Car Booking is a multi-company (SaaS) car rental management system. One installation serves many rental companies. Each company (an owner) gets its own cars, customers, bookings, staff, website and mobile apps, and can never see another company's data. The platform itself is run by the super admin, who sells subscription plans.

Who uses it

Main parts

• Admin panel for super admin, owners, staff and drivers.
• Public booking website for every company (own pages, blog, FAQ, SEO, own domain, dark mode, many languages).
• Driver app and customer app (Flutter, Android and iPhone) that talk to the same server through a mobile API.
• AI helpers (assistant, insights, photo damage check, pricing suggestions, reply drafts, ID reading) with OpenAI, Claude or Gemini.
• Public API and webhooks (n8n, Zapier or any URL) for connecting other systems.

You do not need Node.js on the server: the compiled assets are included.

Do these steps once after the installer has finished. Most problems reported by customers come from skipping one of them.

1. Change the default passwords of the super admin, owner and manager accounts (Profile > Password) and the demo email addresses.
2. Production settings: in .env set APP_ENV=production, APP_DEBUG=false and the real APP_URL (with https://). Debug pages leak secrets.
3. Storage link: run php artisan storage:link (or create the public/storage link in your host panel). Without it uploaded photos, logos and banners do not show.
4. Folder permissions: the web server user must be able to write to storage and bootstrap/cache (usually 775).
5. Cron: add the scheduler entry (next section). Without it there are no reminders, no expiry, no backups.
6. Email: Settings > Email (SMTP) and send a test. Customers receive sign-in codes and booking emails from here.
7. Check the security rules: open https://your-site/.env and https://your-site/storage/logs/laravel.log. Both must answer 403. If a file downloads, your web server ignores .htaccess: fix it before going live.
8. Back up your .env (it holds APP_KEY; without it encrypted settings cannot be read).
9. Run migrations after every update: php artisan migrate --force then php artisan optimize:clear.

Cron (required)

One entry, every minute. Replace the path with the folder that contains artisan (the main_file folder):

* * * * * cd /path/to/main_file && php artisan schedule:run >> /dev/null 2>&1

What the scheduler runs:

Queue (optional)

With the default QUEUE_CONNECTION=sync emails and webhooks are sent during the request: simple and fine for small installs. To send them in the background set QUEUE_CONNECTION=database in .env; the cron entry above then drains the queue every minute (or run php artisan queue:work under Supervisor on a VPS). The old key QUEUE_DRIVER is ignored by Laravel.

The installer writes .env for you. These are the keys you may need to change later:

• The folder with artisan is the application folder. In this product layout the root .htaccess sends requests to index.php and denies access to .env, storage/logs, storage/app/backups, vendor and source files. Keep those rules.
• If you can, point the domain's document root at the public folder instead; then these files are never reachable.
• Nginx: use the standard Laravel configuration (try_files $uri $uri/ /index.php?$query_string;) and deny /\. and /storage/logs.
• SSL: install a certificate (Let's Encrypt is free). Payment gateways, store apps and sign-in cookies need https.
• Company websites on their own domains need the proxy to keep the original Host header. For certificates on customers' domains use a proxy that issues certificates on demand (Caddy on_demand_tls with ask pointing at /domain-check?domain=host, which answers 200 only for domains that belong to a company).

The super admin sees platform-wide numbers instead of one company's data.

• Dashboard: active and inactive owners, new owners (30 days), trials, plans ending soon, expired plans, plan income (this month and 30 days), totals for vehicles, bookings, customers and drivers, a table per plan, and the latest owners and plan payments.
• Customers (menu): the list of owners (your customers). Create an owner, edit, activate / deactivate, and log in as the owner to help (an impersonation banner lets you go back). An inactive owner cannot sign in, and their website and apps stop working.
• Plan payments: Pricing > Transactions lists every plan payment with a PDF invoice. Coupons (All Coupon, Coupon History) give discounts on plans.

Pricing > Packages. Each plan has a price, a duration (monthly, yearly, lifetime) and limits and feature switches. Owners choose a plan on sign-up or from their dashboard.

