Privacy Policy

2. Information We Collect

• Profile & Authentication: Name, verified email address (via Google OAuth), mobile phone number (verified via OTP), and avatar image.
• Community Affiliation & KYC Proofs: Institutional email domain (@itbhu.ac.in), student roll number, or government-issued document (Aadhaar or Driving License) submitted exclusively for administrator identity verification.
• Item Listings: Item name, make, model, category, rental rates, deposit requirements, guidelines, photos, and masked registration number (e.g. UP 65 ** ****) to protect owner privacy.
• Device, IP & Log Data: We automatically collect your IP address, browser type and version, operating system, device type (desktop/mobile/tablet), screen resolution, referring URL, pages visited, time spent on pages, and access timestamps. This data is used for security monitoring, fraud prevention, and platform improvement.
• Specialized Location Data (Admin-Approved Only): RentIt does not perform general GPS tracking on users or vehicles. Only specialized personnel or authorized fleet managers explicitly granted access by platform administrators may access optional GPS handover coordination.
• Communications: Encrypted in-app chat messages and booking notes exchanged between owners and renters.

3. Cookies & Analytics

RentIt uses essential cookies and local storage for authentication session management (NextAuth.js session tokens), user preferences, and form draft persistence. We do not use third-party advertising cookies or cross-site trackers.

• Essential Cookies: Session tokens (next-auth.session-token), CSRF protection tokens. These are strictly necessary for the platform to function.
• Analytics: We collect anonymized usage analytics (page views, feature usage, device type distribution) to improve the platform experience. No personally identifiable information is shared with analytics providers.
• Local Storage: Form drafts and UI preferences are stored locally on your device and are never transmitted to our servers unless you explicitly submit them.

You can disable non-essential cookies via your browser settings. Disabling essential cookies may prevent you from using the platform.

4. Purpose & Use of Data

We process your data exclusively for:

• Verifying user identities and granting verified community badges.
• Enabling peer discovery, booking inquiries, and rental handovers.
• Connecting renters and owners via private, encrypted WebRTC voice calls without revealing personal phone numbers.
• Sending critical notifications (KYC decision alerts, call alerts, and booking updates).
• Enforcing safety standards, preventing fraud, and resolving disputes.
• Monitoring platform security and detecting suspicious or malicious activity.

5. Third-Party Services

RentIt integrates with the following third-party services to operate the platform:

• Google OAuth: For secure user authentication. Google receives only the authentication request; we do not share your platform data with Google.
• Amazon Web Services (AWS): S3 for document and image storage, EC2 for server hosting — all in the Mumbai (ap-south-1) region.
• MongoDB Atlas: Cloud database hosting for platform data, hosted in the AWS Mumbai region.

These providers process data strictly as necessary to deliver their services and are bound by their own privacy policies and data protection agreements.

6. Data-Sharing Conditions

We may share your personal data only in the following limited circumstances:

• With your consent: When you explicitly authorize sharing (e.g., initiating a chat with another user shares your first name and verified status).
• Legal compliance: When required by law, court order, or government authority under Indian law (IT Act 2000, DPDP Act 2023).
• Platform safety: To prevent fraud, abuse, or security threats, we may share relevant data with law enforcement agencies.
• Service providers: With third-party vendors (AWS, MongoDB Atlas) strictly as needed to operate the platform, under data processing agreements.

We never sell, rent, or license your personal data to advertisers, data brokers, or any third parties for marketing purposes.

7. No General GPS Tracking & Admin-Granted Specialized Access

RentIt does not track the real-time location or travel movements of general users or vehicles. Live GPS handover coordination is a specialized, restricted capability accessible strictly by authorized personnel granted explicit permission by platform administrators on an individual basis. For standard community members, handovers are coordinated directly without GPS tracking.

8. Peer-to-Peer Encrypted Voice Calling

RentIt includes browser-based WebRTC voice calling. Signaling is conducted securely through our server, but actual audio streams travel directly between peers using DTLS-SRTP end-to-end encryption. RentIt does not record, intercept, or listen to your voice conversations.

9. Storage, Cloud Security & AWS S3

Identity verification documents and item photos are securely stored in Amazon Web Services (AWS S3) in Mumbai (ap-south-1) using tenant-isolated object keys. All data in transit is encrypted with TLS 1.3, and access to identity proofs is strictly restricted to authorized administrators.

10. Payments & Financial Privacy

RentIt does not integrate or utilize any online payment gateways (such as Razorpay, Stripe, or payment intermediaries). RentIt charges a 0% platform commission. All financial transactions, security deposits, and rental settlements occur strictly and directly between peer and peer (via direct peer UPI or offline cash) at the time of handover. RentIt never requests, handles, escrows, or stores sensitive debit/credit card numbers, CVVs, UPI PINs, or bank credentials. RentIt is strictly a technology and communication venue to connect community members.

