Privacy Policy

1. Who We Are and the Roles We Play

Korent ("the Service") is a rental-business management platform. Depending on whose data is involved, we act in one of two distinct roles:

• Korent as controller. For operator account data (your name, email, business details, billing records), for visitors to our own marketing site, and for the product analytics described in section 7, Korent decides how and why the data is processed and is the data controller.
• Korent as processor / service provider.For the customer records that operators enter or collect through their storefronts (renter names, contact details, delivery addresses, order history, signed documents), the operator is the controller and Korent processes that data only on the operator's behalf and instructions. If you rented from a business that uses Korent, please direct privacy requests to that business first — they control your data, and we assist them in fulfilling your request. If you cannot reach them, contact us at privacy@korent.app and we will help route your request.

2. Information We Collect

• Account information: name, email address, phone number, and business details when you create an operator account.
• Customer data:names, email addresses, phone numbers, and delivery addresses that operators enter for their rental customers, or that customers submit through an operator's storefront, checkout, or waiver/document forms.
• Payment information: payment records and transaction details. Credit card processing is handled entirely by Stripe — we never store card numbers.
• Usage data: pages visited, features used, and actions taken within the dashboard (collected only as described in section 7).
• Communication records: logs of emails and text messages sent through the platform (recipient, subject, and a short preview), and messages customers send to operators.
• Marketplace data (Korent Marketplace at rent.korent.app): renter identity-verification photos (a government ID photo and a live selfie — see section 3), verified phone numbers, messages between renters and sellers (screened by automated moderation), booking and payment records, item condition photos uploaded at handoff and return, reviews, and demand requests (searches and waitlist signups, including email).

3. Identity Verification Photos (Marketplace)

To make in-person handoffs safer, renters upload a government ID photo and a live selfie before booking. These images are stored in a private bucket and are viewable only by (a) the seller at handoff through short-lived links so they can visually confirm you are you, and (b) Korent personnel when a dispute requires it. A human compares the photos. We do not use facial recognition and do not create biometric templates, faceprints, or scans of face geometry — from these images or any others. Verification photos are retained while your account is active because they are used at each rental handoff, and are deleted within 30 days of an account-deletion request.

4. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process transactions and send transactional emails (order confirmations, payment receipts, status updates)
• Respond to support requests and inquiries
• Enforce our Terms of Service and prevent abuse
• Send product updates and service announcements (with opt-out)
• Send text and WhatsApp messages for verification codes and rental notifications when you provide your phone number (reply STOP to opt out; we do not send marketing texts)
• Power optional AI and integration features, as described in sections 5 and 6

Legal bases (operators and site visitors in the EEA/UK).Where Korent acts as controller (see section 1), we rely on the following lawful bases under Article 6 of the GDPR/UK GDPR for each purpose. For renter/customer data that we process on an operator's behalf, the operator (as controller) is responsible for the lawful basis.

Where we rely on legitimate interests, you may object at any time (see section 11); where we rely on consent, you may withdraw it at any time without affecting prior processing.

5. AI Features

The dashboard includes an AI assistant ("Copilot") operators can use to ask questions about their business. When an operator uses the Copilot, we send the operator's message, the recent conversation history, and a snapshot of the operator's business context — which can include order details, operational status, and customer names, email addresses, and recent message excerpts — to an AI model provider: OpenAI (our primary Copilot provider) or Anthropic (used as a fallback). Anthropic also powers optional translation of operator-authored email template copy, and automated categorization of marketplace listing text (titles and descriptions). The public storefront can additionally offer an optional AI Booking Desk; when a website visitor uses it, their typed messages — questions about availability, products, and delivery, plus any contact details they choose to share — are sent to the same providers (OpenAI, with Anthropicas a fallback) to generate a grounded answer from the operator's published catalog.

We access both providers through their business APIs, under terms which state that data submitted via the API is not used to train their models. AI features that involve customer data are used only to provide the Service to the operator — we do not sell this data or use it for advertising.

