This Privacy Policy explains how StivaSoft Ltd., operating the VEVS Car Rental Software service (“VEVS”, “we”, “us”, or “our”), processes information when customers use the VEVS AI Assistant, Model Context Protocol (“MCP”) service, ChatGPT integration, or other supported AI applications connected to VEVS Car Rental Software.
The VEVS MCP service allows authorized users of a VEVS Car Rental Software account to retrieve information from, and where permitted make changes to, their own car rental management account through supported AI applications such as ChatGPT.
This Privacy Policy applies specifically to information processed through the VEVS AI Assistant and MCP service and supplements the general VEVS privacy terms applicable to the VEVS Car Rental Software service.
1. Scope of the Service
The VEVS MCP service acts as a secure interface between an authorized AI application and the customer's VEVS Car Rental Software account.
Depending on the tools made available and the permissions granted, the service may allow an authorized user to perform functions such as:
- viewing reservations;
- viewing fleet and vehicle information;
- checking vehicle availability;
- viewing customer or driver information where required for a specific rental-management task;
- viewing rental locations, branches, rates, extras, protection plans, maintenance information, and other account settings;
- creating or updating reservations;
- updating vehicles, rates, locations, customers, drivers, or operational settings;
- recording vehicle handover and return information;
- recording vehicle condition, mileage, fuel level, or damages;
- creating documents or operational records; and
- performing other rental-management functions specifically requested by the authorized user.
The AI application does not receive unrestricted access to the entire VEVS database. The MCP service processes individual requests using the tools and permissions made available to the authenticated VEVS account.
2. Information We Process
Depending on the function requested by the user, the MCP service may process the following categories of information.
A. VEVS Account Information
We may process:
- VEVS account or installation identifier;
- company or rental business name;
- authorized user identifier;
- user name;
- business email address;
- assigned role or permissions; and
- authentication and authorization status.
Authentication credentials and security secrets should not be included in AI prompts or returned in MCP tool responses.
B. Reservation Information
When necessary to perform a reservation-related request, we may process:
- reservation number;
- reservation status;
- pickup and return dates and times;
- pickup and return locations;
- vehicle or vehicle category;
- rental price and charges;
- selected extras or protection options;
- payment status;
- reservation notes;
- vehicle handover and return records; and
- other information directly required to manage the reservation.
C. Customer and Driver Information
Where required to perform the specific task requested by an authorized user, we may process:
- customer or driver name;
- email address;
- telephone number;
- date of birth;
- address where required for rental administration;
- customer or driver relationship to a reservation; and
- other ordinary contact or rental-management information necessary for the requested operation.
VEVS limits information returned through the MCP service to information relevant to the user's request.
D. Vehicle and Fleet Information
We may process:
- vehicle make and model;
- vehicle category;
- registration or fleet number;
- VIN where required for vehicle-management functions;
- mileage or odometer readings;
- fuel level;
- vehicle availability;
- branch or location assignment;
- maintenance records;
- vehicle condition;
- damage records;
- inspection records; and
- vehicle operational status.
E. Business Configuration Information
We may process VEVS account configuration such as:
- rental locations and branches;
- opening hours;
- pricing and rental rates;
- seasons and rental periods;
- extras and protection products;
- taxes and fees;
- booking rules;
- fleet settings;
- maintenance settings; and
- other configuration information required to answer or carry out the user's request.
F. Information Provided in an AI Request
When a user asks an AI application to use VEVS, the MCP service may receive the portion of the user's request that is necessary to identify and execute the requested VEVS operation.
For example, a request such as “show the upcoming reservations for vehicle CRS-1001” may cause the service to receive:
- the requested operation;
- the vehicle identifier; and
- the parameters necessary to perform the search.
VEVS does not request or reconstruct the user's complete ChatGPT conversation history.
G. Technical and Security Information
For operation, security, abuse prevention, and troubleshooting, we may process limited technical information such as:
- connection status;
- date and time of a service request;
- tool or operation invoked;
- success or error status;
- account identifier; and
- security or audit information required to investigate unauthorized access or technical failures.
Where possible, logs are designed to avoid storing the contents of AI conversations and unnecessary personal information.
Internal diagnostic information, debugging data, trace identifiers, server metadata, and similar technical fields are not intentionally returned to the AI application unless they are strictly necessary to fulfill the requested function.
3. Information We Do Not Intentionally Collect Through the MCP Service
The VEVS MCP service is not intended to request or collect through AI tool inputs:
- payment card numbers, CVV codes, or other PCI-regulated card information;
- passwords;
- API keys;
- authentication tokens;
- one-time passwords or MFA codes;
- Social Security numbers or equivalent national identification numbers;
- passport numbers;
- driver's licence numbers through AI prompts;
- protected health information; or
- information unrelated to the rental-management task requested by the user.
Users should not provide this information in prompts sent to the VEVS AI Assistant.
Where such information exists elsewhere within a customer's VEVS account for legitimate business purposes, the MCP integration is designed not to expose it to the AI application unless expressly permitted by applicable requirements and necessary for an approved function.
4. How We Use Information
Information processed through the MCP service is used to:
Provide the requested service
We process information to authenticate the account, identify the user's request, obtain relevant information from VEVS Car Rental Software, and return the requested result.
Carry out authorized actions
When a user explicitly requests an action, information may be used to create, update, or otherwise modify records within their VEVS Car Rental Software account.
Examples include changing a reservation, blocking a vehicle, recording a handover, or changing rental settings.
Protect the service
Limited information may be used to:
- authenticate users;
- enforce account permissions;
- prevent unauthorized access;
- detect abuse;
- investigate security incidents; and
- maintain the reliability of the service.
Provide technical support
Information may be processed when necessary to diagnose and resolve technical problems reported by a customer.
Comply with legal obligations
We may process information where necessary to comply with applicable laws, court orders, regulatory requirements, or lawful requests from authorities.
5. How AI Requests Are Handled
When a user connects VEVS to ChatGPT or another supported AI service, the AI service determines when a VEVS tool should be invoked based on the user's request and the permissions available to that integration.
VEVS receives only the information provided to the MCP tool for execution of that operation.
VEVS does not use MCP tool instructions to:
- obtain hidden portions of a user's AI conversation;
- override instructions or safety protections of the AI platform;
- request unrelated confidential information;
- cause the AI to disclose authentication credentials;
- bypass user authorization;
- circumvent platform security safeguards; or
- perform actions outside the functionality and permissions presented to the user.
The MCP service validates requests on the server and does not rely solely on instructions generated by an AI model.
6. Read and Write Actions
Some VEVS tools only retrieve information, while others can change information within the user's VEVS account.
Read-only operations may include functions such as viewing availability, reservations, vehicles, locations, rates, or settings.
Write operations may include functions such as:
- creating or modifying a reservation;
- modifying a vehicle;
- changing pricing;
- changing locations or opening hours;
- recording vehicle handover or return;
- adding vehicle damage;
- creating documents; or
- modifying other account records.
Write actions are identified as such to supported AI clients where the platform provides this functionality.
Where the AI platform requires confirmation for an action, VEVS supports the platform's confirmation process and does not attempt to bypass it.
7. Data Minimization
VEVS follows a data-minimization approach.
MCP tools are designed to request only information reasonably necessary to perform their stated function.
Likewise, responses are designed to return only information relevant to the user's request.
For example, when a user asks whether a vehicle is available for a particular period, the service should return the information necessary to answer the availability request rather than complete customer records associated with unrelated reservations.
We continually review MCP tools and responses to reduce unnecessary information.
8. Who Receives Information
Information processed through the VEVS MCP service may be disclosed to the following categories of recipients.
The AI service selected by the user
Information necessary to answer the user's request may be returned to the AI application through which the user connected to VEVS.
For example, if VEVS is connected to ChatGPT, information returned by the MCP service may be processed by OpenAI according to OpenAI's applicable terms and privacy policies.
Use of ChatGPT and information processed by OpenAI is governed separately by OpenAI's privacy practices.
The VEVS customer
Information may be accessible to authorized employees, representatives, or users of the VEVS customer account according to their permissions.
VEVS personnel
Authorized VEVS personnel may access information where reasonably necessary for:
- customer support;
- security;
- investigation of technical problems;
- maintenance; or
- compliance with legal obligations.
Access is limited to personnel who require it for their role.
Service providers
VEVS may use infrastructure, hosting, monitoring, security, communications, or other technical service providers that process limited information on our behalf.
Such providers are permitted to process information only for the services they provide to VEVS and are subject to appropriate contractual and security obligations.
Legal authorities
Information may be disclosed where required by applicable law or where reasonably necessary to protect VEVS, our customers, users, or others from fraud, security threats, or unlawful activity.
We do not sell personal information obtained through the VEVS MCP service.
