Privacy Policy

Privacy Policy

Last Updated: October 14, 2026 | Effective Date: October 14, 2026 | Version: 2.5

📋 CHANGES IN VERSION 2.5

• Section 8 (Data Security) corrected: card payments are handled by Stripe, a PCI DSS Level 1 provider, and RentalTide itself is not PCI DSS certified. Security testing is internal; RentalTide has not had an independent third-party audit. "Employee training" is replaced by the confidentiality obligations that apply to everyone with access

📋 CHANGES IN VERSION 2.4

• Rewrote Section 4.4 (now "Identity Images and Biometric Information") to cover the identity images RentalTide itself handles: photos taken while a waiver is signed, licence and ID images, and the AI comparison of a licence photo with those photos
• Added where identity images are stored (Sydney, Australia for Australian rental locations; the United States otherwise) and who can open them
• Added identity images to Section 4.1

📋 CHANGES IN VERSION 2.3

• Added Section 4.4 (Biometric Information) clarifying that facial verification is performed by Stripe Identity and that we receive only verification results, including BIPA and other U.S. biometric-law notice
• Added Section 10.6 (Quebec residents, Law 25), Section 10.7 (other U.S. state privacy laws), and Section 10.8 (New Zealand residents, Privacy Act 2020)
• Linked the new Messaging & Communications Consent policy for SMS/email consent and opt-out
• Clarified that we never sell data and that our advertising/analytics tools are used only for our own marketing measurement, with a Global Privacy Control (GPC) opt-out (Sections 6.5 and 11)

📋 CHANGES IN VERSION 2.2

• Added explicit "We do not sell your data" commitment (preamble + Section 6.5)
• Expanded Section 5.3 with AI training masking measures and opt-out
• Updated CCPA table (Section 11) to reflect that we do not sell or share personal information for targeted advertising
• See the standalone AI Usage and Data Commitment page for the full AI policy

📋 CHANGES IN VERSION 2.1

• Added Section 10.4 (Canadian Residents - PIPEDA rights)
• Added Section 10.5 (Australian Residents - Privacy Act 1988 rights)
• Added protection product data to Section 4.1

---

OUR COMMITMENT: WE DO NOT SELL YOUR DATA

RentalTide does not sell, rent, or trade your personal information to third parties for their own commercial purposes, and we never will. We do not share your data with advertisers, marketers, or data brokers. If our business model ever changes, this policy will be updated in advance and you will be notified directly. See Section 6.5 for the full commitment.

PRIVACY NOTICE

This Privacy Policy describes how RentalTide Inc. and its affiliates ("RentalTide," "we," "us," or "our") collect, use, share, and protect your personal information. By using our Services, you agree to the collection and use of information in accordance with this policy.

1. Introduction

RentalTide Inc. (Delaware), a Delaware corporation, and RentalTide Inc. (Canada), a Canadian corporation (Business Number 783525165) (together "RentalTide," "we," "us," or "our"). The two companies share a name but are separate legal persons, and the one responsible to you is the one that contracts with you under Section 1.2 of the Terms of Service. RentalTide operates a SaaS booking and point-of-sale platform for asset rental businesses. Our corporate offices are located at 110 Didsbury Road, Ottawa, Ontario, K2T 0C2, Canada, and 1111B S Governors Ave STE 48363, Dover, DE 19904, United States.

This Privacy Policy applies to all personal information collected through our website (www.rentaltide.com), our application (app.rentaltide.com), mobile applications, APIs, and all related services (collectively, the "Services").

2. Scope and Application

This Policy applies to:

• Visitors to our website
• Rental operators using our platform ("Operators")
• Customers making bookings ("Renters")
• Business partners and their representatives
• Any individual whose personal information we process

Important Distinction: When Operators process their customers' data through our platform, they act as independent data controllers. Operators are responsible for their own privacy compliance and must publish their own privacy policies.

3. Data Controller

RentalTide Inc. is the data controller for personal information processed under this Privacy Policy. For questions about data processing, contact our Data Protection Officer at privacy@rentaltide.com

3.1 Representatives in the EU, UK and Switzerland

RentalTide is established in Canada and the United States. Where we offer services to individuals in the European Union, the United Kingdom or Switzerland, we designate local representatives under GDPR Article 27, UK GDPR Article 27 and Swiss FADP Article 14 respectively. Their names and postal addresses are published in our GDPR Compliance document.

Contacting a representative is an option, not a requirement, you may always contact us directly at privacy@rentaltide.com, and you may always complain to your own supervisory authority.

