Privacy Policy

Rentouri is operated by Damian Gadomski, a sole trader (Jednoosobowa Działalność Gospodarcza) registered in Poland under NIP: PL5213819318, with a business address at ul. Zamiany 8/LU202, 02-786 Warszawa (“Rentouri”, “we”, “us”, “our”).

We operate the website rentouri.com and the ERP platform app.rentouri.com.

For any privacy questions, contact us at: [email protected]

When you register as a guest:

• Email address and password (stored as a one-way hash — we cannot read it)
• First and last name
• Phone number — shared with the shop you book with so they can reach you about your rental

When you make a booking:

• Booking details: dates, equipment type, shop location
• Rental agreement e-signature: your typed or drawn signature, signer name, IP address, and browser information — kept as evidence that the agreement was signed
• Payment information — processed by Stripe; we never store card numbers or CVVs. If you save a card, Stripe stores it; we keep only your Stripe customer ID and show the card's brand, last four digits and expiry, read from Stripe. For a booking charged when free cancellation ends, we also keep with the booking the card's brand, last four digits and expiry and Stripe's identifier of the card, to hold and charge it on the dates shown when you booked and to show you and the shop which card will pay
• Your acceptance of the shop's cancellation policy when booking, with its date and time — kept as evidence of what was agreed
• The history of your bookings' cancellations — when each was cancelled, and whether by you, by the shop or because your card could not be charged
• Condition photos of the rented equipment: the photos the shop may take of each item when you pick it up, and the photos you add yourself, while you have the equipment, through the photo link we email you — a record of the equipment's condition, used when damage is reported and as evidence if a card payment is disputed
• Payment requests after a rental: when a shop asks you to pay for damage or a late return, the request, your answer, any note you write, the time and IP address at which you accepted it, and the brand and last four digits of the card you paid with (the card itself is processed by Stripe)
• VAT invoice details, if you ask for a VAT invoice: the company name, VAT number and address you give, which we pass to the shop so it can issue the invoice, and the invoices and receipts the shop shares with you through Rentouri
• Identity verification status — if verification is required, it is processed by Stripe Identity and we receive only a pass/fail result

When you use the platform:

• IP address, browser type, device type
• Pages visited and actions taken (server logs)

When you register as a shop owner:

• Business name, VAT/NIP number and registered address, which go on the invoices Rentouri issues to your business
• For a business registered in another EU country: whether the EU's VIES system confirmed its VAT number, and when
• Bank account details — provided directly to Stripe via their hosted onboarding; we do not store these

When you request a demo:

• Name, email address, phone number (optional), shop name and town
• Your answers on the form: the kind of gear you rent, how many items, and what you use today
• The pricing plan or campaign named in the link that brought you to the form (its utm_* parameters, for example from an ad or our newsletter)

When you subscribe to our newsletter:

• Email address only — no account is required, and subscribing is entirely optional
• Confirmation of your opt-in (timestamp and IP address), kept as proof of consent
• Whether you opened or clicked a newsletter we sent, so we can measure what is worth writing about

When you take part in the referral program:

• Your public name and referral code, shown on your referral page
• For a business that applies, its legal name, NIP or VAT number, address and country, whether VIES confirmed the VAT number, where you plan to share your link and your website
• Your acceptance of the program terms (date, version, IP address)
• The commission you earn, the statements we send you, and the number and payment date of each invoice you send us

When you come through a referral:

• The referral code you sign up or request a demo with
• If you request a demo through a referral link and open an account with the same email address within 12 months, we link the account to that referrer
• The referrer earns a commission on your subscription and sees your shop's name, its plan, whether it pays, and your subscription payments net of VAT with the commission on them; never your contact details

• Process bookings and reserve the equipment you selected
• Process payments and manage refunds, including holding and charging a card saved for a booking on the dates shown when you booked
• Pass the company details you give for a VAT invoice to the shop, and deliver the invoices and receipts the shop shares with you
• Issue Rentouri's invoices to shops through KSeF, and check the EU VAT numbers of shops registered outside Poland
• Limit how many unpaid bookings for overlapping dates one account can hold: 2, or 1 if 3 or more of the account's bookings were cancelled before payment, by you or because your card could not be charged, in the past 12 months
• Answer payment disputes: if you dispute a payment with your bank, we send Stripe, for your card issuer, your name and email address, the booking details, the signed rental agreement with your signature and IP address, the browser information recorded when you signed, your acceptance of the cancellation policy, and the condition photos of the rented equipment, and, for a booking charged later, when your card was saved and the dates and amount you agreed to, and, for a payment you made on a shop's payment request, the request with its photos and when and from which IP address you accepted it
• Send transactional emails: booking confirmation, pickup reminder, return reminder, deposit receipts and damage reports from the shop, the shop's pickup photos with the link to add your own, a notice when no damage was reported after your return, payment requests from a shop after your rental, a reminder, and their outcome, and, for a booking charged when free cancellation ends, a reminder before your card is held, a warning if your card will expire before then, and a notice with a payment link if the hold fails, and the invoices and receipts a shop sends you through Rentouri
• Send our newsletter — roughly monthly, and only if you subscribed and confirmed your address
• Verify your identity where verification is required (Stripe Identity)
• Protect login and registration forms from automated abuse (Google reCAPTCHA)
• Operate, secure, and improve the platform
• Respond to support requests
• Answer demo requests and prepare the call
• Run the referral program: link a sign-up or a demo request to the referral code, give the referred shop its discount, calculate and pay commission, send monthly statements and check the program's exclusions
• Comply with our legal obligations (tax, consumer law, GDPR)

