Privacy Policy

Last updated: October 16, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. This Policy explains how personal data is processed. It is not a request for blanket consent; where consent is required for a particular operation, We request it separately.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

Account means a unique account created for You to access our Service or parts of our Service.
Affiliate means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
Application refers to Rental Agreements, the software program provided by the Company, available as mobile applications and web applications.
Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to Aleh Hutnikau, the operator of Rental Agreements.
Country refers to: Baden-Württemberg, Germany
Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
Document means a rental agreement, template, or other document created, filled in, or signed through the Service.
Participant means a person who is named in, fills in, reviews, or signs a Document, whether or not that person has an Account.
Personal Data is any information that relates to an identified or identifiable individual.
Service refers to the Application and the website rentalagreement.app.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

Email address
First name and last name
Account identifiers from the sign-in provider You choose (Google or Apple)
Usage Data

Documents and Participant Data

The Service lets You create, fill in, send, and sign Documents. Documents and the data entered into them may contain Personal Data of You and of other Participants, such as names, contact details, identity details, addresses, signatures, and photos (for example, photos of rented items). We process these data to operate the document and signing workflows. Depending on the processing activity and the purposes determined by a business account holder, We may act as a processor on behalf of that customer or as an independent controller. The exact roles and any required data processing agreement must be assessed for the relevant business use.

If You enter Personal Data of other Participants, You confirm that You are allowed to share it with Us for this purpose.

When a Document is sent for signature or signed, We record signing evidence: the time and method of signing (on the creator’s device or through a signature request), the IP address and browser or device information (user agent) used, the email address a signature request was sent to, and when the request was sent, opened, and signed. This evidence is stored with the Document, is included in the Document’s certificate (signing history), and is deleted together with the Document.

Usage Data

Usage Data is collected automatically when using the Service to improve and tailor the user experience and ensure the proper functioning of the application.

Usage Data may include information such as Your Device’s Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers, and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

We only access, store, and process Usage Data and any personal information You provide solely for the purpose of delivering, maintaining, and improving the Service. We are committed to protecting your privacy and will ensure that your data is handled securely and in compliance with applicable data protection laws.

Analytics and Crash Reports

Google Analytics (website only): with Your consent, We use Google Analytics (Google LLC) to understand how visitors use our website: pages visited (without document or link identifiers), browser and device type, approximate location derived by Google from Your IP address, and, in the future account-based web app if implemented, a pseudonymous user identifier. The public landing website does not attach an account identifier. It is used only after You accept analytics cookies in the banner shown on Your first visit; if You decline, Google Analytics is not loaded. You can change Your choice at any time through “Cookie settings” at the bottom of every page of the website. We have turned off Google signals, advertising personalisation, and data sharing with Google, and Google Analytics data is deleted after 2 months. The mobile app does not use Google Analytics, and pages used to sign or review Documents without an account never load it.
Firebase Crashlytics (mobile app): when the mobile app crashes or hits an error, it sends a crash report to Firebase Crashlytics (Google LLC) so that We can fix the problem: the technical error details, device model, operating system and app version, an installation identifier, and Your account identifier. We do not intentionally attach Documents or entered field values to reports. We minimise error details, but diagnostic information may include error metadata and must be handled as personal data. Google keeps crash reports for 90 days.

Security Checks

To protect the Service and Your Documents from automated abuse, the apps prove to our servers that requests come from our genuine app:

Google reCAPTCHA Enterprise (web app and signing pages): the web app and the pages used to sign or review Documents without an account load reCAPTCHA Enterprise (Google LLC). It collects hardware and software information, such as browser and device data and how the page is used, sets a cookie needed for this check, and sends this information to Google for analysis. Google uses it to provide and improve reCAPTCHA and for general security purposes, not for personalised advertising. The Google Privacy Policy and Terms of Service apply. Our website does not use reCAPTCHA.
Google Play Integrity and Apple App Attest (mobile app): the mobile app asks Google (Android) or Apple (iOS) to confirm that it is our unmodified app on a genuine device. This sends information about the app and the device to Google or Apple, never Your Documents or the information You enter in them.

Legal Bases and Data Protection Roles

For personal data processed by Us as controller, our possible GDPR Article 6 legal bases depend on the operation: (a) Article 6(1)(b), where necessary to provide account, subscription, and contracted Service functions to the individual concerned; (b) Article 6(1)(f), where supported by a balancing assessment, for security, fraud prevention, necessary diagnostic reporting, signing-event evidence, and handling disputes; (c) Article 6(1)(a), consent, for optional website analytics; and (d) Article 6(1)(c), where retention or disclosure is required by law. Where We act solely on a business customer’s instructions for participant-document content, the customer’s controller obligations and Our processor obligations must be addressed separately, including by a data processing agreement where Article 28 applies. For non-account Participants, contractual necessity for Our contract with the account holder does not automatically supply a legal basis for their personal data.

You may ask Us for information about any legitimate-interest balancing, Our role in a processing operation, and applicable processor arrangements.

Email Confirmation and Legal Notice Acceptance

To confirm an account profile email used for signature requests, We send a six-digit verification code to the address being confirmed. The code is valid for 15 minutes; a security-restricted record containing the code hash and verification state is maintained for the verification process and expires or is deleted according to the technical retention settings. We use the verified address as the reply-to address for emails sent to signing Participants. This address is distinct from Your account sign-in identifier.