3.2 Our Role for Merchant Data

For personal information that a rental operator ("Merchant") collects from their own customers through RentalTide, the Merchant is the controller and RentalTide is the processor, acting on the Merchant's documented instructions under our Data Processing Agreement. For our own account, billing, security and platform-improvement processing, RentalTide is the controller. Where the two overlap on the same record, each party is responsible for its own purposes.

3.3 Quebec, Person in Charge of Protection of Personal Information

Under Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the person in charge of the protection of personal information is our Chief Privacy Officer, reachable at privacy@rentaltide.com or at our Ottawa address in Section 13. You may address access, rectification, de-indexing, portability and automated-decision requests to that person, and you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

4. Information We Collect

4.1 Information You Provide

• Account Information: Name, email, phone number, business name, address
• Verification Data: Government ID, business registration, tax information, licenses
• Identity Images: Photos of government ID, driver's and boating licences, and photos of a person taken while they sign a waiver or check in (see Section 4.4)
• Financial Information: Bank account details, credit card information, billing address, tax ID
• Booking Data: Reservation details, rental history, customer preferences
• Protection Product Data: Optional protection selections, waiver acknowledgments, claim information
• Communications: Support tickets, emails, chat messages, phone recordings
• User Content: Photos, reviews, feedback, waiver signatures

4.2 Information We Collect Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, click paths, session duration
• Location Data: GPS coordinates (mobile), IP-based location
• Cookie Data: See our Cookie Policy for details
• Log Data: Server logs, error reports, performance metrics

4.3 Information from Third Parties

• Payment Processors: Transaction details from Stripe
• Identity Verification: ID verification results from Stripe Identity
• Business Information: Public records, credit bureaus, sanctions lists
• Marketing Partners: Lead information, referral data

4.4 Identity Images and Biometric Information

Rental businesses that use RentalTide (our "merchants") can collect images that identify a person. The merchant decides which of these to use and controls the images it collects; RentalTide stores and processes them on the merchant's behalf.

What is collected

• Waiver signing photos. If a merchant turns the feature on, the waiver page takes a small number of photos of the person signing, using the device's camera, as evidence of who signed. The page tells the signer before it starts, and the browser asks for permission to use the camera.
• Licence and ID images. Photos of a driver's licence, boating licence or other government ID, provided by the renter during waiver signing, self check-in or a booking's "next steps", or taken by the merchant's staff at check-in or attached to the renter's profile.
• Identity verification through Stripe. Some flows use Stripe Identity, which may capture a photo of a government ID and a selfie and perform a facial-similarity (biometric) check to confirm the document belongs to the person. Stripe performs that matching and processes those images under Stripe's privacy policy and its biometric notices. From Stripe we receive the verification result, the extracted identity data (such as name, date of birth, document type and number, and expiry) and a fraud signal.

AI comparison of a licence photo

When a merchant uses licence verification, we send the licence photo, together with the waiver signing photos or the selfie taken at self check-in, to our AI service provider (OpenAI, listed on our Sub-Processors page) to assess whether they show the same person. We store the result (match or no match, a confidence level and a short reason). A likely mismatch marks the renter's record for the merchant's staff to review and counts as a risk signal in the information shown to the merchant. It does not by itself cancel or refuse a rental. We do not create or store a facial-recognition template, and the AI provider's agreement with us does not allow it to use these images to train its models.

Where they are stored and who can open them

• Identity images are kept in private storage that is not publicly accessible. They can be opened only by the signed-in staff of the merchant that collected them, and by RentalTide personnel where needed to support that merchant or keep the service secure, through links that expire after 15 minutes. A renter can open their own signed waiver through a personal link sent to them.
• For rental locations in Australia, identity images are stored in Amazon Web Services' Sydney, Australia region. For all other locations they are stored in the United States.

Purpose and limits

Identity images and any biometric data are used only to identify the person renting, to keep evidence of who signed and checked in, to prevent fraud and to handle disputes and claims. We do not use them for advertising, profiling or any unrelated purpose, and we never sell them.

Retention

Identity images are kept with the waiver, booking or customer record they belong to, for as long as the merchant keeps that record and as long as the law requires us to keep it. A merchant can ask us to delete them, and you can make a request to the merchant or to us under Section 10.

U.S. biometric laws

Where the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier law (CUBI) or Washington's biometric law applies, biometric data is collected with notice and consent, used only for the purposes above, and retained no longer than those laws allow. You may decline biometric verification, though the merchant may then be unable to complete identity checks it requires before a rental.

