Legal
Privacy Policy
This Privacy Policy explains what information RENTALLEAK LLC, a Washington limited liability company with its principal place of business in Whitman County, Washington (“Rental Leak”, “we”, “us”), collects when you use the Rental Leak web app and companion iOS and Android apps (together, the “Service”), why we collect it, and the choices you have. Rental Leak is business software sold to contracting companies; the account owner is our customer and controls the company’s data.
Controller and processor roles
For the operational data a customer company puts into the Service — rentals, temporary services, vendors, projects, locations, team members, documents, invoices and recurring jobsite costs — Rental Leak generally acts as a processor: we handle that data on the customer company’s instructions to provide the Service, and the company decides why and how it is used. Rental Leak acts as a controller for its own purposes: creating and authenticating accounts, account administration and support, billing, security and abuse prevention, and meeting our legal obligations. Where individual privacy requests concern company operational data, we generally route them through the company’s account owner.
1. Information we collect
Account information
When you or your company create an account we collect your name, email address, company name, your role on the team (owner, manager or field), and a hashed password. Authentication is handled by our backend provider, Supabase; we do not store your password in readable form.
Rental and business data you enter
The core of the Service is the records you create: vendor and project names, vendor contact details including a vendor email address, descriptions of rented equipment and temporary services, rates and billing periods, purchase-order and unit numbers, start and return dates, status history, notes, and the reminders and verification requests attached to each rental. This information is provided by you and stored on your company’s behalf.
If you choose to send a vendor an Off-Rent Notice, we send an email to the vendor email address saved in your account. The email contains the item, project and requested off-rent date; it is sent through our transactional email provider. Sending it is a customer-initiated action and is not the vendor confirming anything.
Uploaded documents, photos and PDFs
When you photograph or upload a rental agreement or a vendor invoice, we store that image or PDF file, along with the fields extracted from it and a record of which extracted values you confirmed. Photos are resized and compressed on your device before upload; we do not keep the full-resolution original. Files are held in private storage and are only reachable through short-lived signed links issued to signed-in members of your company.
Payment information
Subscription billing is processed by Stripe. Rental Leak never receives or stores your full card number, expiry date or security code. We store only non-sensitive references that Stripe returns to us: a customer identifier, a subscription identifier, the plan/price identifier, the current billing-period end date, and — for display only — your card brand and its last four digits.
Connected accounting software (QuickBooks Online)
Connecting QuickBooks Online is optional and is done by your company’s account owner. When it is connected, the owner authorizes Rental Leak to access that QuickBooks company through Intuit’s Accounting permission. Rental Leak uses that access only for the integration you asked for:
- reading your QuickBooks vendors, customers, jobs and projects and expense accounts so you can match them to your Rental Leak vendors and projects and choose a rental expense account;
- creating a bill in QuickBooks when you press “Send to QuickBooks” on a reviewed invoice, and checking for an existing bill with the same vendor and invoice number first;
- reading the QuickBooks company name and its expense-tracking setting.
We store the matches you choose (the QuickBooks record’s id and name), your chosen expense account, the QuickBooks company name and id, and a record of each invoice sent (the QuickBooks bill id, invoice number, amount and status). We do not keep a copy of your QuickBooks vendor, customer or account lists, and we do not read or change payroll, bank, payment or general-ledger data.
The connection’s access credentials (OAuth tokens) are stored on our servers, encrypted, and are used only by our servers to talk to QuickBooks. They are never sent to your browser or to the mobile app. We do not ask for or store your QuickBooks username or password.
Device and technical information
To operate the Service we process standard technical data such as your IP address and app or browser version when your device communicates with our servers. On mobile, some rollover reminders are scheduled locally on your device by the operating system after you grant notification permission. The mobile app also uses push notifications for time-sensitive workflows such as team verification: after you grant permission, we obtain a push token issued by Expo, our notification delivery provider, and store it, associated with your account, company and device installation, so we can deliver that notification to your device. Delivering it may involve Expo’s push service and your device platform’s own notification service — the Apple Push Notification service on iOS or Firebase Cloud Messaging on Android. Push tokens are used only to deliver Rental Leak’s own notifications about your account and rentals — never for advertising or to track you across other companies’ apps or websites — and we do not use advertising identifiers.
Error and diagnostic reports
Crash and error reporting is off by default. If we enable it for a release, diagnostic reports are sent to Sentry and are automatically scrubbed before they leave your device to remove access tokens, card-like numbers, email addresses and the contents of uploaded documents. We do not use product analytics, session recording or behavioural tracking.
2. How we use information
- Provide the Service: store your rentals, calculate rollover dates and the next charge, and send reminders.
- Read your uploaded agreements and invoices using an AI document-extraction provider (see “AI and OCR processing” below) so fields can be pre-filled for your review.
- Authenticate users, enforce team roles and keep each company’s data separate from every other company’s.
- Process subscription payments and manage trials, upgrades and downgrades through Stripe.
