Privacy Policy

equipments.rent (“the Platform,” “we,” “us”) is operated by equipments.rent Technologies Inc., a corporation registered with the Securities and Exchange Commission of the Philippines.

We are the Personal Information Controller (PIC) for the data described in this policy, as defined under Republic Act No. 10173 (the Data Privacy Act of 2012, “DPA”) and its Implementing Rules and Regulations.

For privacy questions or to exercise your rights under the DPA, contact our Data Protection Officer at privacy@equipments.rent.

We collect data in three categories:

a) Information you provide directly: name, email address, mobile number, business name, address, role (Renter / Lessor / Both), and account preferences.

b) Identity verification (KYC) documents: government-issued IDs, business permits, SEC/DTI registrations, BIR certificates. Submitted only when you complete KYC and stored encrypted in private storage.

c) Transactional and usage data: listings you post, requests you submit (including the job-site area and transport arrangements), bids placed (including a lessor’s yard-to-site distance estimate and transport quote), rentals booked, payments processed, reviews left, in-app messages, IP address, device type, browser, pages visited, and timestamps.

We do not collect sensitive personal information (as defined under Sec. 3(l) of the DPA) such as race, marital status, religious or political affiliation, health, or genetic data — unless you voluntarily disclose it in a message or KYC document.

We process your data only when at least one of the following lawful bases applies:

Contractual necessity — to operate the Platform, match renters with lessors, process bids and payments, generate invoices, and deliver notifications about your transactions.

Legal obligation — to verify identity (Anti-Money Laundering Act, Bureau of Internal Revenue rules), retain records for tax and audit purposes, and respond to lawful orders from Philippine authorities.

Legitimate interest — to prevent fraud, abuse, and platform manipulation; to investigate disputes; to improve service quality through aggregate analytics.

Consent — for marketing emails and push notifications, personalization, and any optional data we ask you to share. You may withdraw consent at any time. If your browser sends a Global Privacy Control signal, we record it as an opt-out of marketing and personalization the first time you open your workspace, unless you have already made an explicit choice in Settings.

We use your data to: create and authenticate your account; display your listings and bids to other users; route bid notifications and payment confirmations (for new in-app messages, we email you about the first unread message in a 15-minute burst rather than every message); verify your identity for KYC; process payments via PayMongo; send transactional emails and in-app notifications; detect fraud or abusive behavior; comply with PH legal obligations; and aggregate anonymized insights to improve the Platform.

We do not sell your personal data to advertisers, data brokers, or third parties for their independent marketing purposes.

We share data only with parties who help us operate the Platform, under contractual obligations to protect your data and use it only for the stated purpose:

Other users: when you place a bid or post a listing, your name (or company name), KYC verification status, average rating, and message contents become visible to the counterparty.

Payment processor: PayMongo Pte. Ltd. processes all transactions. They receive amounts, payer details, and reference numbers. See PayMongo’s privacy policy for their data handling.

Payments outside the Philippines: where a market uses Stripe, Stripe receives the same categories as PayMongo above.

Identity verification: in markets that use hosted verification, Sumsub collects your documents directly; we keep only the applicant reference and the verdict.

Email provider: Resend (transactional and, with your consent, marketing email) receives the destination address, message content, and a delivery identifier. We do not send SMS.

AI assistance: Anthropic (Claude) processes the text of listings and requests when you ask it to draft copy or parse a request, the bids on a request when its owner asks for a bid evaluation, and, for administrators resolving a dispute, the dispute statement and rental chat with phone numbers and email addresses removed. Voyage AI or OpenAI (embeddings) receives listing and request text to power matching. A bid evaluation and a dispute analysis include the display names (or company names) of the parties involved; none of these providers receives your email address or phone number from us.

Monitoring and security: Sentry (error monitoring), our log and alerting providers, and Upstash (rate limiting) receive technical data such as error details, request identifiers and IP-derived rate-limit keys. Email addresses, phone numbers and account numbers are redacted before these leave our servers.

Cloud infrastructure: Supabase (Postgres + Storage) and Vercel (hosting) store your data on encrypted infrastructure. Both providers are bound by Data Processing Agreements.

Authentication: Google OAuth (if you sign in with Google) receives a unique identifier on each login.

Legal authorities: we will disclose data when compelled by a valid Philippine subpoena, court order, or written demand from a government agency acting within its mandate.

We retain personal data only for as long as needed for the purposes described:

Active accounts — for the lifetime of your account.

Closed accounts — basic identity and transaction records are retained for 10 years as required by BIR record-keeping rules and Anti-Money Laundering law.

KYC documents — retained for 5 years after account closure or last transaction.

Consent records — every consent choice you make (including a withdrawal) is kept as evidence that we honored it, for as long as we may need to demonstrate compliance. If your account is erased, these records are kept only in pseudonymous form.

Server logs — email addresses, phone numbers and account numbers are redacted before logs are written; the remaining technical logs are kept for our log provider’s retention period.

Payment-provider notifications — the full notification is kept for 90 days for reconciliation, then reduced to the identifiers, amounts and statuses needed for our financial records.

You may request earlier deletion under Section 11 below; we will comply unless retention is required by law.

We apply organizational, physical, and technical safeguards proportionate to the data’s sensitivity, in line with NPC Circular 16-01:

All traffic is encrypted with TLS 1.3 (HTTPS only). Our database and file storage are encrypted at rest by our infrastructure provider (AES-256), and payout account numbers are additionally encrypted field by field. KYC documents are stored in private buckets with signed-URL access. Access to production data is limited to authorized personnel with multi-factor authentication. We log administrative actions and review them regularly. We perform security reviews before significant feature releases.

No system is perfectly secure. If we discover a personal data breach that creates a real risk of serious harm to you, we will notify you and the National Privacy Commission within 72 hours as required by the DPA.

We use cookies sparingly. Specifically:

Strictly necessary cookies — session token (NextAuth), CSRF protection. These cannot be disabled without breaking sign-in.

Functional cookies — your active company context, language preference. These improve usability but the site works without them.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking.

You can clear cookies in your browser settings at any time. Doing so will sign you out.

Some of our infrastructure providers operate servers outside the Philippines (Vercel and Supabase use the Singapore region by default). When data is transferred abroad, we ensure the recipient provides an adequate level of protection through contractual safeguards (Data Processing Agreements with standard contractual clauses).

The Platform is not directed at persons under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact privacy@equipments.rent and we will remove the account.

As a data subject, you have the following rights under the DPA:

Right to be informed of how your data is processed.

Right of access — request a copy of your personal data we hold.

Right to rectify inaccurate or incomplete data.

Right to erasure or blocking — request deletion when data is no longer needed, processing was unlawful, or you withdraw consent.

Right to data portability — receive your data in a structured, machine-readable format.

Right to object to processing (e.g. marketing).

Right to damages for inaccurate, false, unlawfully obtained or unauthorized use of your data.

Right to file a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated.

To exercise any right, email privacy@equipments.rent with proof of identity. We respond within 15 business days.

We may update this policy as we add features or in response to legal changes. Material changes will be communicated via email and posted on this page with a new “Last updated” date at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.

Data Protection Officer

equipments.rent Technologies Inc.

Email: privacy@equipments.rent

For complaints not resolved by us, you may contact the National Privacy Commission at complaints@privacy.gov.ph or +63 2 8234-2228.