This policy explains what personal information Stufflet collects, why, and the choices you have. It is written to comply with Quebec’s Law 25 and Canada’s PIPEDA.
What we collect
Account information: name, email, phone, home town, profile photo and bio. Listing information: tool details, photos and the pickup address (shared with a renter only after the host confirms a booking). Booking information: dates, prices, handoff photos, messages and reviews. Payment information is collected and stored by Stripe; Stufflet keeps only tokens and the last four digits.
Technical information: device, browser, approximate location from your IP address, and usage events needed to run and secure the service.
Why we use it
To run the marketplace: matching listings to renters near you, processing payments and deposits, recording handoffs, resolving claims and sending transactional notifications. To keep members safe: verification, fraud prevention and enforcing our terms. To improve the product using aggregate usage data.
We do not sell personal information and we do not use it for third-party advertising.
Who we share it with
The other party to a booking sees your name, photo, rating, messages and, once confirmed, the pickup address or delivery address. Service providers who process data for us: Supabase (database and storage, hosted in the United States), Stripe (payments and identity verification), Vercel (hosting), Resend (email) and MapTiler (maps). Authorities when required by law.
Location
Listings show an approximate location only. Exact addresses are stored encrypted at rest and revealed to the renter after confirmation. If you enable browser geolocation we use it once to sort results and do not store it.
Retention
Account data is kept while your account is open and for 3 years after closure to handle disputes and legal obligations. Handoff photos and claim records are kept for 3 years after the booking. You can request deletion earlier; we will delete what we are not legally required to keep.
Your rights
You can access, correct or export your information from Settings or by emailing privacy@stufflet.com. You can withdraw consent to optional communications at any time. Quebec residents may complain to the Commission d’accès à l’information. Our person in charge of personal information is reachable at privacy@stufflet.com.
Security
Data is encrypted in transit and at rest. Access is restricted by row-level security so members only see the records they are party to. We notify affected members and the regulator of breaches that present a risk of serious injury.