5. How We Use Your Information

5.1 Service Provision (Contractual Necessity)

• Process bookings and payments
• Manage operator accounts and dashboards
• Provide customer support
• Execute rental agreements and waivers
• Enable communication between operators and renters

5.2 Legal Compliance

• Anti-money laundering (AML) and Know Your Customer (KYC) checks
• Tax reporting and withholding
• Responding to legal requests and court orders
• Enforcing our terms and policies
• Protecting against fraud and illegal activities

5.3 Legitimate Business Interests

• Improving our Services through analytics
• Developing new features and products
• Sending service-related communications
• Preventing fraud and ensuring security
• Training our internal AI and machine learning models (see Section 5.3.1)
• Business transfers and corporate transactions

5.3.1 AI and Machine Learning Training

We use limited, masked data to train and evaluate our own internal AI features (docs chatbot, pricing recommendations, fraud detection, support routing, and similar). When we do so:

• Personally identifiable information is removed or redacted before data reaches any training pipeline. This includes names, email addresses, phone numbers, physical addresses, payment card numbers, bank account details, waiver signatures, government identifiers, and IP/device identifiers.
• Free-text fields (notes, messages, support transcripts) are reviewed and redacted of identifying detail before use.
• Financial figures are used in aggregate or scaled form and are never tied back to a specific customer.
• We use the minimum data needed to accomplish a specific improvement. We do not perform bulk training dumps.
• Your data is never sold, licensed, or shared with third-party AI providers for them to train their own models. When we use foundation-model APIs to power product features, we do so under enterprise agreements that prohibit those providers from using your data to train their own models.

Opt-out: You can opt your business out of internal AI training at any time by emailing privacy@rentaltide.com with the subject "AI training opt-out." We will exclude your data from all future training and evaluation runs within thirty (30) days and confirm in writing. Opting out has no effect on the quality of service you receive.

For the full policy see AI Usage and Data Commitment.

5.4 With Your Consent

• Marketing communications and newsletters
• Promotional offers and campaigns
• Participation in surveys and research
• Measuring the performance of our own marketing campaigns

How SMS, email, and voice consent works, and how to opt out at any time (reply STOP, unsubscribe, or update your preferences), is described in our Messaging & Communications Consent policy.

6. How We Share Information

We may share your information with:

6.1 Service Providers:

• Stripe (payment processing, identity verification)
• AWS (cloud hosting)
• Intercom (customer support)
• Google Analytics (analytics)
• SendGrid (email delivery)

6.2 Business Partners:

• Operators (for bookings on their assets)
• Integration partners (with your consent)
• Insurance providers (for coverage claims)
• Marketing affiliates (referral programs)

6.3 Legal and Compliance:

• Law enforcement agencies
• Courts and tribunals
• Tax authorities
• Regulatory bodies
• Legal advisors

6.4 Corporate Transactions:

In case of merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. In such an event, this Privacy Policy will continue to govern the use of that information, or you will be notified of any new policy that materially differs.

6.5 What we will never do: No sale of personal information

We do not sell, rent, lease, or trade your personal information to third parties for their own commercial purposes, and we never will.

Specifically, we do not:

• Sell customer lists, booking histories, payment data, or any other personal information to data brokers, marketers, or advertisers.
• Hand your personal information to a third party so that the third party can run its own advertising or build profiles to sell.
• Allow third parties to use your data to train their own AI or machine-learning models.
• Receive any compensation from third parties in exchange for access to your personal information.

We do use Google Analytics and our own advertising pixels (Google Ads, Meta) to measure and improve our own marketing. Under the CPRA's broad definition this can count as "sharing," so we provide an opt-out and honor Global Privacy Control (GPC) signals (see Section 11). We never share your data for any third party's own advertising.

This commitment is in addition to, and stronger than, the minimum required by CCPA/CPRA, GDPR, and other applicable privacy laws. If our business model ever changes, we will update this Policy at least thirty (30) days before any change takes effect and notify you directly by email.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including Canada, the United States, and other countries where our service providers operate.

We ensure appropriate safeguards through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules for intra-group transfers
• Your explicit consent where required

8. Data Security

We implement industry-standard security measures including:

• 256-bit SSL/TLS encryption for data in transit
• AES-256 encryption for data at rest
• Card payments handled by Stripe, a PCI DSS Level 1 certified provider (we do not store full card numbers)
• Periodic internal security reviews and penetration tests
• Access controls and authentication requirements
• Confidentiality obligations for everyone with access to personal data

Security Disclaimer: No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You use our Services at your own risk.

