Privacy Policy

Last updated: 14 October 2026

This policy explains how MeRents processes your personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

1. Who is responsible for your data

The controller is CloudGate Solutions, S.L. (MeRents), c/ de Espronceda 34-C, piso 1, 28003 Madrid, Spain [TO CONFIRM: registered office and postal address], NIF B19901180. Contact for any privacy question or to exercise your rights: support@merents.app.

2. What data we process

• Account data: name, email address, username, profile photo, language, and the declaration that you act as a private person when you list.
• Listing data: descriptions, photos, prices, availability, the accessories included, whether the Good has a serial number (and, if the Owner records it, the expected serial number), and the location you give for the listing.
• Booking data: dates, status, prices, Service Fee, the booking timeline, and the reviews you write and receive.
• Handover data: the photos, checklists and serial numbers recorded at pickup and return, condition reports, issue reports, claims, and any police report number given to a moderator.
• Payment data: payments are processed by Stripe. We store payment and transfer references, amounts, payment status, refunds, chargebacks and the card fingerprint (an identifier Stripe generates for a card, which does not reveal the card number). We never see or store your full card number. For Owners, Stripe collects the identity and bank details needed to open their Stripe account.
• Tax data of Owners: where the EU DAC7 rules apply, the Owner's name, address, date of birth, tax identification number and income from the Platform.
• Moderation data: reports, moderator cases and decisions, statements of reasons, Strikes, account restrictions and appeals.
• Automated listing analysis data: the photos and text of a listing that the Owner uploaded for publication, and the suggestions generated from them (suggested title, category and accessories, a suggested rental price and an estimated value of the Good with its confidence and flags).
• Messages exchanged between Users on the Platform.
• Technical data: IP address, device and browser information, logs, error reports and, with your consent, analytics data.
• Location data: only when you give it, to place a listing or to search near a location.

3. Why we process your data and on what legal basis

• To provide the Service (account, listings, bookings, payments, handover records, messages, notifications, refunds, payouts, reviews, and moderator decisions on the rental price): performance of the contract (GDPR art. 6(1)(b)).
• To prevent fraud and keep the Platform safe (the checks described in Section 4, Strikes and account restrictions, security and error monitoring): our legitimate interest, and that of our Users, in preventing fraud and misuse (art. 6(1)(f)).
• To comply with the law: accounting and tax obligations, DAC7 reporting to the Spanish Tax Agency, our duties under the EU Digital Services Act (handling notices, statements of reasons, appeals), consumer complaints, and requests from courts and authorities (art. 6(1)(c)).
• To suggest listing details, a rental price and an estimated value by automated analysis of the listing photos and text, and to support price and safety checks on listings: our legitimate interest in helping Owners publish accurate listings and in preventing fraud and misuse (art. 6(1)(f)).
• To support a complaint to the police about a Good that was not returned, and to establish, exercise or defend legal claims: our legitimate interest and that of the Owner (art. 6(1)(f)).
• To send marketing communications and to use functional and analytics cookies: your consent (art. 6(1)(a)), which you can withdraw at any time.

4. Fraud prevention and automated decisions

To protect Users from payment fraud and theft, some decisions are taken automatically:

• a booking is refused, or a payment refunded in full, when the card used is linked to the Owner's own payments or to 3 or more accounts in the last 12 months (we compare card fingerprints);
• a Renter with fewer than 2 completed rentals can have at most 2 bookings in progress, and any Renter can send at most 3 booking requests per hour;
• a Renter whose rented Good is 3 days overdue cannot make new bookings until it is returned or the case is decided;
• a Strike is recorded when an Owner misses the deadline to answer a refused pickup;
• Stripe applies its own fraud screening (Stripe Radar) and may require you to confirm a payment with your bank.

The estimated value and the suggested price produced by the automated analysis of a listing (Section 6) are suggestions: you decide what to publish and at what price, and they produce no legal effects on you. Our staff can review them and correct them.

We tell you when such a decision affects you, and why. You have the right to obtain human review, to express your point of view and to contest the decision: write to support@merents.app and a person who did not take the decision will review it.

