Privacy Policy

Account information. Email address, password (stored only as a salted hash by our authentication provider, never in readable form), display name, and — if you provide them — full name, phone number, profile photo, bio, city, country, and website. If you sign in with Google or Apple, we receive your email address, name, and profile photo from that provider.

Authentication data. Session tokens, sign-in timestamps, and, if you enable it, two-factor authentication (time-based one-time passcode) enrollment data. Administrators of the Platform are required to use two-factor authentication.

Listing information. Titles, descriptions, categories, photos, pricing, add-on services, availability calendars, replacement values, security deposit amounts, and pickup details — including a pickup address, pickup window, and pickup notes that you enter. Host profiles may also store a default pickup address applied to new listings.

Booking information. Requested dates and durations, rental amounts, deposit and balance status, add-on selections, purchase order numbers you enter for business rentals, cancellation and completion timestamps, and pickup/return check-in records.

Messages. In-app messages exchanged between a Host and a Renter about a specific booking, including timestamps and read receipts.

Condition photos. Photos and notes uploaded at pickup and return to document the condition of an asset.

Reviews and ratings. Scores and written comments you submit about a listing or about the other party to a rental.

Insurance information. If you choose to save a policy, we store the insurer name, policy number, policy holder name, coverage amount, expiration date, and any document file you upload (for example a certificate or declarations page).

Identity documents. The Platform does not currently require or run an automated identity or driver's-license verification process, and there is no dedicated driver's-license upload. Do not upload identity documents unless we specifically ask for them. If a document you upload to the insurance section happens to contain identity details, it is stored under the same private, owner-only controls described in Section 5.

Payment information. Payments are processed by Stripe. Card numbers, CVC codes, and bank details are entered directly into Stripe's hosted checkout and are never transmitted to or stored on our servers. We store payment-related identifiers and status only: Stripe customer ID, checkout session IDs, payment intent IDs for security-deposit authorizations, subscription and price/product identifiers, subscription status and billing period dates, amounts, currency, and paid/pending status. Your email address is passed to Stripe so it can send receipts. Stripe's own handling of your payment data is governed by Stripe's privacy policy.

Support and legal records. Emails you send us, dispute and damage-claim submissions, and records of agreements you accept (document name, version, timestamp, and — where captured — IP address and browser user agent).

Technical data. Standard server and platform logs generated by our hosting and database providers, including IP address, browser and device type, requested pages, timestamps, and error traces used to diagnose failures.

We distinguish between several kinds of location data:

• Listing location — the city, area, or ZIP code a Host enters for a listing. This is shown publicly on the listing.
• Pickup and return location — a specific address a Host sets on their profile or an individual listing. Full pickup addresses are used to facilitate confirmed bookings and are shared with the Renter for that booking, not with the general public.
• User-provided search location — the text you type into search filters.
• Device GPS — the Platform does not currently request your device's precise geolocation, and we do not collect GPS coordinates from your browser or phone.
• Telematics / asset tracking — we do not currently operate or receive GPS or telematics data from vehicles or equipment. Some Hosts may independently use their own tracking devices on their own assets; that is their activity, not ours. If we ever integrate a telematics provider, we will update this Policy and describe what is collected before that data flows through the Platform.

Approximate location may also be inferred from your IP address in standard server logs, as is typical for any website.

• Create and secure accounts, authenticate sessions, and support two-factor authentication.
• Operate the marketplace — publish listings, run search and availability, process booking requests, and connect Hosts and Renters.
• Process payments, deposits, security-deposit authorizations, subscriptions, refunds, and Host payouts through Stripe.
• Send transactional email such as account, booking, and security messages.
• Generate receipts, rental records, and the Rental Agreement applicable to a booking.
• Support customers, investigate damage claims, and resolve disputes between Hosts and Renters.
• Detect and prevent fraud and abuse, enforce our Terms, and protect the safety of users and the Platform.
• Diagnose errors, monitor reliability, and improve the Platform.
• Meet tax, accounting, and other legal obligations.
• Send optional marketing messages where you have opted in; you can unsubscribe at any time.

