End-to-End Encryption
TLS 1.3 in-transit and AES-256 at-rest. Sensitive identity documents and biometric contracts are stored in cryptographically isolated storage.
Strict Retention Expiry
Completed transaction media archives expire automatically after 3 days (Free tier) or 7 days (Paid tiers) before permanent purging.
Zero Data Brokering
Rentl never sells, leases, or trades user identity data, rental logs, or equipment inventories to third-party advertisers.
1. Scope & Operating Entity
Rentl (“we,” “us,” or “our”) is a universal peer-to-peer rental marketplace platform operated by Nicolei Games in the Republic of the Philippines. This Privacy Policy governs all interactions with Rentl mobile applications (Android APK), Progressive Web Applications (PWA), and related web properties (collectively, the “Platform”).
Rentl operates under a Unified Account Model. A single registered account may alternate between Lessor (asset owner/lender) and Lessee (renter/customer) operational modes. The policies outlined herein apply equally across both operational capacities.
2. Categories of Information We Collect
To provide verifiable physical custody transfers, prevent equipment theft, and generate legally binding contracts, Rentl collects the following categories of data:
A. Identity Verification & Account Data (KYC)
When registering or verifying an account to list or book high-value assets, you provide your legal full name, mobile phone number, email address, physical delivery or handover address, and government-issued identification cards (such as Philippine Passport, Driver's License, or UMID).
Purpose: Verification of legal contracting age, prevention of fraud, identity matching against mobile sign-offs, and compliance with Philippine Anti-Money Laundering and consumer safety standards.
B. Physical Condition Audit Logs (2 to 5 Photos)
Before any physical rental handover unlocks into an active state, the Rentl mobile application requires capturing a minimum of 2 and a maximum of 5 high-resolution condition photos via the device camera. The same 2-to-5 photographic capture protocol is enforced upon physical item return.
Purpose: Indelible, tamper-evident record of physical asset condition before and after custody transfer to eliminate cosmetic or functional disputes.
C. Digital Contracts & Biometric Signatures
During physical check-in, both lessor and lessee execute an on-glass digital handwritten signature. This signature is cryptographically embedded directly into a generated PDF legal contract containing transaction terms, serial numbers, security deposit schedules, and liability provisions.
Purpose: Creation of a legally enforceable rental agreement recognized under the Philippine Electronic Commerce Act of 2000 (Republic Act No. 8792).
D. Business & Commercial Registration Attachments
Lessors subscribed to Mid Size or Commercial Business tiers may optionally attach official government business permits, Bureau of Internal Revenue (BIR) Certificates of Registration (Form 2303), or Department of Trade and Industry (DTI) / Securities and Exchange Commission (SEC) registration documents.
Purpose: Verification of legitimate commercial rental business status for public storefront badges and automated invoicing.
3. End-to-End Encryption & Storage Security
Rentl enforces a defense-in-depth cryptographic security model designed to safeguard sensitive identity documents, contract agreements, and physical condition logs:
- Data In-Transit: All communication between user client applications (Android and Web/PWA) and Rentl backend infrastructure is encrypted using Transport Layer Security (TLS 1.3) with strong cipher suites. Unencrypted plaintext HTTP traffic is strictly rejected.
- Data At-Rest: Database records, user metadata, and object storage containers are encrypted using AES-256 standard encryption keys managed under strict role-based access policies.
- Access-Controlled Object Buckets: Identification card uploads, biometric signature vectors, and generated contract PDFs are stored in private, cryptographically restricted storage buckets. Access is governed by strict document-level security rules that permit read/write access solely to authenticated parties who are direct counterparties to that specific booking.
- Zero Token Storage: Payment card numbers, CVVs, and banking credentials are never transmitted through or stored on Rentl servers. All payment handling is offloaded to PCI-DSS Level 1 certified processors using tokenized sessions.
4. Strict Tiered Data Retention & Auto-Purge Policy
Rentl does not retain transient rental media indefinitely. We adhere to a strict tiered lifecycle policy that automatically purges completed rental photographic logs and media archives once their statutory operational window closes:
| Subscription Tier | Archive Retention Window | Automated Action Post-Completion |
|---|---|---|
| Starter Free Tier (₱0) | 3 Days (72 Hours) | Handover photos, temporary media, and chat archives are queued for permanent, unrecoverable deletion after 72 hours from completed return (Step 9). |
| Mid Size Rental Business (₱499/mo) | 7 Days (168 Hours) | Transaction archives, condition audit logs, and exportable reports are retained for 7 calendar days before automated media purging. |
| Commercial Business (₱999/mo) | 7 Days + Automated Email Dispatch | Upon completion of Step 9 (excluding optional rating), the full signed PDF contract and itemized receipt are automatically dispatched directly to lessor and lessee registered email addresses, before the 7-day cloud media archive expires. |
5. Third-Party Disclosures & Zero Data Brokering
Rentl does not engage in third-party data brokerage or targeted behavioral advertising. We only disclose information to third parties under the following strict operational necessities:
- Transaction Counterparties: Verified full legal names, contact numbers, and agreed handover locations are shared exclusively between the confirmed lessor and lessee of an active booking.
- Infrastructure & Payment Processors: Cloud storage providers (Google Cloud Platform / Firebase security rules), subscription management (RevenueCat), and transactional messaging providers operating under strict confidentiality and security terms.
- Legal Process & Formal Dispute Arbitration: In the event of confirmed equipment theft, total loss, or intentional breach of contract, signed contract PDFs, KYC credentials, and condition photo logs may be provided to Philippine law enforcement agencies or competent courts upon valid judicial subpoena.
6. Your Rights Under Philippine Law (RA 10173)
As a data subject under the Philippine Data Privacy Act of 2012, you possess the following statutory rights regarding your personal information:
7. Data Protection Officer (DPO) Contact
For inquiries regarding our cryptographic security standards, data retention schedules, or to exercise any of your statutory privacy rights under Republic Act No. 10173, contact our designated Data Protection Officer: