Last updated: 7 October 2026
This notice explains what personal data Glovebox collects through gloveboxcentral.com and app.gloveboxcentral.com, why, who it goes to, how long we keep it and the rights you have. It covers operators in the United Kingdom, Ireland, the rest of the European Economic Area, Australia and every other country we serve from this site. New Zealand operators are covered by the getglovebox.co.nz privacy policy.
Who we are
Glovebox is run by Dori Media, a sole trader based in Christchurch, New Zealand. For the personal data described here, Dori Media is the controller. You can reach us about anything in this notice at hello@gloveboxcentral.com, and a person will reply.
What we collect, and why
When you visit this website
- Visit statistics. If you allow it, Google Analytics records the pages you view, how you arrived and the device you use. We use it to see which pages help operators and which do not.
- Advertising measurement. If you allow it, Google Ads records whether you arrived from one of our adverts and whether you then started a trial, so we can tell which adverts work.
- Request data. Cloudflare, which serves this website, processes your IP address and the request itself to deliver the page and protect the site from attacks.
Visitors in the UK, the EEA and Switzerland are asked first, and nothing in the first two points runs until they accept. The legal basis is your consent, which you can withdraw at any time from Cookie choices.
If you arrive from one of our Google adverts. The link you followed carries a click identifier that Google added to it. We pass it along in the links to our app, without storing anything in your browser, and if you then start a trial we keep it with your account, together with the cookie choice you made. That tells us which advert led to the trial. We send it back to Google with your trial only if you accepted cookies. The legal basis for keeping it is our legitimate interest in knowing which adverts work.
When you join the waitlist
The waitlist is for countries we have not opened yet. We store your email address, country and fleet size, and, if you give them, your name, business name, timeline and current booking tool. We also store the page you signed up on, the country Cloudflare detects from your connection, and when you ticked the consent box. We send one email asking you to confirm. We use these details only to tell you when your country opens and, occasionally, to ask how your operation runs. The legal basis is your consent.
When you start a trial or subscribe
- Account details: your name, email address, phone number, business name and location, fleet size and current booking system.
- How you found us: the advert, campaign or link you arrived from, if any.
- Billing: your subscription and payment history. Card details are collected and held by Stripe. We never see or store the full card number.
- Technical data: log data, error reports and the IP address and browser of each sign-in, which we need to run and secure the service.
The legal basis is the contract between us: we need these details to provide the service you signed up for. We keep billing records because tax law requires it. We use technical data under our legitimate interest in keeping the service secure and working.
Your customers' data
When you use Glovebox to run your hire business, you decide what customer data goes in: names, contact details, licences, bookings and payments. For that data you are the controller and we are your processor. We handle it only to run the service for you, under the data processing terms in our terms of service. If one of your customers asks us about their data, we will pass the request to you.
Who we share it with
We do not sell personal data. We use these providers to run Glovebox, and each one handles data only as needed for the service it provides.
| Provider | What for |
|---|---|
| DigitalOcean | The servers that run Glovebox, in Sydney, Australia |
| Cloudflare | This website, security, the waitlist database and file storage |
| Postmark | Sending email, such as confirmations, notices and booking emails |
| ClickSend | Sending text messages, where an operator turns them on |
| Stripe | Subscription billing, and card payments operators take from their customers |
| Analytics and advertising measurement, only with your consent | |
| Microsoft Clarity | How people use our sign-up pages, only with your consent |
| Laravel Nightwatch | Error and performance monitoring |
| Xero | Accounting sync, only if you connect your Xero account |
| Anthropic (Claude) | Only if a workspace owner connects the Claude connector. Claude then receives the answers to the owner's questions about that workspace and any changes the owner approves. |
We may also disclose data where the law requires it, or to protect our rights or someone's safety.
Where your data goes
Glovebox's servers are in Australia, Dori Media is in New Zealand, and some of the providers above process data in the United States and other countries. New Zealand is recognised by the UK and the EU as giving adequate protection. For transfers to countries without that recognition, we rely on the standard contractual clauses, and for UK data the UK addendum to them, that our providers include in their data processing terms.
How long we keep it
- Waitlist details: until we open in your country and for up to 12 months after, unless you ask us to delete them sooner.
- Account and workspace data: for as long as your account is open. After you close it, you can export your data for 30 days, and then we delete it.
- Billing records: for 7 years, because tax law requires it.
- Logs and error reports: for as long as we need them to keep the service secure, usually no more than 90 days.
Cookies
These are the cookies and similar storage that gloveboxcentral.com and app.gloveboxcentral.com use. The analytics, advertising and Clarity ones are set only after you accept, if you are in the UK, the EEA or Switzerland.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| gbc_consent | Glovebox | Remembers your cookie choice, so the website and the app both respect it | 180 days |
| glovebox-session | Glovebox | Keeps you signed in to the app. Needed for it to work. | 30 days |
| XSRF-TOKEN | Glovebox | Protects the app's forms from forged requests. Needed for it to work. | 30 days |
| _ga, _ga_* | Google Analytics | Counts visits and tells one visitor from another | Up to 2 years |
| _gcl_au, _gcl_aw | Google Ads | Records that you came from an advert, so a trial can be credited to it | 90 days |
| _clck, _clsk | Microsoft Clarity | Shows how people move through the sign-up pages | Up to 1 year |
You can change your choice at any time from Cookie choices, at the foot of every page.
Your rights
Depending on where you live, you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to limit how we use it, ask for a copy in a portable format, or object to how we use it. You can always object to marketing emails and withdraw consent, without affecting what we did before you withdrew it. Email hello@gloveboxcentral.com. We reply within one month.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to a regulator:
- United Kingdom: the Information Commissioner's Office.
- Ireland: the Data Protection Commission.
- Elsewhere in the EEA: the data protection authority in your country.
- Australia: the Office of the Australian Information Commissioner.
- New Zealand: the Privacy Commissioner.
We do not make decisions about you by automated means alone.
Changes to this notice
If we change this notice in a way that matters, we will say so here and, if you have an account, by email before the change takes effect.