• Limits: number of users, customers, vehicles (vehicle limit) and so on. When the limit is reached the owner is asked to upgrade.
• Free trial: set trial days on a plan; a new owner starts on the trial and sees the end date.
• Feature switches: for example AI features, n8n webhooks, API access, online booking. A feature that is off in the plan is hidden for the owner.
• Payment methods for plans: bank transfer (needs your approval), Stripe, PayPal and the other gateways you switch on under Settings > Payment.
• Renewal: owners get reminder emails before the plan ends (subscriptions:remind). Renewal is a reminder with a link: cards are not charged automatically. A plan that ends is marked expired by subscriptions:expire.

Settings (top right menu) has one tab per area. The super admin's settings are the platform defaults; each owner has their own copy for their company.

• System health: scheduler heartbeat, queue backlog, failed jobs, last backup, free disk space and plans ending soon, each with a green / red state and a hint.
• Backups: nightly backup:run writes a zip (database dump + uploads) to storage/app/backups and keeps the newest BACKUP_KEEP. Download or run one now from Backups. Copy the zips off the server too. Owners can export their own data as JSON (Backup & data export).
• Login attempts: every sign-in try (who, address, result) for 90 days. Five wrong passwords per account and address, and 30 per address, lock sign-in for a while.
• Mobile apps: paste the Google Play and App Store links of the shared apps once (see "Mobile apps").
• Language files: php artisan lang:sync adds every text used in the code to each language file so translators have a complete list (untranslated texts keep the English words).

A new company is ready to take bookings after these steps. Each one is a menu item on the left.

1. Settings > Company: company name, address, phone, email, currency, time zone, logo. These appear on invoices, agreements and the website.
2. Configuration > Tax: add your tax rates (for example VAT 10%). Bookings can add taxes automatically.
3. Configuration > Types: vehicle types (Sedan, SUV, Van), inspection types, expense types and expiration (maintenance) types. Configuration > Booking: Options (air conditioning, GPS, child seat), Addons (extras with a price) and Places (pick-up / drop-off points with an optional price).
4. Fleet > Branches: add your branches (offices / depots).
5. Fleet > Vehicle: add each car (details below). Add photos: the website and apps use them.
6. People > Driver, and System Settings > Staff Management: add drivers (they get the trimmed driver menu), then staff Users and Roles.
7. Configuration > Rental Policy: late fees, kilometres, cancellation, deposit. Everything is off until you turn it on.
8. Configuration > Pricing Rules: season, weekend, last-minute rules (optional).
9. Configuration > Email Notification: choose what is sent by email, SMS, WhatsApp or push, and edit the wording.
10. Settings > Payment: your own gateway keys if customers pay online.
11. Online Booking: turn it on and choose your web address (for example sunrentals). This creates your website and your app code.
12. Website > CMS: write your pages, colours, banner, FAQ, blog and SEO.
13. Website > Mobile apps: see your app code and QR code.

• Roles (Staff Management > Roles): create roles such as "Receptionist" or "Accountant" and tick what each can do (manage / create / edit / delete / show for every module).
• Users: Staff Management > Users: add a user, assign a role, set a password, activate or deactivate.
• Drivers: People > Driver: a driver is a user with the driver role. This role is deliberately small: contacts, notes, vehicles, bookings, inspections, expenses, rental agreements and their own account settings. They do not see WhatsApp inbox, branches, reports, finance and similar areas.
• Permissions are checked everywhere: menu items, pages, buttons, exports and the mobile API. A user who cannot "manage booking" does not see Bookings and cannot open the link by typing it.
• Changing a role takes effect immediately. If a menu item seems missing after an update, open Roles and tick the new permission for that role.