9. Data Retention

We retain personal information for as long as necessary to:

• Provide our Services
• Comply with legal obligations (typically 7 years for financial records)
• Resolve disputes and enforce agreements
• Maintain security and prevent fraud

Specific retention periods:

• Account data: Duration of account plus 2 years
• Transaction records: 7 years
• Marketing data: Until consent withdrawn
• Cookie data: See Cookie Policy
• Support communications: 3 years

10. Your Privacy Rights

10.1 Rights for All Users

• Access your personal information
• Correct inaccurate data
• Delete your account and data (subject to legal requirements)
• Opt-out of marketing communications
• Request information about our data practices

10.2 Additional Rights for EEA/UK Residents (GDPR)

• Data portability (receive your data in a structured format)
• Restrict processing of your data
• Object to processing based on legitimate interests
• Withdraw consent at any time
• Lodge a complaint with supervisory authorities

10.3 Additional Rights for California Residents (CCPA/CPRA)

• Know what personal information we collect and how it's used
• Request deletion of personal information
• Opt-out of "sale" or "sharing" of personal information
• Non-discrimination for exercising rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

10.4 Additional Rights for Canadian Residents (PIPEDA)

• Access your personal information held by us
• Challenge the accuracy and completeness of your data
• Withdraw consent (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada

10.5 Additional Rights for Australian Residents (Privacy Act 1988)

• Access your personal information
• Request correction of inaccurate data
• Complain about privacy breaches to the Office of the Australian Information Commissioner (OAIC)
• Opt-out of direct marketing at any time
• Request information about overseas disclosure of your data

10.6 Additional Rights for Quebec Residents (Law 25)

Under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, you have the right to:

• Be informed when we collect your personal information and the purposes for it
• Access and request correction of your personal information
• Request de-indexing or deletion of personal information in certain circumstances
• Data portability, receive computerized personal information in a structured, commonly used format
• Be informed of, and request a review of, decisions based exclusively on automated processing (see our AI Usage and Data Commitment)
• Withdraw consent, subject to legal or contractual restrictions
• Lodge a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca

Our Privacy Officer is responsible for our compliance and can be reached at privacy@rentaltide.com.

10.7 Additional Rights for Other U.S. State Residents

If you reside in a U.S. state with a comprehensive privacy law, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, and others as they take effect, you have rights comparable to those in Section 10.3, which we extend to you, including the right to:

• Confirm whether we process your personal data and access it
• Correct inaccuracies and request deletion
• Obtain a portable copy of your data
• Opt out of targeted advertising, the "sale" of personal data, and certain profiling (we do not sell personal information or use it for targeted advertising, see Section 6.5)
• Appeal a denial of a rights request, and contact your state Attorney General

To exercise these rights, email privacy@rentaltide.com.

10.8 Additional Rights for New Zealand Residents (Privacy Act 2020)

• Access and request correction of your personal information
• Receive notice of a privacy breach likely to cause serious harm
• Request information about overseas disclosure of your data
• Complain to the Office of the Privacy Commissioner (privacy.org.nz)

See our dedicated New Zealand Privacy Compliance page for full details.

11. California Privacy Rights (CCPA/CPRA)

This section applies only to California residents. We have collected the following categories of personal information in the last 12 months:

*We never sell your personal information. "Limited" reflects that we use Google Analytics and our own advertising pixels (Google Ads, Meta) to measure our own marketing, which can count as "sharing" for cross-context behavioral advertising under the CPRA. We do not share your data for any third party's own advertising.

Do Not Sell or Share My Personal Information

RentalTide does not sell your personal information. We use Google Analytics and our own advertising pixels (Google Ads, Meta) to measure and improve our own marketing. To the extent this is "sharing" for cross-context behavioral advertising under the CPRA, you can opt out at any time by:

• Adjusting your cookie settings or using the provider opt-out links in our Cookie Policy,
• Sending a Global Privacy Control (GPC) signal, which we honor, or
• Emailing privacy@rentaltide.com.

We never share your data with any third party for that third party's own advertising. If you have any concern that we may have sold or shared your information contrary to this commitment, email privacy@rentaltide.com and we will investigate within thirty (30) days.

12. Children's Privacy

Our Services are not intended for children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will promptly delete such information.

13. Contact Us

For privacy-related inquiries:

Data Protection Officer:
Email: privacy@rentaltide.com

General Privacy Inquiries:
Email: legal@rentaltide.com

Mailing Addresses:

Canada: RentalTide Inc. Attn: Privacy Department 110 Didsbury Road Ottawa, Ontario K2T 0C2 Canada

United States: RentalTide Inc. Attn: Privacy Department 1111B S Governors Ave STE 48363 Dover, DE 19904 United States

Phone: (888) 709-2650

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending email notification for material changes
• Obtaining consent where required by law

---