U-Haul

"The U-Haul Vehicle, Towable Equipment... and/or U-Box Container(s) in your possession (collectively, "U-Haul Equipment") may be equipped with a device which collects location data of the U-Haul Equipment ("Location Detection Device"). We may access and/or use the Location Detection Device... To monitor U-Haul Equipment for diagnostic, performance, repair, maintenance, and design purposes; To monitor U-Haul Equipment for fleet performance, migration, positioning, and repositioning purposes... For any other legitimate business purposes as authorized by law."

U-Haul equipment may be fitted with location tracking devices, and the company reserves broad rights to access this data for fleet management, diagnostics, and any other 'legitimate business purposes' — going well beyond theft recovery or roadside assistance.

"Biometric information — Scans of face geometry (taken from selfie or headshot photos). Internet or other electronic network activity information — IP Address, Device / Browser Information, Browsing history... Log File Information such as web request, browser type, referring / exit pages and URLs, number of clicks, domain names, landing pages, pages viewed, and other such information."

U-Haul collects biometric face geometry scans from photos alongside extensive device and browsing data, which is unusually invasive for a moving and storage rental company.

"Inferences drawn from any of the collected to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes."

U-Haul creates detailed psychological and behavioral profiles by combining data collected across its services, including inferences about intelligence, attitudes, and predispositions — far beyond what's needed for equipment rental.

"Examples of whom We may share information with include: U-Haul International, Inc. and its parent, affiliates and subsidiaries... Vehicle repair and/or tow truck companies... Payment card issuers, banks, credit reporting and fraud checking agencies, debt collection agencies, and insurance companies... Transportation or driver licensing authorities... Government or private organizations responsible for the processing or handling of transportation, tolls, traffic/moving or parking related violations."

U-Haul shares personal information with a wide network of third parties including credit agencies, debt collectors, insurance companies, and government organizations, creating broad exposure of user data.

"We reserve the right to revise, modify, add, or remove portions and reissue this Privacy Policy at any time to keep you aware of what information We collect, how We use it and under what circumstances We may disclose it. Any changes will be effective immediately upon posting of the revised Privacy Policy and your continued use of the website indicates your consent to the Privacy Policy then posted."

U-Haul can change its privacy policy at any time with no advance notice, and continued use of the website is treated as consent to the new terms.

"Consistent with our record retention policies, we store your information for as long as legally required or for so long as necessary to support the business purposes described in this Privacy Policy. In general, this storage will be (i) at least for the duration of our relationship, (ii) for as long as you can bring a claim against Us and for Us to be able to defend Ourselves, and (iii) for any period required by applicable laws and regulations."

U-Haul's retention policy has no concrete timelines and uses open-ended criteria like 'as long as you can bring a claim,' which effectively allows indefinite retention of personal data including biometric information.

"To exercise your access and deletion rights described above, please submit a verifiable consumer request to Us by either: Calling Us at 1-866-242-7780, Emailing Us at privacy@uhaul.com. Only you, or a person registered with the Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request... The verifiable request must: Provide sufficient information that allows Us to reasonably verify you are the person about whom We collected personal information."

There is no self-service account deletion option. Users must call or email and go through a verification process, and U-Haul reserves the right to retain data despite deletion requests for broad business and legal reasons.