Privacy Policy

This Privacy Policy explains how Supersonic Rentals ("we", "us", "our") collects, uses, and shares personal information through Rental Pilot (the "Service"). It applies to organization administrators and staff who use the Service, and to individuals whose information is entered into the Service by a Rental Pilot customer (for example, a customer's own rental clients).

If your organization uses Rental Pilot to manage your own customers' information, your organization is responsible for that data as between you and your customers; this policy describes how we, as the platform operator, handle information that passes through our systems.

1. Information We Collect

Depending on how the Service is used, we collect:

• Account & organization information: name, email, phone, company/organization name, website, industry, and password (stored as a salted hash, never in plain text).
• Customer records entered by your organization: names, phone numbers, email addresses, and physical addresses of the people and businesses you rent equipment to.
• Equipment & operational records: asset details, rental agreements, work orders, deliveries and returns, photographs of equipment or job sites, and signature images captured for agreement sign-off.
• Employee timesheet records: clock-in/clock-out times entered by your staff. We do not collect GPS or precise location data through the mobile app.
• Payment information: subscription payments are processed by Stripe. We do not receive or store your full card number — only a Stripe-issued customer/subscription reference.
• Technical & usage information: IP address, browser/device type, and pages visited, including on our public marketing pages before you ever create an account. On those public pages we use our own first-party analytics to see which pages, links, and sources lead to sign-ups. It sets no cookies: it uses a random identifier that lasts only as long as your browser tab, and stores your IP address only as a one-way hash.

2. How We Use Information

• To provide, maintain, and secure the Service;
• To process subscription billing and send related notices;
• To send transactional communications (for example, account confirmations and, subject to our internal review process, notifications relevant to your rentals);
• To respond to support requests;
• To monitor for errors, abuse, and to keep the Service reliable;
• To comply with legal obligations.

We do not sell personal information, and we do not use customer data entered into the Service to serve you third-party advertising.

3. Who We Share Information With

We use a small number of third-party service providers to operate the Service. Each receives only the information needed to perform its function:

• Stripe (payment processing) — receives billing name, email, and organization identifier to process subscription payments. Stripe, not us, handles and stores full card details.
• Amazon Web Services (AWS) — hosts the Service and stores uploaded files (equipment photos, signed agreements, documents) on our own servers, not a public bucket. AWS SES also delivers our outgoing email, and AWS Textract processes document images you explicitly submit for text-recognition (OCR).
• Twilio — used to mirror certain in-app staff chat messages to WhatsApp for organizations that enable that feature; message text and the relevant phone numbers pass through Twilio to do so.
• Photon (OpenStreetMap/komoot) — an address look-up service used to power address autocomplete when entering delivery or customer addresses. Only the address text you type is sent, not your device's location.
• Google Analytics (Google LLC) — measures visits to our public marketing pages and which ones lead to sign-ups. It receives page addresses, approximate location, and device/browser details, and may set cookies on those pages.
• A site-analytics IP lookup service — the first time a browser visits our public marketing pages, we send the visitor's IP address to a geolocation lookup service to record approximate visit origin (city/region/country) for our own internal analytics; we store a one-way hashed version of the IP, not the raw address.

We may also disclose information if required by law, to protect the rights and safety of Supersonic Rentals, our customers, or the public, or in connection with a merger, acquisition, or sale of assets (with notice to affected customers where required by law).

4. Data Retention

We retain information for as long as your organization's account is active, and for a reasonable period afterward to allow for data export, dispute resolution, or legal compliance. We do not currently offer a fully automated self-service "delete my data" tool inside the Service; if you'd like your organization's data deleted, contact us (Section 8) and we will process the request manually within a reasonable time.

5. Data Security

We use industry-standard safeguards, including encrypted transport (HTTPS), salted password hashing, and access controls scoped to authenticated staff and their organization's own data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your Rights

Canadian users: under PIPEDA (or applicable provincial privacy law), you may request access to, or correction of, personal information we hold about you.

California and other U.S. users: depending on applicable state law, you may have the right to request access to, deletion of, or details about the personal information we hold about you, and to not be discriminated against for exercising these rights. As noted above, we do not sell personal information.

To exercise any of these rights, contact us using the details in Section 8. If your information was entered into the Service by a Rental Pilot customer organization (rather than provided directly by you), we may need to direct your request to that organization, as they control that data.

7. International Data

Our infrastructure and service providers are located in Canada and the United States. If you access the Service from elsewhere, your information will be transferred to and processed in these countries.

8. Children's Privacy

The Service is intended for business use and is not directed to individuals under 18.

9. Changes to This Policy & Contact

We may update this Privacy Policy from time to time; material changes will be announced by email or in-app notice. Questions or requests regarding this policy can be sent to rent@supersonicrentals.ca.