publish your review, tell you when it is published, needs a change, is rejected or is removed, and stop fake or repeated reviews.
• Legal basis: agreement (our terms of use, which you accept when you send a review), and legitimate interest for the checks against fake reviews.
• How long: a review you do not confirm is deleted after 7 days. The coded IP address is removed from the review 90 days after you send it. A review waiting for a decision or for your changes is kept until it is published or rejected. A published review and your email are kept while the review is online. When a review is rejected or removed, your email is deleted after 30 days, and the review, the reason and the coded email are deleted after 12 months.

Anyone can report a review. A report holds the reason, your explanation, a coded IP address and, if you give it, your email, which we use only to confirm that we received your report and to tell you what we decided. Rental companies report from their account. Legal basis: legal duty, because the EU Digital Services Act requires us to handle reports, and legitimate interest. Your email and the coded IP address are removed from the report 180 days after we close it. The reason and your explanation are kept with the review’s record and deleted with it.

Rental company accounts

This part is for people who claim a company page or sign in for a rental company through For rental companies.

• Claiming a page: you give the company, your name, your role and your work email, and you choose how to prove that you act for the company: an email address on the company’s website domain, or a code placed on the company’s website. We add the dates, a coded IP address, the details of the company’s trade licence that we check (issuing authority and number) and our decision.
• Signing in: we keep your email, name, role and when you last signed in. We email you a sign in link and store only a coded copy of it. Each session stores a coded copy of the sign in cookie, a short description your browser gives of itself (its name, version and system) and a coded IP address.
• What you send: rates, rental terms, price files you upload, replies to reviews and reports about reviews. They are about the company, but they are linked to your account.
• Emails we send you: a link to confirm your email when you claim a page, the result of your claim, sign in links, a reminder one day before your rates stop being shown, and, once reviews open, a note when a review of your company is published, a receipt and our decision when you report a review, and the reason when we do not publish or we remove your reply to a review. We may also write to you about our founding pilot and other offers for rental companies; reply STOP to any such email and we stop.
• Why: to check that you act for the company, let you sign in safely, publish your rates and keep a record of who changed what.
• Legal basis: legitimate interest, ours and the company’s, in making sure only the company’s own people can change its page under the terms for rental companies. If you run the company on your own, the basis is the agreement with you.
• How long: a claim not completed within 30 days expires. Its coded IP address is removed from the claim once the claim is decided or expires. A claim we refuse, or that expires, is deleted 12 months later. Sign in links work for 15 minutes and are deleted a day after that. Sessions are deleted when they end. Uploaded price files are deleted after 90 days. Rates, terms and replies stay with the company page while it is listed. Your account and your approved claim are kept while the account is open and deleted 30 days after it closes. To close your account, email us.

Information about rental companies

Company pages show business information we read on each company’s own website: its name, website, area, cars, prices and a short description, with the source. Some company pages also sum up what renters say on public pages such as Trustpilot, Tripadvisor and business directories, with links to the sources and to the company’s Google Maps page. We publish only the summary and the links. We do not name the people who wrote those posts, or any staff. If a company is run by one person, some of this is personal data about that person.

• Why: so renters can compare prices and companies.
• Legal basis: legitimate interest, ours and renters’, in comparing the prices that companies publish.
• How long: while the company is listed. If a company is taken off the site, we keep its record and the reason, so that we do not list it again by mistake. Our record of each price we read, with a short piece of page text around it, is kept 3 years.

For our own checks, we also compare the photos on company websites, including number plates shown in them, to see when two companies offer the same car. This is never published, and we keep the result only while both companies are listed. A company can ask us to correct its information, stop reading its website or remove its page: see corrections and removal requests.

Contacting rental companies

We write to rental companies in Dubai to confirm the prices we show, to ask whether we may read their website, and to invite them to list with us, including our founding pilot. This part explains what we keep for that. For people who sign in for a company, see Rental company accounts above.

• What we keep: the company’s name and website; the business email address and phone number it publishes; where and when we found them; the company’s Instagram account if we write to it there; and notes of our exchanges: the dates, the channel, what we asked, what the company answered, and whether it said yes, no or stop. We add a person’s name or role only if the company publishes it with a date we can check, or if that person writes to us or gives it to us on a call. If your company joins our pilot, we also keep the WhatsApp number you give us in writing and your yes to messages there.
• Where it comes from: the company’s own public website, its Instagram profile if we write there, the messages the company sends us, and what you tell us on a call.
• Why: to keep the prices we show correct, to respect what each website allows, and to invite rental companies to list with us.
• Legal basis: legitimate interest, ours and renters’, in listing rental companies and inviting them to take part. We weighed this against your interests before our first message and wrote it down; you can ask us for a copy. Lithuanian law (Law on Electronic Communications, Article 81) lets us email a company’s business address without asking first, as long as every message lets you refuse.
• How we contact you: by email, or through the contact form on your website. Each message is prepared with the help of Claude, an AI assistant, and read and sent one by one by a person on our team. As a second step only, we may send one Instagram message from our business account. On one subject we send at most three messages, about a week apart. We make no cold calls and send no text messages. We call you only if you ask for a call in writing, and we write to you on WhatsApp only after you write to us there first or say yes in writing.
• How long: until you object, or 12 months after our last contact, whichever comes first. If your company signs in or joins our pilot, the rules under Rental company accounts apply instead. If you ask us to stop, we delete your contact details and keep only a short note: the company, the address or number, the date, the channel and the words you used. We keep that note for as long as we write to rental companies, so that we never write to you again by mistake, and we review it once a year.
• Who sees it: inside MB SupercarMenu, only the people who handle this outreach. The providers listed under Who receives your data handle it for us. We never publish it, sell it or pass it to other rental companies.
• Stopping us: reply STOP to any of our messages, or write to hello@supercarmenu.com. If you object to marketing, we stop at once, without asking why.

