Privacy Policy

Last updated: 2026-08-22

1. Who we are

This website is operated by Right Spot Rental LLC of Hudson, Wisconsin. If you have questions about this policy, contact us at privacy@rightspotrental.com.

2. What we collect

Account data: email, password (hashed), name, phone number.
Authentication data: session cookies, IP address at sign-in, device user-agent.
Rental records: your reservations and orders, the rental agreements you sign, pickup and delivery addresses, and notes about your rentals.
Documents and photos you provide: a driver's license for identity verification, insurance certificates where required, and equipment condition photos taken at hand-out and return.
Usage data: pages visited, features used, click events. See "Cookies + tracking" below.
Payment data: we DO NOT store full card numbers. Card details are handled by Stripe; we receive only a token + last-4 + brand. Billing address is stored.
Communications: emails you send us, support requests, and (if you opt in) text messages about your orders.

3. Why we collect it

Under GDPR, our legal bases are:

Contract (Art 6(1)(b)) — to run your reservations and rentals.
Legitimate interest (Art 6(1)(f)) — to keep the service secure, protect our equipment, prevent abuse, and improve features.
Consent (Art 6(1)(a)) — for marketing communications (email + SMS). You can withdraw consent at any time.
Legal obligation (Art 6(1)(c)) — to comply with tax, accounting, and law-enforcement requests.

4. Who we share it with

We share data with the following subprocessors. Each is bound by a data processing agreement.

Fly.io — hosting infrastructure (servers, databases).
MongoDB Atlas — database hosting.
Cloudflare — CDN + DDoS protection + image storage (R2).
Postmark — transactional + marketing email delivery.
Twilio — SMS delivery (when you opt in).
Stripe — payment processing.
PostHog — product analytics (pageviews, feature usage).
Sentry — error reporting (stack traces, request IDs; redacted of PII).
Typesense — search infrastructure.

We don't sell your data. We don't share it with advertisers.

5. How long we keep it

Account data: until you delete your account, plus 30 days for the soft-delete window, plus up to 7 years for tax/legal records.
Rental agreements and condition photos: as long as a claim could arise from the rental, and as required for tax and legal records.
Server logs: 30 days.
Analytics: aggregated indefinitely; individual events 12 months.
Backups: 30 days rolling; deletion requests are honored on the next backup cycle.

6. Your rights

Under GDPR (EU/UK) and CCPA (California), you have the right to:

Access — see what data we have. Use the export tool at Settings → Account.
Export — download a copy of your data in a portable format (JSON archive).
Delete — remove your account and associated data. Use the delete tool at Settings → Account. Some data is retained for legal compliance (anonymized), and signed rental agreements are kept as records of the rentals they document.
Rectify — fix inaccurate details by calling the yard or emailing privacy@rightspotrental.com.
Object — opt out of marketing email with the unsubscribe link in any message, and of SMS by replying STOP to any text.
Restrict processing — contact privacy@rightspotrental.com.
Lodge a complaint — with your local data protection authority. In the UK that's the ICO; in the EU it's the supervisory authority in your member state.

We respond to all requests within 30 days.

7. Cookies + tracking

Essential cookies (auth session) — set without consent because you can't use the service without them.
Analytics cookies (PostHog) — set with consent in the EU/UK; opt-out anywhere else.
No third-party advertising cookies.

8. International transfers

Our servers are in the United States. If you access the service from outside the United States, your data is transferred to and processed there.

9. Changes

We'll update this policy as the product evolves. Material changes are announced by email with at least 14 days' notice. The "last updated" date at the top of this page reflects the most recent change.

10. Contact

Email privacy@rightspotrental.com for any privacy questions, data requests, or to exercise your rights above.

2. What we collect

Account data: email, password (hashed), name, phone number.

Authentication data: session cookies, IP address at sign-in, device user-agent.

Rental records: your reservations and orders, the rental agreements you sign, pickup and delivery addresses, and notes about your rentals.

Documents and photos you provide: a driver's license for identity verification, insurance certificates where required, and equipment condition photos taken at hand-out and return.

Usage data: pages visited, features used, click events. See "Cookies + tracking" below.

Payment data: we DO NOT store full card numbers. Card details are handled by Stripe; we receive only a token + last-4 + brand. Billing address is stored.

Communications: emails you send us, support requests, and (if you opt in) text messages about your orders.

3. Why we collect it

Under GDPR, our legal bases are:

Contract (Art 6(1)(b)) — to run your reservations and rentals.

Legitimate interest (Art 6(1)(f)) — to keep the service secure, protect our equipment, prevent abuse, and improve features.

Consent (Art 6(1)(a)) — for marketing communications (email + SMS). You can withdraw consent at any time.

Legal obligation (Art 6(1)(c)) — to comply with tax, accounting, and law-enforcement requests.

4. Who we share it with

We share data with the following subprocessors. Each is bound by a data processing agreement.

Fly.io — hosting infrastructure (servers, databases).

MongoDB Atlas — database hosting.

Cloudflare — CDN + DDoS protection + image storage (R2).

Postmark — transactional + marketing email delivery.

Twilio — SMS delivery (when you opt in).

Stripe — payment processing.

PostHog — product analytics (pageviews, feature usage).

Sentry — error reporting (stack traces, request IDs; redacted of PII).

Typesense — search infrastructure.

We don't sell your data. We don't share it with advertisers.

5. How long we keep it

Account data: until you delete your account, plus 30 days for the soft-delete window, plus up to 7 years for tax/legal records.

Rental agreements and condition photos: as long as a claim could arise from the rental, and as required for tax and legal records.

Server logs: 30 days.

Analytics: aggregated indefinitely; individual events 12 months.

Backups: 30 days rolling; deletion requests are honored on the next backup cycle.

6. Your rights

Under GDPR (EU/UK) and CCPA (California), you have the right to:

Access — see what data we have. Use the export tool at Settings → Account.

Export — download a copy of your data in a portable format (JSON archive).

Delete — remove your account and associated data. Use the delete tool at Settings → Account. Some data is retained for legal compliance (anonymized), and signed rental agreements are kept as records of the rentals they document.

Rectify — fix inaccurate details by calling the yard or emailing privacy@rightspotrental.com.

Object — opt out of marketing email with the unsubscribe link in any message, and of SMS by replying STOP to any text.

Restrict processing — contact privacy@rightspotrental.com.

Lodge a complaint — with your local data protection authority. In the UK that's the ICO; in the EU it's the supervisory authority in your member state.

We respond to all requests within 30 days.