• Vehicle list and details page: every car has a full details page (eye icon): photos, specs, rates, insurance, documents, GPS position, bookings history, income, expenses, maintenance and inspections.
• Fields: name, model, year, colour, plate, engine, gearbox, fuel, seats, odometer, daily / hourly / weekly / monthly rates, purchase price and date, insurance provider, policy number, premium and expiry, registration expiry, tracker id (GPS), branch, out-of-service switch, documents and notes.
• Photos: up to 12 per car (JPG / PNG / WebP, 5 MB each). Drag to reorder, mark the main photo. They show on the website (gallery, swipe, full screen) and in the apps. A car without photos shows a drawn side view.
• Out of service: takes the car out of booking and out of the website.
• Expiration reminders: Fleet > Expiration Reminder tracks registration, insurance and any date you add; vehicles:expiry-alerts sends bell alerts / emails before they end; repeating maintenance moves to its next date on its own.
• Branches and transfers: cars belong to a branch; log a one-way transfer to move a car between branches (history is kept).
• Pricing suggestions (AI): see the AI section.
• GPS / tracker: the public API accepts position updates (tracker ability) and shows the last position on the car page.

• Create a booking: Rentals > Booking > Create. Choose customer (or create one), car, dates and times, pick-up and drop-off places, driver, extras (add-ons), discount, tax and notes. The price is worked out by the pricing engine (rates, rules, extras, tax).
• Statuses: Pending (online request waiting), Yet to start, On going, Completed, Cancelled. A booking whose return time passed while still On going shows an Overdue badge.
• Availability: a car cannot be double-booked; the system checks overlaps for staff, the website, the API and drag-and-drop.
• Payments: add payments (cash, card, transfer…) on the booking page; the payment status (unpaid / partly / paid) follows. Refunds are recorded as negative payments so income reports show net figures. A paid booking that is cancelled is flagged Refund due; you send the money and press Mark as refunded.
• Deposit: a default deposit for new bookings. It is held money, not income: mark it collected, later release it, optionally keeping part against the balance.
• Start / finish: the driver (or staff) starts the job with the odometer and fuel level and finishes it with the return reading. Closing the contract adds the late fee and extra-kilometre fee from your Rental Policy and sets the car's odometer.
• Bulk actions: tick rows on the list to export (Excel, PDF, CSV), cancel or delete selected bookings (bookings with payments are never deleted).
• Invoices and PDF: print the invoice or download PDF from the booking page.
• Activity log: who did what on a booking and when.
• Photos and AI check: pick-up and return photos from the driver app show on the booking; "Check photos with AI" compares them (a hint, never proof).
• Overdue and reminders: customers get pick-up and return reminders by email and, with the app, by push.

Planning calendar

Rentals > Planning shows every car as a row. Drag a booking to another day or onto another car, or resize it to change the length. The server checks the car is free, recalculates the price and keeps the draft agreement in step; a refused move snaps back. Completed and cancelled bookings are fixed. Needs the update booking permission.

• Rental agreement: a draft agreement is created with every booking (and follows the driver). Edit the terms, then send the customer a private e-sign link (/sign/{token}). The signing page shows the full agreement; the customer draws a signature; name, address (IP) and time are stored. Signed agreements cannot be changed.
• Drivers can also sign: the driver signs their own agreement in the driver app or the My jobs page.
• Inspections: checklists for pick-up and return (types are configurable) with photos, amount and notes.
• Damage marks and claims: mark damage on the car diagram, then "Start a damage claim" to record the cost, status and who pays. A claim can be charged to the booking.
• Fines and tolls: record a fine with the vehicle, time and amount; it finds the booking that had the car at that time and can be charged to that customer's booking.

• Customer records: name, email, phone, address, ID and licence numbers, licence expiry, notes. Created by staff, the website or the customer app.
• Documents: licence and ID photos or PDFs in private storage (not publicly reachable). Expiry dates are tracked.
• Blacklist: a blacklisted customer cannot book online or sign in to the app.
• Lifetime value: income per customer (Finance > Customer value).
• Privacy (GDPR): Export gives the customer's data; Erase removes personal details and documents but keeps past bookings without the name. The customer app has "Delete my account" with the same result.
• Loyalty and referral: see Marketing.
• AI document reading: optional; see the AI section.