We use an AI service to help generate draft listing descriptions from listing photos and details you submit. That content is listing content, not personal profile data, and the drafts are always yours to edit before publishing.

Visible to other users and, in some cases, the public:

• Display name and profile photo
• Account creation date, completed-rental count, and cancellation count
• Ratings and reviews you write or receive
• Verified badge and subscription tier
• Listing content, photos, pricing, availability, and the general listing location

Shared only with the other party to a specific booking: in-app messages, condition photos and notes, the exact pickup address and pickup window, pickup instructions, and booking details necessary to complete the rental. Contact details are exchanged to the extent needed to coordinate handoff.

Not visible to other users:

• Email address and password
• Phone number outside of a confirmed booking context
• Saved insurance records and uploaded insurance documents — these are readable only by the account that uploaded them
• Payment identifiers, subscription records, and billing history
• Any identity document you have uploaded
• Your personal address, where it is not the pickup address of a confirmed booking

Platform administrators employed by T1 Ventures can access account and booking records to provide support, investigate abuse, and meet legal obligations.

We use reasonable administrative, technical, and organizational safeguards, including:

• TLS encryption for data in transit, and encryption at rest provided by our hosting and database infrastructure.
• Passwords stored only as salted hashes by our authentication provider; we never see or store your password.
• Optional two-factor authentication for user accounts, and mandatory two-factor authentication for administrators.
• Row Level Security enabled on our database tables, with policies scoped so that users can read and write only their own records or records for bookings they are a party to.
• Private (non-public) storage buckets for listing photos, condition photos, and insurance documents. These files are not served from public URLs; access requires an authenticated, permission-checked request, and insurance documents are restricted to the uploading account.
• Service-role and administrative database credentials kept server-side only and never exposed to the browser.
• Webhook signature verification on payment callbacks so payment status cannot be forged.

No system can be guaranteed completely secure, and we do not promise absolute security. Use a strong, unique password, enable two-factor authentication, and tell us promptly at Support@SourcedRentals.com if you believe your account has been compromised.

We share personal information with service providers and other parties where it is necessary to operate the Platform, comply with law, or protect people. We do not sell personal information, and we do not share it for cross-context behavioral advertising. Categories of recipients:

• Payments — Stripe, for checkout, deposits, security-deposit authorizations, subscriptions, refunds, and Host payouts.
• Hosting, database, storage, and authentication — our cloud infrastructure providers, which store account records, listings, bookings, messages, and uploaded files, and which handle sign-in, password hashing, and session management.
• Sign-in providers — Google and Apple, if you choose to sign in with them.
• Email delivery — our managed transactional email provider, which sends account and booking email from notify.sourcedrentals.com.
• AI listing assistance — an AI model provider that processes listing photos and details you submit to draft a listing description.
• Error monitoring — application error and log data used to diagnose failures.
• Other users — Hosts and Renters, as described in Section 4, to the extent needed to complete a rental.
• Professional advisors — accountants, insurers, and legal counsel, under confidentiality obligations.
• Legal, safety, and compliance — courts, regulators, tax authorities, or law enforcement in response to a valid legal request, or where necessary to investigate fraud or protect the rights, property, or safety of any person.
• Business transfers — a successor entity if Sourced Rentals is acquired, merged, or reorganized, subject to this Policy.

We do not currently use Google Analytics, advertising pixels, conversion-tracking tags, or third-party marketing trackers on the Platform. We do not currently use an SMS provider or a third-party identity-verification vendor. If that changes, we will update this Policy.

The Platform uses a deliberately small set of technologies:

• Strictly necessary — cookies and browser storage used to keep you signed in, maintain your session, and protect against abuse. The Platform will not work correctly without these.
• Functional — browser storage used to remember preferences such as items you have added to a bundle before checkout.
• Payment — cookies set by Stripe within its embedded checkout, used for payment processing and fraud prevention.
• Error and performance logging — server-side logs and client error reports used to diagnose problems.

We do not currently set advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; blocking strictly necessary cookies will prevent sign-in. We do not currently respond to Global Privacy Control or "Do Not Track" signals differently, because we do not sell or share personal information for advertising.