- Send transactional messages such as email confirmation, password reset, team invitations and, on mobile, rollover and field-verification notifications.
- Provide support, diagnose problems, prevent abuse and meet legal obligations.
We do not sell your data, and we do not use your rental records or uploaded documents to train third-party AI models.
3. AI and OCR processing
When you scan or upload an agreement or invoice, the file is sent from our server to a third-party AI extraction provider (currently Anthropic) to read structured fields from it. Under our agreement with the provider, your document is processed only to return that extraction result and is not used to train the provider’s models. Rental Leak does not use your documents or business data to train any Rental Leak-owned model. The extracted result is cached on our side for a short period (about 24 hours) so that re-opening the same document does not trigger a second call. The document’s contents are never written to our application logs. The extracted values are only ever suggestions: your confirmed entries, not the AI output, are the rental’s data.
4. How information is shared
We share information only with service providers that help us run the Service, each under a contract that limits them to that purpose:
- Supabase — database, authentication and file storage.
- Stripe — subscription billing and payment processing.
- Anthropic — AI extraction of fields from uploaded agreements and invoices.
- A transactional email provider (Resend) — sending invitations, confirmations, password-reset messages and customer-initiated vendor Off-Rent Notices.
- Expo — delivering push notifications to the mobile app, such as field-verification alerts.
- Sentry — crash and error diagnostics, only if enabled for a release.
- Our hosting and CDN providers — serving the website and app.
Intuit (QuickBooks Online) is a third-party service that you choose to connect. If your account owner connects it, the invoices you choose to send are transmitted to Intuit to create bills in your own QuickBooks company. Intuit handles that information under its own terms and privacy statement. We do not sell QuickBooks data, use it for advertising, or send it to our AI extraction provider.
We may also disclose information if required by law, to enforce our agreements, or in connection with a merger or acquisition, in which case we will provide notice as required.
Within your company, rental data, documents and history are visible to other signed-in members according to their role. The account owner and managers can add or deactivate members.
5. Where data is processed
Rental Leak and its service providers are based in the United States, and data is primarily processed and stored there. A provider or its sub-processors may also process data in other countries where they operate in order to deliver their part of the Service.
6. Retention and deletion
We keep your company’s account and business data for as long as the account is active. Uploaded files and their extracted fields are retained with the rental they belong to. Short-term caches used for AI extraction expire automatically (about 24 hours).
From within the app you can request deletion of your own account, or — as an account owner — of the whole company. The request starts a 30-day grace period during which you can cancel it and nothing is deleted. After the grace period the request is processed automatically: for a company deletion we cancel any paid subscription, delete the company’s uploaded files, and delete the company’s account, rental, vendor, project, location, invitation and invoice records along with the associated sign-in accounts; for an individual account deletion we remove that person’s sign-in and profile and remove their name from shared company history. Some records may be retained for as long as reasonably required for legal, tax, accounting, security, fraud-prevention or dispute-resolution purposes. Backups follow their own retention cycle and then expire.
QuickBooks. Your account owner can disconnect QuickBooks at any time under Account → Integrations. Disconnecting revokes Rental Leak’s access at Intuit and deletes the stored access credentials, so Rental Leak can no longer reach that QuickBooks company; the same happens if access is removed from inside QuickBooks. Your matches and the record of invoices already sent stay in Rental Leak until the company is deleted, and are then deleted with the rest of the company’s data, together with the connection and its credentials. Bills already created in QuickBooks are part of your QuickBooks books: they stay in QuickBooks and are not deleted or changed by disconnecting or by deleting your Rental Leak company.
7. Your rights and choices
- Access and correction — you can view and edit most of your data directly in the app. Contact us for anything you cannot change yourself.
- Deletion — request account deletion in the app, or email us.
- Notifications — you can turn rollover reminders off in your device settings or in the app. Other Rental Leak notifications (such as field-verification alerts) can be turned off in your device’s notification settings, and signing out removes that device’s push registration.
- Marketing — we only send transactional email for the Service; there is no marketing email programme at this time.
Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA/CPRA, including the right to a copy of your data or to lodge a complaint with a regulator. Because Rental Leak is sold to companies, we generally route individual requests that concern company operational data through the company’s account owner, and act on requests about your own account directly.
8. Security
We use reasonable administrative, technical and organizational safeguards to protect your information. Data is encrypted in transit. Access to company data is restricted at the database level so that a signed-in user only reaches their own company’s rows (tenant isolation), roles limit what each team member can do, and administrative access is limited to staff who need it. Payment card data never touches our servers. Uploaded files are private and served only through short-lived signed links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we also work to limit what we collect in the first place.
9. Children
The Service is for business use by adults and is not directed to anyone under 18. We do not knowingly collect information from children.
10. Changes to this policy
We may update this policy as the Service evolves. If we make a material change we will update the date above and, where appropriate, notify account owners.
11. Contact
Questions or privacy requests: support@getrentalleak.com.