• Driver menu: a driver sees My jobs (their jobs for the next 7 days with phone and map links, Start / Finish), their rental agreements, their expenses and their earnings.
• My jobs page: /driver-app/today can be added to a phone's home screen and the last loaded page stays readable offline. The Flutter driver app does the same and more.
• Commission: People > Driver payouts: set a commission per driver (percent of the rental before tax, per booking, or per day). It is worked out once when a booking is completed (later rate changes do not alter it). Pay out in one go; paid earnings are never removed. Reopening a completed booking removes an unpaid earning.
• Expenses by drivers: a driver can add fuel, tolls, parking with a receipt photo; the owner sees them in Expense with the driver's name.

• Expenses: Expense menu: title, type (Expense types), vehicle, date, amount, receipt, notes.
• Reports (menu Report): Income, Outstanding Balances, Vehicle Utilization, Tax summary (tax collected per period), Customer value (best customers), Expense, Profit/Loss, Vehicle Availability and Damage Incident, each with filters and export to Excel, PDF or CSV where offered. Logged History (Staff Management) shows who signed in.
• Data & sync: Backup & data export, Calendar feed and Accounting export (CSV files for Xero, QuickBooks and Zoho).
• Dashboard: a period filter (for example today, this month, this year or a custom range) drives the money cards (received, expenses, profit, bookings, new customers); fleet counts and the Today section always show today. Also top vehicles, upcoming pick-ups, overdue returns, outstanding balances, online requests waiting, utilisation and the AI insight card.
• Other currencies: on the website visitors can view approximate prices in another currency using rates you type (display only; bookings stay in your currency).

• Promotions: percent or fixed codes with dates, minimum amount, cap, total and per-customer limits and a channel (everywhere / website and API / staff). One discount per booking. Customers type the code on the website or in the app.
• Loyalty and referrals: points are earned when a booking is completed, spent by staff as a discount, and returned if the booking is cancelled. Every customer has a referral code; a friend using it gets a discount on the first booking and the referrer gets points after the friend's first completed rental.
• Reviews: a request email is sent after a rental; reviews wait for your approval, can get a reply, and show on the website.
• WhatsApp inbox: customers' replies arrive in a shared inbox and staff answer from it (free replies are allowed 24 hours after the customer's message). Needs Twilio WhatsApp; see "Integrations".
• Contact diary and Notice board: contacts and notes for the team; the notice board is shown to staff and drivers (also in the driver app).
• Email notifications: Configuration > Email Notification lists every email the system sends; for each one choose the channels (email, SMS, WhatsApp, phone push) and edit the wording, per company.
• Calendar feed: a private .ics link for Google / Apple / Outlook calendars. Creating a new link disables the old one.

Switch AI on under Settings > AI Settings (needs a plan that includes AI). Choose a main provider (OpenAI, Claude or Gemini) and an optional backup; if the main one fails the request is tried once on the backup. Keys are stored encrypted; leave a key empty to keep it, or tick "remove this key". A daily limit per company protects your costs. The permission use ai assistant controls who can use the features.

• API Access: create tokens under Configuration > API Access. Abilities: read, bookings:write, tracker. Base address /api/v1. Tokens can be revoked at any time.
• Webhooks (n8n / Zapier / any URL): Configuration > N8N lists every event with a sample payload and a send test button. Events: online_booking_created, booking_created, booking_updated, booking_cancelled, payment_received, refund_recorded, contract_closed, deposit_released, review_submitted, fine_charged, damage_claim_created and more. Every call carries event and occurred_at. With a signing secret the call includes X-Signature: sha256=<HMAC-SHA256 of the raw body>.
• Mobile API: documented in main_file/docs/mobile-api.md (login, driver, staff and customer endpoints).

1. Open Online Booking, switch it on and choose a web address (lowercase letters, numbers, dashes). Your site is https://platform/book/{address}.
2. Choose whether bookings are confirmed automatically or need your approval, the free-cancellation hours (0 = no online cancellation), whether payment is required, hold time for unpaid reservations, the intro text and the AI chat helper.
3. Add payment keys under Settings > Payment. Supported: Stripe, PayPal, Paystack, Flutterwave, Razorpay. When several are on, the renter picks one. A payment is checked with the provider (never trusted from the browser) and recorded once.
4. Stripe webhook (recommended): in Stripe add the endpoint shown on the Online Booking settings page for the checkout.session.completed event and paste its signing secret there. Payments are then recorded even if the renter closes the tab before returning.
5. Cancellation: renters can cancel until N hours before pick-up. A paid booking cancelled this way is flagged Refund due; gateways are not asked to refund automatically.
6. Unpaid online reservations are released automatically when the hold time ends (bookings:expire-online).
7. Staff see an online booking in Bookings (source "online"). It has no driver until you assign one.

