Rentalee Privacy Notice
Version 1.1 — 30 October 2026
1. Who is responsible
Rentalee is operated by Justo van Doesum, a self-employed business established in Spain, at C/ Alicante 013, ex:1, pl:00, pt:03, 03501 Benidorm, Alicante, Spain. Contact info@rentalplugin.com or use Help / report a problem for privacy questions or requests. We are the controller for the marketplace accounts, booking administration, platform security and records described here. Rental businesses act separately as controllers for their rental fulfilment, customer support, invoices and legal duties. Stripe determines its own processing purposes for its regulated payment, identity and fraud services. We do not appoint a data protection officer merely by publishing this notice.
2. Information we use and where it comes from
You provide account name, email and password; booking item, quantity, dates, times, contact and fulfilment information; messages, reviews and support requests. Passwords are stored as hashes. Sellers provide their public shop profile, address, opening hours, photos, prices, stock, rental conditions, legal identity, EU VAT number and verification information. Authorised rental-manager connections supply the products, business details, rates, inventory and reservation information that you choose to share. We record connection identifiers and protect connection secrets on the server. Stripe supplies account readiness and payment, refund, fee and dispute references; we do not store full payment-card details, online banking credentials or Stripe identity-document images in the marketplace. We also process necessary IP addresses, browser/device information, session identifiers, access/error logs and security events generated when you use the service.
3. Why we use it and our legal bases
We use account and booking information to perform our contract with you or take steps you request before contracting: creating an account, displaying listings, reserving stock, administering payments, changes, cancellations, receipts and support. We process legally required tax, accounting, seller verification, reporting and regulatory records to meet legal obligations. Our legitimate interests are protecting users, preventing fraud and overbooking, investigating complaints, moderating reviews fairly, maintaining reliability and defending legal claims; we balance these interests against your rights and use proportionate safeguards. Optional Google Analytics and precise device location depend on your consent. Marketing requires its own lawful permission and is not included in account registration, booking or review consent. We do not sell personal data.
4. Public information and recipients
Shop details, approved listings, photos and published reviews are public. A review displays the reviewer's first name, ratings, text and publication date, plus the verification label; booking reference and email stay private. Sellers receive the customer and rental details necessary to fulfil their own bookings. A seller cannot see other sellers' customer lists or accounts. Our authorised hosting, storage, email, security and technical support providers process information needed to provide their services. Authorised staff have role-based access; the accountant receives necessary financial and tax records, not unrestricted customer access. We may disclose information to professional advisers, authorities or courts where required or justified for a specific legal matter. Monthly seller statements concern that seller's bookings and are available through its authenticated workspace.
5. Payments and external connections
Stripe receives checkout and payment information and performs its own verification. Seller-direct charges pay the rental business, with our agreed commission separately allocated; this does not make all booking totals Rentalee income. See Stripe's privacy information at https://stripe.com/privacy. EU seller VAT numbers are sent to the European Commission VIES service to verify registration. Explicit address searches send the entered address to the configured address provider (Geoapify where configured, otherwise OpenStreetMap Nominatim). Map tiles are delivered by OpenStreetMap infrastructure and receive ordinary connection information such as IP address and website origin. Do not enter private identity or payment details into address search. Authorising a stock-manager connection permits the agreed catalogue and reservation exchange; it is not permission for unrelated marketing.
6. Location
If you choose Use my location and approve the browser request, we use the returned coordinates to centre the map and find nearby rentals. Search coordinates may be transmitted to Rentalee in the search request; do not share a location-bearing URL if you want to keep it private. You can search by town instead and withdraw location access in your browser. We do not continuously track your movements or publish your device location to sellers. Necessary access logs may contain request details; these are restricted and follow the retention criteria below.
7. Cookies and Google Analytics
Necessary session and security cookies keep you signed in, protect forms and remember essential choices. The configured session lifetime is normally two hours; a selected Remember me option can persist longer until logout or expiry. These are not used for advertising. Your cookie preference is stored locally for up to six months and can be changed through Cookie settings.