We do not disclose MCP data to advertising networks for targeted advertising.
9. Data Retention
The underlying rental-management information accessed through the MCP service remains subject to the retention settings and policies applicable to the customer's VEVS Car Rental Software account.
The MCP service does not create a separate permanent copy of reservation, customer, driver, or vehicle records merely because they were retrieved through an AI tool.
Limited security, operational, and audit logs may be retained for 90 days for purposes including service reliability, troubleshooting, security, fraud prevention, and investigation of unauthorized access.
Where information is required for an ongoing security investigation, legal claim, or legal obligation, it may be retained for longer as reasonably necessary for that purpose.
After the applicable retention period expires, the relevant MCP service logs are deleted or anonymized in accordance with our data-retention procedures.
10. Data Storage and International Processing
VEVS and its service providers may process information in countries other than the country in which the user is located.
Where personal information is transferred internationally, we use safeguards required by applicable data-protection law.
The location and retention of information maintained directly by ChatGPT or another AI provider are governed by that provider's own privacy policy and terms.
11. Legal Bases for Processing
Where the General Data Protection Regulation (“GDPR”) or similar legislation applies, VEVS processes personal information through the MCP service on one or more of the following bases:
- performance of a contract;
- legitimate interests in providing and securing the service;
- compliance with legal obligations; or
- consent, where consent is required by applicable law.
When VEVS processes personal data contained within a rental company's VEVS account on behalf of that company, the rental company generally determines the purposes for which that customer or driver information is processed, and VEVS processes the information on its behalf as a service provider or processor.
12. User Controls
Users and VEVS customers have several controls over use of the MCP service.
Depending on their account permissions, users can:
- choose whether to connect VEVS to a supported AI service;
- disconnect or disable the integration;
- control who within their organization is permitted to use the integration;
- limit user permissions within VEVS;
- choose which actions they request through the AI service;
- review information and changes within the VEVS administration system;
- correct information stored in VEVS;
- request deletion where applicable; and
- contact VEVS regarding their privacy rights.
Disconnecting the MCP integration prevents new requests through that connection but does not automatically delete legitimate business records already maintained within VEVS Car Rental Software.
Users may also have privacy controls provided separately by their AI provider.
13. Data Subject Rights
Depending on the user's jurisdiction, individuals may have rights including the right to:
- request access to their personal information;
- correct inaccurate information;
- request deletion;
- restrict certain processing;
- object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent; and
- lodge a complaint with an applicable data-protection authority.
Some information contained in a VEVS account is processed by VEVS on behalf of the rental company using our software. Where appropriate, privacy requests concerning rental customer or driver records may therefore need to be directed to that rental company.
Requests concerning VEVS's own processing may be sent using the contact information below.
14. Security
VEVS uses technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction.
These measures include, as appropriate:
- encrypted communications;
- authentication and authorization controls;
- account permission controls;
- server-side input validation;
- access restrictions;
- security logging;
- infrastructure security measures; and
- monitoring for misuse or unauthorized access.
No online system can guarantee absolute security, but we continually review our safeguards and access controls.
15. AI and Automated Decision-Making
The VEVS MCP service enables an AI system to interpret user instructions and select appropriate VEVS tools.
The AI model does not receive unrestricted authority over the VEVS account.
VEVS MCP tools execute defined operations and enforce applicable server-side permissions and validation.
VEVS does not use information received through the MCP integration for automated profiling of rental customers for advertising purposes.
16. Use of Information for AI Training
VEVS does not use customer reservation, driver, vehicle, or MCP request data to train a general-purpose artificial intelligence model.
An external AI provider may have its own policies governing whether information submitted to that provider may be used to improve its services. Users should review the privacy and data-control settings of the AI provider they choose to connect.
17. Children's Privacy
The VEVS MCP service is a business software integration and is not directed to children.
VEVS does not knowingly use the MCP service to collect personal information directly from children for marketing or profiling purposes.
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to:
- the MCP service;
- available tools;
- AI integrations;
- applicable laws;
- security practices; or
- our data-handling practices.
When material changes are made, we will update the “Last updated” date above and, where required, provide appropriate notice.
19. Contact Us
The VEVS MCP service is provided by:
StivaSoft Ltd.
Trading as VEVS / VEVS Car Rental Software
Website: https://www.vevs.com/
MCP service: https://mcp.vevs.com/
For questions about this Privacy Policy or the processing of personal information through the VEVS MCP service, please contact us using the details above.