Each tab saves on its own. Empty text falls back to good defaults.

• The header menu is fixed: Home, Cars, Our fleet, How it works, About us, Contact us. Everything else (Blog, extra pages, My bookings, Get our app) is in the footer.
• The site follows the owner's language; visitors can switch language (?lang=). Arabic switches the whole layout to right-to-left. Language files live in resources/lang; run php artisan lang:sync after adding texts.
• Pages: home, cars (filters, sort, grid / list), car page (gallery, specs, features, price table, policies, reviews, similar cars, sticky booking panel), wishlist, compare, contact, blog, my bookings (find bookings by email link), booking confirmation and invoice.

Every company's website can be opened on up to three addresses, all showing the same site:

1. Standard link: https://platform/book/{address}. Always on.
2. Free subdomain: https://{address}.example.com. The super admin sets SITE_BASE_DOMAIN=example.com in .env and creates a wildcard DNS record *.example.com to the server (and a wildcard SSL certificate).
3. Own domain: the owner opens Website > Website address, types rent.theircompany.com, creates the shown CNAME (or an A record to your CUSTOM_DOMAIN_IP) and the TXT record _carbook-verify.rent.theircompany.com with the shown value, then presses Verify. Only after verification does the domain serve the site.

• The owner can choose a main address; the other addresses then redirect to it (GET requests only; signed links are never redirected).
• On a company's own host the links are clean (/cars, /blog, /contact, /my-bookings, /app), robots.txt and sitemap.xml use the host, and login, admin and other companies are not served there (404). The mobile apps always talk to the platform address, never to a company's own domain.
• The page also lists a one-click copy of each address ("My website" in the header menu).

There are two Flutter apps (Android and iPhone) in the mobile folder: the driver app and the customer app. Both talk to the server's /api/mobile/v1 (documented in main_file/docs/mobile-api.md). A staff app is not part of the product.

Recommended model: one shared app for everyone

• You (the super admin) publish one customer app and one driver app under your own Apple and Google developer accounts, built with your domain.
• The driver signs in with email and password; the server knows the company, so no code is needed.
• The customer picks the company once (scan the QR on the company's website, search by name or city, or type the company code), then the app shows that company's name, logo, colour, cars, prices and rules.
• One update reaches every company; one set of store fees and reviews.

Why not a separate store app per company?

Apple's guideline 4.2.6 rejects apps made from a template by a service provider on behalf of clients, and Google Play's repetitive-content policy discourages many near-identical apps; Google also does not allow tool-generated apps to be submitted by the tool's operator for others. The accepted ways are the shared "picker" app above, or an own-brand app that the company publishes from its own developer accounts. The build script in "Own-brand app" prepares that. Check the stores' current rules before launch.

What the owner gives customers

• The app code (the website address name, for example sunrentals), shown on Website > Mobile apps with a QR code, a "copy message" button and the page customers see.
• Every company website has a public page /book/{address}/app ("Get our app") with the QR code, the code in plain text and the store buttons. A "Get our app" link appears in the footer once store links are set.
• On iPhone the App Store cannot pass the code through the install, so the customer scans the QR or types the code after the first start. This is normal.

• Home: today, in progress, coming up and done-this-month counts; commission to be paid, earned this month, paid out, expenses this month; a 7-day bar chart; today's jobs; alerts for overdue returns and agreements waiting for a signature.
• Bookings: Open, Today, Coming up, Done, Cancelled, All history, with search by booking number, car or customer. Each card shows customer, places, amount and payment status. The booking page has notes, map navigation, call and WhatsApp the customer, start and finish with odometer and fuel, photos, and the linked agreement.
• Photos: pick-up, return and damage photos with the camera or gallery; long-press to delete your own.
• Agreements: list (To sign / Signed / All), read the terms, sign with a finger. A blank signature is refused; a signed agreement cannot be signed again.
• Expenses: add fuel, tolls or parking with type, car, date, amount, notes and a receipt photo; see this month's total; delete your own.
• Earnings and notices: commission and payouts; the company notice board.
• Push: new job and cancelled job (needs Firebase; see below).