11. KYC / Aadhaar Document Storage & Deletion

KYC documents (Aadhaar card images, Driving License photos, Student ID images) are uploaded securely to AWS S3 with tenant-isolated keys. These documents are:

• Accessible only to authorized Super Admins for verification purposes.
• Never shared with other users, third parties, or external services.
• Retained only for the duration of your account's active lifecycle plus a statutory compliance period of 90 days post account deletion.
• Permanently deleted from S3 storage within 90 days after account deletion or upon explicit user request.
• Aadhaar numbers are never stored in plaintext in any database. Only the verification status (approved/rejected) and the admin's review decision are recorded.

12. Data Retention Periods

• User Profile Data: Retained for the duration of your active account. Deleted within 7 business days of account deletion request.
• KYC / Aadhaar Documents: Retained during active account + 90 days post-deletion for statutory compliance, then permanently purged.
• Item Listings: Retained while active. Archived listings are purged 180 days after deactivation.
• Chat Messages & Metadata: Chat content is retained for 1 year from the last message date. Metadata (session creation, participant info) is retained for the lifetime of the account.
• Call Metadata: WebRTC call signaling metadata (call start/end timestamps, caller/callee IDs) is retained for 90 days. No audio content is ever stored.
• Location Data: GPS coordinates used during authorized handover coordination are retained for a maximum of 30 days, then permanently deleted.
• Analytics & Log Data: Anonymized analytics events are retained for 2 years. Server access logs (IP, user agent) are retained for 90 days.
• Security Events: Security audit logs (failed logins, suspicious activity) are retained for 1 year.

13. Consent Withdrawal

You may withdraw your consent for data processing at any time by:

• Deleting your account from the Profile settings page.
• Emailing a withdrawal request to madhava2807@gmail.com with the subject line "Consent Withdrawal — [Your Registered Email]".
• Contacting us via the Support & Queries page.

Upon consent withdrawal, we will cease processing your personal data and initiate account deletion. Note that withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal, and certain data may be retained as required by Indian law.

14. Minimum Age Requirement

RentIt is intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a user under 18 has provided personal information, we will promptly delete such data and terminate the account. If you believe a minor has registered on RentIt, please contact us immediately at madhava2807@gmail.com.

15. International Data Transfers

RentIt primarily stores and processes all user data within India (AWS Mumbai region, ap-south-1). In the event that any data is transferred outside India (e.g., for third-party service providers with global infrastructure), we ensure that:

• Adequate safeguards are in place as required under the DPDP Act 2023.
• Data is only transferred to jurisdictions that provide an adequate level of data protection or under standard contractual clauses.
• No sensitive personal data (KYC documents, Aadhaar) is transferred outside India.

16. Data Breach Handling

In the event of a data breach that compromises the security or confidentiality of your personal data:

• We will notify affected users via email within 72 hours of discovering the breach.
• We will report the breach to the relevant data protection authority (Data Protection Board of India) as required under the DPDP Act 2023.
• We will provide details of the nature of the breach, the data affected, steps taken to mitigate the impact, and recommended protective actions for users.
• We maintain an incident response plan and conduct periodic security audits to minimize breach risk.

17. Chat & Call Metadata Retention

Chat metadata (session IDs, participant emails, timestamps, read/unread status) is retained for the lifetime of your account. Chat message content is retained for 1 year from the last message in a session. After this period, message content may be permanently deleted while session metadata is preserved.

Call metadata (WebRTC signaling records including caller/callee IDs, call initiation/end timestamps, call duration) is retained for 90 days. No audio content is ever recorded or stored. Call quality metrics may be retained in anonymized form for platform improvement.

18. Location Data Retention

For standard users, RentIt does not collect or store any location data. For authorized personnel using the optional GPS handover coordination feature, location coordinates are:

• Collected only during an active handover session with explicit user consent.
• Retained for a maximum of 30 days following handover completion.
• Permanently deleted after the retention period.
• Never used for behavioral profiling, advertising, or shared with any third parties.

19. Zero-Data-Selling Commitment

We do not sell, rent, license, or monetize your personal information to advertisers or data brokers. Community peers only see your first name, verified badge status, community hub, rating, and masked vehicle/item details.

20. Data Retention & Account Deletion ("Right to be Forgotten")

You have the right to access, rectify, or permanently delete your account data at any time. You can request complete account deletion directly from your Profile settings or by submitting a request via our Support & Queries page. All personal records, uploaded KYC documents, and listings will be permanently expunged within 7 business days once active rentals are concluded.

21. Privacy Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes:

• We will notify registered users via email at least 7 days before the changes take effect.
• A prominent notice will be displayed on the platform.
• The "Last Updated" date at the top of this policy will be revised.
• Continued use of the platform after the effective date constitutes acceptance of the updated policy.

22. Privacy Grievance Officer & Contact

In accordance with the Information Technology Act 2000 and the DPDP Act 2023, the designated Grievance Officer for privacy-related concerns is:

For any privacy-related questions, data access requests, consent withdrawal, or complaints, please email madhava2807@gmail.com with the subject line "Privacy Inquiry — [Your Concern]".