5. Who can see your data

• Other Users can see your public profile (name, profile photo, reviews) and your listings, including their approximate location.
• The other party to a booking can see the booking details, your messages, and the handover records (photos, checklists and serial number) of that booking.
• Moderators (people working for MeRents) can see, for a case they handle, the booking timeline, both parties' photos and checklists, and the messages between the parties.

6. Service providers and other recipients

We use the following service providers, who process data on our behalf under a data processing agreement:

• Hetzner Online GmbH (Germany): hosting, database, file storage (listing and handover photos) and backups.
• OpenAI Ireland Limited (Ireland) [TO CONFIRM: the OpenAI entity named in our signed data processing agreement]: automated analysis of listing photos and text to suggest listing details, a rental price and an estimated value. We send the listing photos the Owner uploaded for publication (downscaled) and the listing text, never condition, handover or issue photos. OpenAI does not retain the data (zero data retention) [TO CONFIRM: zero data retention approved for our account]; the estimate is kept with the listing.
• Brave Software, Inc. (United States), Brave Search API: web search of prices for the estimated value. We send only product names (search queries), never photos or personal data [TO CONFIRM: transfer mechanism, EU-US Data Privacy Framework or standard contractual clauses].
• Resend (United States): delivery of transactional emails [TO CONFIRM: transfer mechanism, EU-US Data Privacy Framework or standard contractual clauses].
• MapTiler AG (Switzerland): map display [TO CONFIRM: map tiles provider], and [TO CONFIRM: geocoding provider and its location] to convert addresses into map positions.
• [TO CONFIRM: error monitoring provider, either self-hosted on Hetzner (GlitchTip) or Functional Software, Inc. (Sentry), United States, under the EU-US Data Privacy Framework.]
• [TO CONFIRM: push notifications for the mobile app through Expo (650 Industries, Inc., United States).]
• [TO CONFIRM: Google Analytics (Google Ireland Limited), only if analytics cookies are used and you consent.]

Stripe (Stripe Payments Europe, Limited, Ireland) processes payments, payouts and fraud screening as an independent controller. See Stripe's Privacy Policy.

We also share data with the Spanish Tax Agency (DAC7 reporting), and with the police, courts and other authorities when they request it under the law.

We do not sell your data.

7. International transfers

Most of your data are stored in the European Economic Area (EEA). When a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission (for example for Switzerland, or for US companies certified under the EU-US Data Privacy Framework) or on the standard contractual clauses approved by the Commission.

8. How long we keep your data

• Account data: while your account is open. When you close it, we delete or anonymise it within 30 days, except the data we must keep for the reasons below.
• Payment and transaction data, including card fingerprints: 5 years after the last transaction, for tax, accounting and legal obligations. Card fingerprints are used for the fraud checks in Section 4 for 12 months only.
• Booking, handover and case data (photos, checklists, serial numbers, issue reports, moderator cases and decisions): 5 years after the end of the booking, the limitation period for contractual claims [TO CONFIRM: retention applied by the deletion job].
• Valuation estimates (estimated value, suggested price, confidence and the sources used): with the listing, and deleted with it. The providers in Section 6 do not retain the data we send.
• Messages: 2 years after the account is closed.
• DAC7 data: for the period required by tax law [TO CONFIRM: retention period under the DAC7 rules].
• Technical logs: [TO CONFIRM: log retention period].
• Account deletion requests are carried out within 30 days. Some data may be kept for the legal reasons above.

9. Your rights

You have the right to access, rectify and erase your data, to object to and restrict its processing, to data portability, to withdraw your consent at any time, and not to be subject to a decision based solely on automated processing without human review (Section 4). You can also download your data or ask for your account to be deleted from your account settings.

To exercise your rights, write to support@merents.app. You can also complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or to the data protection authority of the country where you live.

10. Security

We apply technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, restricted access controls, private storage for handover photos, and regular security reviews.

11. Cookies

We use the cookie categories shown in our cookie banner: essential cookies, which the site needs to work and which do not require consent, and functional, analytics and marketing cookies, which we use only with your consent. We do not use marketing cookies at present. You can change your choice at any time in the cookie preferences. See our Cookie Policy.

12. Changes to this policy

We may update this policy when our processing changes. We will tell you about significant changes by email or in the app.