With rental shops: When you make a booking, we share the minimum necessary information with the relevant shop — your name, email address, phone number, booking dates, the equipment you booked and, for a booking charged when free cancellation ends, when it is charged and the brand, last four digits and expiry of the card that will pay, and, for a payment request after your rental, your answer, any note you write and the brand and last four digits of the card you paid with, and, if you ask for a VAT invoice, the company details you give — so they can fulfil the rental and issue your invoice. Shops receive this data as independent data controllers and are contractually prohibited from using it for marketing, contacting you outside the Rentouri platform (except to pursue a claim arising from the rental that you refused or did not answer on Rentouri), or sharing it with third parties.

Condition photos: the photos of the rented equipment — the shop's from pickup and those you add through the photo link — are seen by the shop and by Rentouri, and, if you dispute a card payment, by your card issuer through Stripe.

With your referrer: if you came through a referral, the referrer sees your shop's name, its plan, whether it pays and your subscription payments net of VAT, with the commission on them; never your contact details. A Polish referrer's invoice to us goes through KSeF, as every invoice does.

With our service providers (data processors):

• Stripe, Inc. (USA) — payment processing and identity verification. Data is transferred to the US under Standard Contractual Clauses (SCCs). Stripe Privacy Policy: stripe.com/privacy
• Hetzner Online GmbH (Germany) — server hosting and object storage. Data remains within the EU/EEA.
• Google LLC (USA) — reCAPTCHA, which protects our login and registration forms from automated abuse. Google receives your IP address and browser information when you use those forms. Data is transferred to the US under the EU–US Data Privacy Framework. Google Privacy Policy: policies.google.com/privacy
• OpenFreeMap (map tile rendering) and the OpenStreetMap Foundation / Komoot GmbH (Germany) — map tiles and address search. Map and search requests include your IP address and the place you search for, but no personal booking data.
• Klaviyo, Inc. (USA) — newsletter delivery, for subscribers only. It receives your email address, your opt-in record, and newsletter open/click activity — never your bookings or payment data. Data is transferred to the US under Standard Contractual Clauses (SCCs). Klaviyo Privacy Policy: klaviyo.com/legal/privacy
• Fakturownia (Poland) — issues Rentouri's invoices to shops. It receives a shop's business name, VAT number, address and email, never guest data.
• iFirma (Poland) — issues Rentouri's invoices to shops. It receives a shop's business name, VAT number, address and email, never guest data.

Tax authorities and registers: every invoice Rentouri issues to a shop goes to KSeF, the Polish Ministry of Finance’s e-invoicing system, and the VAT number of a shop registered in another EU country is checked with VIES, the European Commission’s VAT number service.

We do not sell your data. We do not share your data with advertisers.

When you request account deletion, we anonymise all personal data we are not legally required to retain. Anonymised booking records may be kept for aggregate analytics.

You have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Restriction — restrict processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — for any processing based on consent, at any time without affecting the lawfulness of prior processing. For the newsletter, the unsubscribe link at the bottom of every email does this immediately.

To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl.

• Strictly necessary cookies: session management and authentication, including remembering a device you signed in on, so a shop team account is not asked for an emailed sign-in code on it again for 90 days. No consent required — without these the platform cannot function.
• Stripe cookies: set when you interact with the payment form. Required for fraud detection and 3D Secure authentication.
• Google reCAPTCHA cookies: set on the login and registration pages to distinguish people from bots. Google receives your IP address; see policies.google.com/privacy.
• Trips saved on your device: once you sign in, your browser keeps a copy of your upcoming bookings (the shop, its address and phone, the dates, the equipment and the pickup code) so they open without a connection. The copy never leaves your device and is removed when you sign out and once the rental is over.
• Referral links: the code in a referral link is read from the page address to show the referrer's offer and to fill in the sign-up or demo form. Nothing is stored on your device and visits to referral pages are not counted.
• Analytics cookies: we currently do not use third-party analytics. If we introduce analytics in future, we will update this policy and request your consent first.

We apply industry-standard security measures: TLS 1.3 encryption in transit, encrypted storage at rest, least-privilege access controls, and regular security reviews. No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].

Shop team accounts confirm each new device with a code we email to them, and can also sign in with a code from an authenticator app. We keep the secret key of the authenticator app encrypted, the backup codes, and, for each remembered device, a random identifier and the date of its last sign-in. We delete a device record 90 days after that date.

We may update this policy. For material changes, we will notify registered users by email and update the “Last updated” date above. Continued use of the platform after the notification period constitutes acceptance of the revised policy.

• Data controller: Damian Gadomski
• Email: [email protected]
• Address: ul. Zamiany 8/LU202, 02-786 Warszawa
• Supervisory authority: UODO, ul. Stawki 2, 00-193 Warsaw, Poland