If You accept an in-app legal notice, We record the notice identifier and version, language, hash of the text shown, server timestamp, platform, app version, and installation identifier. This helps document what was displayed and acknowledged. These acceptance records are deleted with the account under the current design, which limits our ability to later reconstruct historic acceptance.

Document Integrity and Verification

We may store cryptographic fingerprints of generated signed PDFs, exported pages, signatures, and related evidence to support document integrity and signing records. A fingerprint match does not prove the real-world identity or legal authority of a signer or guarantee enforceability. If public document verification is made available, the verification page calculates the selected file’s fingerprint locally and submits that fingerprint for matching rather than uploading the entire selected file. A successful match may show limited metadata such as document type, language, signing/completion time, and signer count; it does not need to reveal participants’ names or document content. Availability depends on the actual Service version.

Where GDPR applies, and subject to its requirements and exemptions, You may request access to personal data, rectification, erasure, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests. Where processing relies on consent, You may withdraw that consent without affecting earlier lawful processing. You may also complain to a competent data protection supervisory authority, including the authority in Baden-Württemberg, Germany. Use the contact address below to exercise Your rights. We may need to verify Your identity and must consider the rights and lawful interests of other document Participants when handling requests.

Retention, Copies and Processors

Documents and signing evidence remain in the active Service until the owning user deletes the document or account, or another disclosed retention event applies, subject to mandatory retention rules. Copies downloaded or received by other parties remain outside Our control. Signed documents should be exported by parties who need independent legal, tax, accounting, or evidentiary records.

Infrastructure and other processors include Google Firebase / Google Cloud (hosting, authentication, storage, and diagnostics), Google Analytics (website analytics with consent), reCAPTCHA Enterprise (security), and relevant email delivery providers. We restrict processor access according to contractual, organisational, and technical safeguards. Any additional processors and international-transfer mechanisms should be disclosed accurately and kept current.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To provide and maintain our Service, including to monitor the usage of our Service.
To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
To create, deliver, and sign Documents: to send Documents or signature requests to the Participants You choose and to generate the resulting files.
For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
To contact You: To contact You by email or other equivalent forms of electronic communication, such as a mobile application’s push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
To manage Your requests: To attend and manage Your requests to Us.
For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
To evaluate and improve the Service: data analysis and identifying usage trends, using Usage Data.

We do not sell Your Personal Data and do not use the content of Your Documents for advertising.

We may share Your personal information in the following situations:

With Service Providers: We may share your personal information with third-party service providers who assist us in providing and improving our services. These providers help us with tasks such as hosting, data storage, authentication, sending emails, technical support, and customer communications. We ensure that these service providers safeguard your personal data and only use it to perform specific functions on our behalf as outlined in their agreements with us. The Service is hosted on Google Firebase (Google Cloud).
With Participants: when You send a Document for review or signature, or invite people to sign it, the Participants You choose can see the Document and the data it contains.
For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.
With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company also retains Usage Data for internal analysis purposes, where a lawful basis applies. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. The Service is hosted in the United States. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. Transfers from the European Union are protected by the Standard Contractual Clauses used by our hosting provider.

Accepting this Privacy Policy does not constitute consent to an international transfer. Where relevant, transfers are based on an applicable adequacy decision or safeguards under Chapter V GDPR, such as Standard Contractual Clauses; details of applicable safeguards may be requested using the contact address below.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

The Company will maintain certain data that you transmit to the Services for the purpose of managing the performance of the Services, as well as data relating to your use of the Services. The Company is committed to securing your data and utilizes various safeguards to protect sensitive personal information. These measures include, but are not limited to:

Encryption: We use encryption to protect data in transit and at rest, ensuring that your information remains confidential and secure during transmission and storage.
Confidentiality and Integrity: We have implemented measures to maintain the ongoing confidentiality, integrity, availability, and resilience of our processing systems and services.
Access Controls: Your Documents and files are accessible only to You by default. We restrict access to personal data to authorized personnel only, ensuring that your data is accessed strictly on a need-to-know basis.
Private Links: links sent to Participants for reviewing or signing are unguessable, expire, can be revoked, grant access only to the Document they were sent for, and are excluded from search engines.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update or amend some of Your information in the Service. You can delete Your Account in the mobile app via Settings > Account > Delete account, or contact Us by email to request account deletion or exercise applicable data protection rights. Where required by GDPR, We respond without undue delay, usually within one month, subject to lawful extensions. Account deletion removes stored agreements, signed documents, templates, catalog items, photographs and signing evidence from the active Service and invalidates active signing and document-sharing links. Export copies you need before deleting; copies already downloaded or shared with other parties cannot be remotely deleted. Deleting Your Account does not cancel an App Store or Google Play subscription; cancel it separately in the relevant store. Backup copies and records required by law may persist for limited periods described by the applicable retention schedule.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation
Protect and defend the rights or property of the Company
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of Users of the Service or the public
Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Children’s Privacy

Our Service is intended for account holders aged at least 13, subject to any higher legal age or parental authorisation requirements. Details of minors may nevertheless appear in documents submitted by adult users, and are processed under the applicable legal basis and safeguards. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent’s consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the “Last updated” date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, you can contact us by email: support@rentalagreement.app