We plan to use Google Analytics 4 at launch to understand aggregate use of public marketplace pages. Analytics remains disabled until a measurement ID is configured and you choose Accept analytics. Rejecting is equally available and does not prevent bookings. We use basic consent: no Google Analytics script, analytics cookie or cookieless analytics ping is sent before acceptance. Private account, booking-management, payment, support and administration pages are excluded. Search queries, precise location, names, emails, booking references, form content and connection credentials are not intentionally sent as analytics parameters. Google may process IP addresses and device/browser information when its script is loaded. Advertising features, Google Signals and user-ID tracking are not enabled by our implementation. See https://policies.google.com/privacy and https://support.google.com/analytics/answer/12017362. Analytics cookies are configured for up to six months; the launch configuration must set the shortest suitable event-data retention (planned two months) and disable unwanted enhanced measurement. Consent can be withdrawn at any time in Cookie settings; we stop collection and remove accessible analytics cookies. Previously collected lawful data is not retrospectively invalidated. You can also use browser controls to block cookies.
8. International processing
Some providers, including Google and Stripe, operate internationally and may process information outside the EEA. We use the provider's applicable data-processing arrangements and an appropriate transfer basis, such as an adequacy decision where applicable or standard contractual clauses with the required safeguards. Provider eligibility and the actual hosting/subprocessor locations must be checked before enabling a new service; this notice is not a claim that every provider stores everything in Spain. Ask us for information about the applicable safeguards.
9. How long we keep information
We keep active account and listing information while needed to provide the service. After closure, we remove or anonymise information no longer needed, while retaining the minimum records required for accounting, tax, platform reporting, disputes and legal claims for the applicable statutory periods. We determine the appropriate period by the record type, relevant limitation periods, reporting obligations and any documented legal hold; closing an account does not immediately erase required financial evidence. Operational logs and failed-job records are kept only as long as needed for security and troubleshooting and reviewed for deletion. Published reviews may remain while relevant to the listing; withdrawal removes them from public display, while a restricted moderation record may be retained for disputes and applicable duties. Backups are restricted recovery copies, subject to their rotation and any legal hold; erased data is not reused for ordinary operations and deletion is reapplied after a restore. Contact us for the retention period applicable to a particular record. The launch retention schedule and backup rotation must be recorded before real trading.
10. Your rights and choices
Depending on the circumstances you may request access, correction, erasure, restriction, portability or objection, including objection to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. We may need proportionate identity verification and may retain information where a legal exception applies. Use info@rentalplugin.com or the privacy option under Help / report a problem; do not send passwords, card numbers or unnecessary identity documents. We normally respond within one month, subject to lawful extensions and explanation. You can complain to Spain's AEPD (https://www.aepd.es/) or your competent supervisory authority, and you do not have to contact us first.
11. Required information, decisions and children
We cannot create a booking without the contact and rental information necessary to fulfil it. Sellers cannot trade without the enabled verification and payment requirements. Optional analytics and device location are not required. Availability and payment-readiness checks can automatically prevent an unavailable booking; you can contact support to query an error. We do not use solely automated decisions to make legal or similarly significant assessments about you under this service. Accounts and rentals are intended for adults aged 18 or over, not for collecting children's personal data.
Optional AI assistance
Optional AI assistance uses OpenAI to prepare website setup suggestions, translate public listings and screen listing text and equipment photos. When you request website assistance, we read a limited number of public pages you authorise and send their text and referenced equipment image links to OpenAI. Suggestions are not proof of identity, VAT registration, ownership or legal compliance; you check them before saving. Missing details stay blank, and stock quantities require your confirmation or a verified stock connection. Raw website pages are not kept after processing; encrypted setup suggestions expire within 24 hours after being attached to your business account. We configure this service without voluntarily sharing content for model training; the provider’s processing and retention rules still apply. These features do not require customer bookings, payment records, passwords or identity documents. Automated content screening can publish eligible ordinary equipment from reviewed businesses. Uncertain cases go to human review; AI does not automatically reject a business or certify legality. You can request human review, correction or assistance through our contact page. Translations can contain errors and the original listing remains available.
12. Changes
We publish material changes here and provide an appropriate notice where required. A new privacy notice does not retrospectively create consent for a new purpose. This version describes the implemented marketplace and planned consent-based Analytics configuration.