Legal

Privacy Policy

Last Updated: April 7, 2026

Effective Date: April 7, 2026

Gravvit ("we," "us," or "our") operates the Gravvit equipment rental platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our mobile application and related services.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

  • Account Information: Name, email address, password, account type (personal or business), phone number, and profile photo.
  • Identity Verification: Government-issued identification documents (driver's license, passport, or national ID), including document number, issuing country, full name, date of birth, and residential address. Identity verification is processed through our third-party partner, Stripe Identity.
  • Business Verification: Business name, registration number, and country of registration (for business accounts).
  • Equipment Listings: Equipment name, description, location (including coordinates), pricing, availability schedules, delivery preferences, and equipment photos.
  • Rental Transactions: Rental dates, pickup/delivery preferences, pickup locations, and any notes associated with rental requests.
  • Communications: Messages exchanged between users through in-app messaging, including message content and timestamps.
  • Reviews and Ratings: Ratings and written reviews you leave for other users.
  • Damage Reports: Issue descriptions and evidence photos submitted in connection with rental disputes.
  • Support Requests: Information you provide when contacting us for support.

1.2 Information Collected Automatically

  • Device Information: Device type, operating system, platform (Android, iOS, or web), and push notification tokens (Firebase Cloud Messaging or Apple Push Notification service).
  • Location Data: When you search for equipment, we collect your approximate location (latitude, longitude, and search radius) to provide relevant results. Equipment owners provide location data for their listings.
  • Usage Data: Search queries, search results counts, and interaction with the Service.
  • Log Data: HTTP request logs, error logs, and timestamps generated during your use of the Service.

1.3 Information from Third-Party Services

  • Stripe: Payment confirmation status, customer identifiers, and identity verification results. We do not store your credit card numbers, bank account details, or other sensitive payment credentials — these are handled entirely by Stripe.
  • OpenStreetMap Nominatim: Location search suggestions are fetched client-side from OpenStreetMap for address autocomplete. We do not control or store data sent to this service.

2. How We Use Your Information

We use the information we collect to:

  • Provide the Service: Create and manage your account, facilitate equipment rentals, process payments, enable messaging between renters and equipment owners, and deliver push notifications.
  • Verify Identity: Confirm your identity through Stripe Identity to build trust and safety on the platform.
  • Process Payments: Facilitate rental payments, manage payment statuses, and handle refunds or disputes through Stripe.
  • Enable Location-Based Search: Show equipment near your location and calculate distances between users and listings.
  • Improve the Service: Analyze search patterns and usage data to understand how the Service is used and identify areas for improvement (e.g., tracking searches with zero results).
  • Communicate with You: Send push notifications about rental updates, messages, and important account information.
  • Enforce Policies: Detect and prevent fraud, enforce our Terms of Service, and resolve disputes.
  • Legal Compliance: Comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Users

  • Renters and Equipment Owners: When you engage in a rental transaction, the other party can see your name, profile photo, account type, location, ratings, reviews, and verification status. Sensitive identity information (date of birth, document numbers, full address) is never shared with other users.
  • Messaging: Message content is visible to both participants in a conversation.

3.2 With Service Providers

We use the following third-party service providers to operate the Service:

  • Supabase: Database hosting, user authentication, file storage, and real-time messaging infrastructure. Data is stored on Supabase's infrastructure.
  • Stripe: Payment processing (Stripe Checkout, payment intents, customer management) and identity verification (Stripe Identity). Stripe's use of your data is governed by Stripe's Privacy Policy.
  • Firebase Cloud Messaging (Google): Delivery of push notifications to Android devices.
  • Apple Push Notification service (Apple): Delivery of push notifications to iOS devices.

3.3 For Legal Reasons

We may disclose your information if required to do so by law, or if we believe in good faith that such action is necessary to:

  • Comply with a legal obligation, subpoena, or court order.
  • Protect and defend our rights or property.
  • Prevent fraud or investigate potential violations of our Terms of Service.
  • Protect the personal safety of users or the public.

4. Data Storage and Security

4.1 Where Your Data Is Stored

Your data is stored on Supabase's cloud infrastructure. Files (profile photos, equipment images, rental evidence photos, and identity documents) are stored in private Supabase Storage buckets with access controls.

4.2 Security Measures

We implement security measures to protect your information, including:

  • Password hashing managed by Supabase Auth (passwords are never stored in plain text).
  • Row Level Security (RLS) policies on all database tables to ensure users can only access data they are authorized to view.
  • Private storage buckets with access controls for uploaded files.
  • Bearer token authentication (JWT) for all API requests.
  • HMAC-SHA256 webhook signature verification for Stripe events.
  • HTTPS encryption for all data in transit.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

  • Account Data: Retained for as long as your account is active. If you delete your account, your personal data will be removed, subject to any legal retention requirements.
  • Conversations and Messages: Soft-deleted when you delete a conversation (hidden from your view but visible to the other participant). Hard-deleted when both participants delete the conversation.
  • Rental Transaction Records: Retained for the duration of your account for reference and dispute resolution purposes.
  • Identity Verification Records: Retained for as long as your account is active to maintain your verified status.
  • Payment Records: Transaction metadata (amounts, statuses, timestamps) is retained for accounting and legal compliance. Sensitive payment credentials are not stored by us.
  • Search Logs: Retained for analytics and service improvement purposes.
  • Device Tokens: Retained while your account is active and the device is registered.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

6.1 Access and Portability

You can access your profile information, rental history, messages, and reviews through the app at any time.

6.2 Correction

You can update your profile information (name, phone number, location, and profile photo) through the app settings.

6.3 Deletion

You may request deletion of your account and associated personal data by contacting us at the email address listed below. Please note:

  • Deletion may be delayed if you have active rentals or unresolved disputes.
  • Certain data may be retained as required by law or for legitimate business purposes (e.g., transaction records for tax compliance).
  • Reviews you have written may be anonymized rather than deleted to maintain platform integrity.

6.4 Push Notifications

You can disable push notifications through your device settings at any time.

6.5 Location

You can deny location permissions through your device settings. Note that some features (such as nearby equipment search) may not function without location access.

7. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to such countries.

9. Cookies and Tracking Technologies

The Gravvit mobile application does not use browser cookies. We may use local storage on your device to maintain your authentication session and app preferences.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the app and updating the "Last Updated" date at the top of this document. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@gravvit.com

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale: We do not sell your personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at the email address listed above.