Emails you send us

When you email hello@supercarmenu.com, or reply to one of our emails, we receive your email address, your name if you give it, and what you write.

• Why: to answer you, and to keep a record of requests about your data, corrections and removals.
• Legal basis: legitimate interest; for requests about your rights, legal duty.
• How long: 12 months after the last message on an ordinary question. 3 years after we close a request about your rights, a correction or a removal, so we can show how we handled it.

Security log and backups

Each sign in, each form sent on the website (sign in link requests, claims, reviews and reports) and each change made in a company account or by us is written to a security log. An entry holds what was done, internal reference numbers and a coded IP address, but no email address. Entries cannot be changed and are deleted after 2 years. So a coded IP address stays in this log for 2 years, even after we have removed it from a review, report or claim. Why: to find misuse and to show what happened if there is a dispute. Legal basis: legitimate interest.

A coded IP address is made from your IP address with a secret key. It does not show your IP address, but it lets us see that the same connection was used again. Because we hold the key, it still counts as personal data.

Our database can be restored to any moment in the last 30 days, so deleted data stays in these restore copies for up to 30 days. Each night we also save a copy of what the website publishes (prices, company pages and published reviews) and keep it for 400 days, so we can show what was published on a given date.

Who receives your data

We do not sell your data or share it for advertising. These service providers handle data for us, only on our instructions and under data processing terms:

• Cloudflare (United States): hosting, network and security, our database and file storage, the spam check, sending our emails, and access control for our staff area.
• Zoho Mail, on its EU service: our mailbox, hello@supercarmenu.com.
• GitHub (United States): stores our code and runs the program that reads prices on company websites. No visitor data goes there.
• Meta (WhatsApp and Instagram): only if you exchange messages with us there.
• Our phone company in Lithuania: only for a call you asked for.

We also use Claude, an AI assistant made by Anthropic (United States), to prepare texts, including company descriptions and summaries from public pages, to help us read and answer emails sent to hello@supercarmenu.com, and to prepare our messages to rental companies. We use it on Anthropic’s standard terms, so Anthropic handles what we give it under its own privacy policy rather than only on our instructions. We give it no more personal data than the task needs, and we have switched off the use of our chats to train its models.

Published reviews and company pages can be read by everyone. Links to company websites, review sites and Google Maps are plain links: we send those sites nothing, and they learn of your visit only if you click. We give data to authorities only when the law requires it.

Data outside the EU

We asked Cloudflare to keep our database and file storage in Eastern Europe. Cloudflare follows this where it can, but it is not a guarantee. Our mailbox is on Zoho’s EU service. Cloudflare and GitHub are United States companies and Cloudflare’s network works worldwide, so some data can be handled outside the EU, including in the United States. For these transfers we rely on the EU Standard Contractual Clauses in each provider’s data processing terms and, where a provider is certified under it, on the EU decision that the Data Privacy Framework with the United States protects data adequately. You can ask us for a copy of these safeguards. Anthropic is also a United States company, and what we give Claude is handled there under Anthropic’s own terms.

Your rights

You can ask us, free of charge:

• for a copy of the personal data we hold about you (access);
• to correct data that is wrong (correction);
• to delete your data (deletion);
• to keep your data but stop using it while a question about it is settled (restriction);
• for the data you gave us under an agreement with you, such as your review, in a common file format, so you can keep it or give it to another service (portability).

Your right to object: where we rely on legitimate interest, you can object at any time to our use of your data, for reasons about your own situation. We then stop, unless we have strong legitimate reasons that outweigh yours or need the data for a legal claim. Where we use your data for marketing, including our messages to rental companies, you can object at any time without giving a reason, and we stop at once.

Email hello@supercarmenu.com, if you can from the address the data is about. If we cannot tell that the request is yours, we ask only for what we need to check. We answer within one month. If a request is complex, we may take up to two more months and tell you why within the first month. Some data we keep even after you ask us to delete it: security log entries until they are deleted after 2 years, because we need them to find misuse, and data we need for a legal claim. We tell you when that applies. Deleted data leaves our restore copies within 30 days and our nightly copies within 400 days.

You can also complain to the State Data Protection Inspectorate of Lithuania (VDAI, vdai.lrv.lt) or to the data protection authority where you live or work. We would like the chance to help first, but you do not have to contact us before you complain.

Do you have to give us data?

No. You can browse and compare prices without giving us anything. To send a review, you must give an email address so we can confirm the review and contact you about it. To claim a company page, you must give your name, your role and your work email; to sign in, your work email. Without them we cannot accept the review or the claim. An email address on a report is optional.

No automated decisions

We make no decision about you by automated means alone that has a legal or similarly important effect on you. The spam check can stop a form from being sent if it judges the sender to be a bot; you can then email us instead. The automatic check of review texts only marks possible problems, and a person decides. The order of prices follows rules about prices, not about you: see how we compare prices.

Children

SupercarMenu is for adults who rent cars. It is not aimed at children under 18, and only people aged 18 or over may send a review. If we learn that a child has sent us personal data, we delete it.

Changes to this notice

When what we do with personal data changes, we update this page before the change takes effect. If a change affects company accounts, we also email the account holders. Last updated 15 October 2026.