We keep information for as long as reasonably necessary for the purposes described in this Policy — providing the marketplace, completing and documenting transactions, customer support, fraud prevention, safety, dispute resolution, tax and accounting requirements, legal compliance, security, and other legitimate business purposes. In practice:

• Account and profile records — kept while your account is active.
• Booking, payment, and receipt records — kept after a rental ends for as long as needed for tax, accounting, and dispute purposes. U.S. tax record-keeping generally makes several years appropriate.
• Messages and condition photos — kept for the life of the associated booking record, because they are the primary evidence in a damage or dispute claim.
• Insurance records and uploaded documents — kept until you delete them, or until your account is deleted. You can remove a saved policy and its document at any time from your account.
• Agreement acceptance records — kept as long as needed to evidence the agreement you accepted.
• Technical logs — kept on a short rolling basis by our infrastructure providers.

When you delete your account, we delete your profile and remove or anonymize associated personal information, except records we must retain for legal, tax, security, or dispute reasons, and except records held by Stripe under its own retention obligations.

• Access and correction — view and edit your profile, listings, pickup details, and insurance records in your account settings.
• Deletion — delete your account from the Profile page, or email us to request deletion.
• Marketing opt-out — unsubscribe from any marketing email. Transactional messages about your account and bookings will continue while your account is open.
• Document removal — delete an uploaded insurance document at any time.

To submit a privacy request, email Support@SourcedRentals.com with the subject line "Privacy Request" and tell us what you would like us to do. We will verify your identity through the email address on your account before acting, and we will respond within the timeframe required by applicable law.

Several U.S. states have enacted consumer privacy laws. Whether a given law applies to Sourced Rentals depends on where you live and on statutory thresholds such as revenue and the number of consumers whose data a business processes — thresholds an early-stage marketplace may not meet. Rather than parse that for you, we extend the following to any U.S. resident who asks, to the extent it is technically and legally practicable:

• The right to know what categories of personal information we collect and why.
• The right to access a copy of the personal information we hold about you.
• The right to correct inaccurate personal information.
• The right to delete personal information, subject to legal retention exceptions.
• The right to opt out of sale, sharing for targeted advertising, or profiling with legal effects — noting that we do not currently engage in any of those activities.
• The right to appeal a decision on your request, where your state provides one. To appeal, reply to our response and write "Appeal" in the subject line.
• The right not to be discriminated against for exercising a privacy right.

Indiana. Sourced Rentals is based in Indiana and is launching there first. The Indiana Consumer Data Protection Act takes effect January 1, 2026 and applies to businesses that meet its processing thresholds. Indiana residents may exercise the access, correction, deletion, portability, opt-out, and appeal rights described above by contacting us at Support@SourcedRentals.com. We will honor Indiana requests regardless of whether we have crossed the statutory thresholds.

You may also authorize an agent to submit a request on your behalf; we may ask for proof of that authorization.

Sourced Rentals is operated from Indiana, USA, is directed at users in the United States, and stores information on servers located in the United States. We do not currently market the Platform outside the United States.

If you access the Platform from outside the U.S., your information will be processed in the United States, where privacy laws may differ from those in your country. If you are in the EEA or UK, the legal bases we would rely on are performance of a contract with you, legitimate interests (operating and securing the marketplace, preventing fraud), consent (optional marketing), and compliance with legal obligations — and you may have rights of access, rectification, erasure, restriction, portability, and objection, plus the right to complain to your local supervisory authority. Contact Support@SourcedRentals.com to exercise them.

Our Terms of Service require all users to be at least 18 years old. The Platform is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account or provided information, contact Support@SourcedRentals.com and we will delete it.

We may update this Privacy Policy as the Platform evolves — for example, if we add identity verification, an insurance product, telematics, or analytics tooling. Material changes will be posted here with a new effective date and, where required, notified to you by email before they take effect.

T1 Ventures, LLC dba Sourced Rentals™ · Indiana, USA
Privacy and general support: Support@SourcedRentals.com

This Policy describes our current practices in plain English. It has not been certified by outside counsel, and it is not legal advice to you.