• Find your company: scan QR, search by name or city, or type the code (a pasted website link or the company's own domain also works). Companies can switch listing in the search off (Website > Mobile apps).
• Sign in (three ways, owner can switch password and phone off): (1) email code: a 6-digit code by email, valid 10 minutes, 5 tries, new customers also give their name; (2) password: set in Profile, 5 wrong tries pause it for 15 minutes, "Forgot password" sends an email code; (3) phone number + text message: needs the owner's Twilio SMS; 3 texts per phone and hour, daily company cap 200. Biometric / PIN app lock is optional in Profile.
• Home: trip happening now or next trip with countdown and directions, amount still to pay, "book the last car again", offers (tap to copy the code), trips / spent / points, unread notifications bell.
• Cars: pick-up and return date and time, only free cars with the trip price, sort (price, seats, name), filters (type, gearbox, fuel), favourites, and a car page with photos, extras, places, promo or friend code, price breakdown and the company's rules.
• Booking and payment: book, then pay on the company's secure payment page (the gateway you set up), confirmation screen.
• My bookings: Upcoming / Past / Cancelled; on a booking: status, dates, places, extras, money, payments, extra charges, deposit, your driver (call), pick-up and return maps, add to calendar, Pay, Extend this rental (with new price), Rate your rental, Invoice PDF, Car photos (take pick-up and return photos), Report a problem (breakdown, accident, damage, running late), call the company, cancel inside the free window.
• Profile: details, password, My companies (stay signed in to several companies and switch), My documents (licence and ID photos with expiry), Rewards and offers (points, history, friend code, promo codes), Contact us, AI helper (when the company has it on), Light / Dark / Auto, app lock, sign out, delete my account.
• Notifications: an in-app inbox that keeps every message (also when push is off) and push for booking confirmed / cancelled and reminders the day before pick-up and return.
• Not included: paying by card inside the app (payment opens the company's page), saved cards, Google / Apple sign-in.

Build

1. Install Flutter (flutter.dev) and Android Studio (Android) or Xcode on a Mac (iPhone).
2. Open a terminal in mobile/driver_app or mobile/customer_app:

flutter pub get
# test on a device or emulator
flutter run --dart-define=API_BASE=https://your-domain.com/api/mobile/v1
# Android release files
flutter build apk --release --dart-define=API_BASE=https://your-domain.com/api/mobile/v1
flutter build appbundle --release --dart-define=API_BASE=https://your-domain.com/api/mobile/v1   # Google Play
# iPhone (on a Mac)
flutter build ipa --release --dart-define=API_BASE=https://your-domain.com/api/mobile/v1

• API_BASE must be your platform address (not a company's own domain). Plain http:// works in debug builds only; store builds need https. The Android emulator reaches a server on your PC at http://10.0.2.2/... (the default in lib/config.dart).
• Change the package id before publishing (com.carbooking.driver_app, com.carbooking.customer_app in android/app/build.gradle* and in Xcode) and replace the launcher icons / names if you rebrand: the apps use the system logo (assets/logo.png, assets/mark.png).
• Names: driver app "Car Booking Driver App", customer app "Car Booking".
• The app is tested by unit tests (flutter test) and flutter analyze is clean, but run it on a real phone before release.

Publish

1. Create a Google Play Console account and an Apple Developer account (yours, as the platform owner).
2. Upload the app bundle / IPA, add screenshots, privacy policy and the data-safety answers (the apps use the camera, photos, and optionally location-free push).
3. When they are live, open Mobile apps in the super admin menu and paste the four store links (customer Android / iPhone, driver Android / iPhone). Every company's "Get our app" page then shows them.