6. Subprocessors and Data Sharing

We do not sell your personal information. We share data only with the service providers below, each processing data under their own privacy policies and a data-processing agreement or equivalent terms. The current list is always published at korent.app/subprocessors.

Identity-verification photos are shared with no one beyond the handoff and dispute uses described in section 3. We may also disclose information when required by law, to protect our rights or the safety of users, or as part of a merger or acquisition (with notice to you).

7. Cookies and Analytics

We use two categories of cookies:

• Strictly necessary cookies — authentication and session management, your language preference, your active organization, and your cookie-consent choice itself. These are always on; the Service cannot function without them.
• Analytics cookies (PostHog) — loaded only after you affirmatively accept the cookie banner. Until you accept, no analytics code runs, no analytics cookies are set, and no usage data leaves your browser. Your choice is stored in a first-party cookie (korent_analytics_consent) for about 12 months. Declining changes nothing about how the Service works — we simply collect no usage data.

To change your choice, delete the korent_analytics_consent cookie in your browser settings (the banner will re-appear on your next visit), or contact privacy@korent.app. We do not use advertising cookies and do not permit third parties to track you across other sites.

8. Data Security

We implement industry-standard security measures including encrypted connections (TLS), row-level security policies on all database tables, rate limiting on authentication endpoints, and secure session management. Sensitive operations are recorded in an append-only internal audit log.

9. Data Retention

• Account and business data is retained while your account is active.
• Account deletion: when an operator deletes their account, the organization is soft-deleted with a 30-day grace period (so an accidental deletion can be reversed), after which it is queued for permanent removal.
• Customer deletion:when an operator deletes a customer record, the customer's name, email, phone, and notes are removed immediately, and residual personal data in communication logs (recipient addresses, message subjects and previews) is automatically purged 90 days later. The 90-day window exists so billing or dispute issues that surface shortly after deletion can still be investigated.
• Signed documents: signed rental agreements, waivers, and similar records may be retained longer than the underlying customer record because they serve as legal evidence of an agreement, for as long as legal claims relating to the rental remain possible.
• Marketplace records (bookings, evidence photos, dispute records) are retained for as long as needed to administer rentals, resolve disputes, and meet tax and legal obligations. Identity-verification photos follow the rule in section 3.

10. International Data Transfers

Korent is operated from the United States and our subprocessors are primarily US-based. Where personal data of EEA, UK, or Swiss residents is transferred to the US, we rely on the EU-US Data Privacy Framework (for providers that are certified) and on Standard Contractual Clauses (SCCs) or equivalent safeguards otherwise.

11. Your Privacy Rights

Depending on where you live, you have some or all of the following rights. To exercise any of them, email privacy@korent.app— we respond within the timeframe required by your jurisdiction's law. If you are a rental customer of a business that uses Korent, contact that business first (see section 1).

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format (CSV export available in-app)
• Object to or restrict certain processing
• Withdraw consent at any time (e.g., analytics — section 7)
• Opt out of non-essential communications

EEA / UK: the rights above reflect the GDPR and UK GDPR. You may also lodge a complaint with your local supervisory authority.

California: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Service — so no opt-out of sale/sharing is needed. You may exercise your access, deletion, correction, and portability rights via privacy@korent.app, including through an authorized agent, and we will never discriminate against you for doing so.

Quebec (Law 25): Quebec residents have equivalent rights of access, rectification, and de-indexing. Our designated person in charge of the protection of personal information can be reached at privacy@korent.app.

Australia: we handle personal information of Australian users consistent with the Australian Privacy Principles; complaints may be raised with us first and then with the OAIC.

12. Children's Privacy

The Service is a business tool for rental operators aged 18 and older and is not directed to children. We do not knowingly collect personal information from children. Waiver and participant forms may record information about minors (e.g., a child attending an event), but that information is provided by an adult — a parent, guardian, or the operator — never collected from the child directly.

13. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or in-app notification. Continued use of the Service after changes constitutes acceptance.

14. Contact

For privacy-related questions or data requests, contact us at privacy@korent.app.