Privacy Policy

Last updated: 2026-10-02

1. Who we are

This website is operated by Right Spot Rental LLC of Hudson, Wisconsin. If you have questions about this policy, contact us at privacy@rightspotrental.com.

2. What we collect

• Account data: email, password (hashed), name, phone number.
• Authentication data: session cookies, IP address at sign-in, device user-agent.
• Rental records: your reservations and orders, the rental agreements you sign, pickup and delivery addresses, and notes about your rentals.
• Documents and photos you provide: a driver's license for identity verification, insurance certificates where required, and equipment condition photos taken at hand-out and return.
• Equipment telematics: some rental equipment carries GPS or telematics devices. While it's rented to you, we may collect its location, movement, engine hours, and usage data — to find and protect our equipment, verify hours and charges, and investigate theft or misuse. Your rental agreement describes this; it isn't a safety or emergency service and isn't monitored in real time.
• Usage data: pages visited, features used, click events. See "Cookies + tracking" below.
• Payment data: we DO NOT store full card numbers. Card details are handled by Stripe; we receive only a token + last-4 + brand. Billing address is stored.
• Communications: emails you send us, support requests, and (if you opt in) text messages about your orders.

3. Why we collect it

Under GDPR, our legal bases are:

• Contract (Art 6(1)(b)) — to run your reservations and rentals.
• Legitimate interest (Art 6(1)(f)) — to keep the service secure, protect our equipment, prevent abuse, and improve features.
• Consent (Art 6(1)(a)) — for marketing communications (email + SMS), and for analytics cookies in the EU/UK. You can withdraw consent at any time.
• Legal obligation (Art 6(1)(c)) — to comply with tax, accounting, and law-enforcement requests.

4. Who we share it with

We share data with the following subprocessors. Each is bound by a data processing agreement.

• Fly.io — hosting infrastructure (servers, databases).
• MongoDB Atlas — database hosting.
• Cloudflare — CDN + DDoS protection + image storage (R2).
• Postmark — transactional + marketing email delivery.
• Twilio — SMS delivery (when you opt in).
• Stripe — payment processing.
• PostHog — product analytics (pageviews, feature usage).
• Google Analytics — website traffic measurement (pages visited, how you arrived, device and approximate location). Google's advertising features are switched off.
• Sentry — error reporting (stack traces, request IDs; redacted of PII).
• Typesense — search infrastructure.

Beyond subprocessors: we may share equipment telematics data with law enforcement in connection with theft or unauthorized use, and with our insurer in connection with a claim.

We don't sell your data. We don't share it with advertisers.

Mobile information — the phone number you give us and your consent to be texted — is never shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party.

We use your number only to send the messages you asked for: updates about a rental you hold or a question you asked us, and marketing only where you separately opted in. Message frequency varies by what you have out with us. Message and data rates may apply. Reply STOP to any text to stop them, or HELP for help. See the messaging terms for the full program terms.

5. How long we keep it

• Account data: until you delete your account, plus 30 days for the soft-delete window, plus up to 7 years for tax/legal records.
• Rental agreements and condition photos: as long as a claim could arise from the rental, and as required for tax and legal records.
• Equipment telematics: 12 months, or longer where tied to an unresolved charge, claim, or investigation.
• Server logs: 30 days.
• Analytics: aggregated indefinitely; individual events 12 months.
• Backups: 30 days rolling; deletion requests are honored on the next backup cycle.

6. Your rights

Under GDPR (EU/UK) and CCPA (California), you have the right to:

• Access — see what data we have. Use the export tool at Settings → Account.
• Export — download a copy of your data in a portable format (JSON archive).
• Delete — remove your account and associated data. Use the delete tool at Settings → Account. Some data is retained for legal compliance (anonymized), and signed rental agreements are kept as records of the rentals they document.
• Rectify — fix inaccurate details by calling the yard or emailing privacy@rightspotrental.com.
• Object — opt out of marketing email with the unsubscribe link in any message, and of SMS by replying STOP to any text.
• Restrict processing — contact privacy@rightspotrental.com.
• Lodge a complaint — with your local data protection authority. In the UK that's the ICO; in the EU it's the supervisory authority in your member state.

We respond to all requests within 30 days.

7. Cookies + tracking

• Essential cookies (auth session) — set without consent because you can't use the service without them.
• Analytics cookies (PostHog, and Google Analytics's _ga cookies). If your device is set to a European time zone, including the UK, none are set until you choose Allow. Everywhere else they are on by default and you can turn them off. If your browser sends a Global Privacy Control signal, they stay off. Change your choice at any time with "Cookie settings" at the bottom of every page.
• Email — our emails, booking and offers alike, record when they are opened, and offers may record which links you click. Every offer has an unsubscribe link that works in one click. Unsubscribing stops offers, not the emails about your rentals.
• No third-party advertising cookies.

8. International transfers

Our servers are in the United States. If you access the service from outside the United States, your data is transferred to and processed there.

9. Changes

We'll update this policy as the product evolves. Material changes are announced by email with at least 14 days' notice. The "last updated" date at the top of this page reflects the most recent change.

10. Contact

Email privacy@rightspotrental.com for any privacy questions, data requests, or to exercise your rights above.