Own-brand app for one company (optional, paid extra)

The company must publish it from its own Apple and Google developer accounts. Prepare the project with the script (needs Python 3 and pip install pillow):

cd mobile/customer_app
python3 tools/build_branded.py --company sunrentals --name "Sun Rentals" --logo logo.png \
    --api https://your-domain.com/api/mobile/v1 --package com.sunrentals.app --build appbundle

It copies the app to build_branded/sunrentals/ with the company's name, icons, package id, fixed company code (no code screen) and your API address. The company then enters its own store links under Website > Mobile apps, and those links win on its website.

Push is optional. Without these steps both apps work, only without push messages.

1. In the Firebase console create a project and add an Android app and an iOS app with your package / bundle ids.
2. Download google-services.json into android/app/ and GoogleService-Info.plist into ios/Runner/ (add it to the Runner target in Xcode) of each app. Do this for both apps.
3. iPhone only: upload your Apple APNs key in Firebase (Project settings > Cloud Messaging) and in Xcode enable Push Notifications and Background Modes > Remote notifications.
4. Server: Firebase console > Project settings > Service accounts > Generate new private key. Save the JSON on the server outside the web folder and set FCM_CREDENTIALS=/path/to/file.json in .env.
5. Keep the queue running (or QUEUE_CONNECTION=sync). Rebuild the apps and test on a real phone (push does not work on most emulators).

Who gets what: drivers get a push for a new or cancelled job; staff get the bell alerts; customers get booking confirmed / cancelled and reminders. The owner can switch each push on or off under Configuration > Email Notification (Phone app notifications).

1. Settings > Twilio: enter the Account SID, Auth token, the SMS "from" number and the WhatsApp number.
2. In Twilio set the WhatsApp sender's When a message comes in webhook (POST) to the address shown on the WhatsApp inbox page. Every call is checked against the company's Twilio auth token.
3. Email Notification: choose SMS and/or WhatsApp for the events you want.
4. Customer app phone sign-in uses the same SMS number. Every text costs the owner what Twilio charges; limits protect against abuse (3 texts per phone and hour, 10 per device address and hour, a daily company cap of 200).

• Settings > Email: host, port (587 TLS or 465 SSL), username, password, sender name and address, then press the test button.
• Use an address on your own domain with SPF / DKIM set up, otherwise sign-in codes and booking emails may land in spam.
• Emails sent: sign-in codes, booking confirmation, reminders, invoices, review requests, plan reminders, contact form copies, vehicle-expiry alerts. Every email the system sends is a row in Configuration > Email Notification: new user and driver, booking and agreement updates, online booking received / confirmed / cancelled, pickup and return reminders, payment due, review request, "My bookings" link, agreement signing, the customer app sign-in code, new website messages and vehicle-paper expiry alerts. For each row switch the channels (email, SMS, WhatsApp, push) on or off and edit the wording with the placeholders it shows. The built-in text is used until you change it.
• With QUEUE_CONNECTION=database emails go out in the background (cron drains the queue).

Settings > AI Settings: pick the main provider and an optional backup, paste a key and model for each, set the daily limit, and decide on "Let AI read ID and licence photos". The Claude and Gemini connections were tested with simulated replies; try each key once after entering it.

• Use https everywhere, keep APP_DEBUG=false, strong passwords, and enable two-factor sign-in for admins.
• Keep backups: the nightly zip is on the same server, so copy it elsewhere (another server or cloud storage) regularly, and test a restore once.
• Back up .env (APP_KEY) and the storage folder before every update.
• Check System health weekly (scheduler, queue, failed jobs, last backup, disk space).
• Review Login attempts for suspicious activity; the platform locks repeated wrong passwords.
• Uploaded customer documents are stored privately and are served only to signed-in staff with permission.
• Keep PHP and the server packages updated. After updating the product run migrations and clear caches.
• Not covered by automated tests: real payment gateways, real email / SMS / WhatsApp delivery, real AI calls, DNS verification of own domains, push notifications, and the apps on real phones. Test these once on your server.

If you have any queries, please create a support ticket, and our support team will respond as soon as possible.

Create Ticket Now