Privacy Policy

Two roles, two kinds of data

Rentable.PH is software that rental businesses use to run their bookings, inventory and online storefront. We handle personal data in two different roles:

• Your account and your business (we decide how it's used). If you sign up as a rental business or team member, Rentable.PH is the personal information controller for your name, email, phone number, business details and sign-in data.
• Your customers' data (the business decides). Names, contact details, addresses and bookings that a business collects from its own customers belong to that business, which is the controller. Rentable.PH only stores and processes them for the business, on its instructions. Customers should read the privacy notice on that business's storefront.

What we collect from you

• Account details: name, email address, mobile number and role in a business.
• Business details you enter: name, address, contact details, registration numbers, logo and photos.
• Records you create in the app: inventory, bookings, payments, deliveries and returns, including the customer details inside them.
• Plan and billing details for your subscription.
• Basic activity records (who did what, and when) so your team has an audit trail.

Passwords are handled by our sign-in provider and stored hashed. We never see or store them in readable form.

Why we use it

• To provide the service: sign you in, keep each business's records separate, and run bookings and storefronts.
• To send service messages such as sign-in confirmation, booking notifications and billing notices.
• To send the reminders and daily summaries a business has switched on, such as payment and return reminders to its own customers.
• To keep the service secure, fix problems and prevent misuse.

We don't sell personal data and we don't use customers' data for our own advertising.

Who can see it

• Each business's records are visible only to its own team, limited by role (owner, admin, booking, inventory or delivery staff).
• Public storefronts show only the catalog, availability and the store's public details, never customers or bookings.
• Uploaded photos (items, logos, banners and damage photos taken at return) are stored with a hard-to-guess link and can be viewed by anyone who has it. Don't upload anything private, such as IDs.
• Our hosting and database provider (Supabase) stores the data for us as a processor. Delivery partners such as Lalamove receive customer details only when a business arranges a delivery.
• Authorities, only where the law requires it.

How long we keep it

Each business sets how long its customers' details are kept (Settings → Privacy, 36 months after a customer's last booking unless changed). Businesses can export a customer's data and erase their personal details at any time, and the app lists customers past the retention period. Erasing removes names, contact details, addresses and notes; amounts and dates stay, without personal details, so accounts remain accurate. Account and business data is kept while your account is active, and for as long afterwards as the law requires for accounting and tax. In-app notifications are deleted after 90 days and the activity log after 24 months, and photos that are replaced or no longer used are deleted automatically.

Customer consent on storefronts

Before a storefront visitor can send a booking request, they must accept the store's privacy notice. We record the date and notice version with their record, so a business can show when consent was given.

Your rights

Under RA 10173 you may:

• be informed how your data is used;
• access it and receive a copy, including in a portable format;
• correct data that is wrong or out of date;
• ask for it to be erased or blocked, or withdraw your consent;
• object to its use;
• claim compensation for damages from misuse, and complain to the National Privacy Commission (privacy.gov.ph).

If you are a business user, contact us. If you are a customer of a rental business, contact that business first: it decides how your data is used and can export or erase it; we will help it do so.

Security

Data travels over encrypted connections. Access is controlled per business and role at the database level, not only in the app, and changes are recorded in an activity log. No system is perfectly secure; if a breach affects your personal data in a way the law says must be reported, we will notify the affected businesses and the National Privacy Commission as required.

Changes and contact

If we change this policy in a way that matters, we will update the version above. Questions or requests about privacy, including to reach our data protection officer, can be sent through the contact page.