Data and Security

Last updated 3 August 2026

HyreKit is a rental booking app for Shopify, built and operated by Offsite OÜ, a company registered in Estonia (reg. 14061956), in the EU.

This page exists for one specific moment: you have found an app with few reviews from a company you have never heard of, and before you click Install you want to know what you are handing over. So here is the whole picture, including the parts that do not flatter us.

What the app asks for at install

Shopify shows you a permission list when you install any app. This is ours, with the reason for each one.

Permission	Why HyreKit needs it
`write_products`	Create and update rental products and their availability settings in your catalogue.
`read_orders`, `write_orders`	Read rental orders, and update them when a booking is extended, returned or cancelled.
`write_draft_orders`	Create the draft order used to charge rental extensions and late fees.
`read_customers`	Read the name and email address on a rental order, so booking confirmations and return reminders reach the right person.
`read_cart_transforms`, `write_cart_transforms`	Add the deposit line to the cart at checkout.
`write_discounts`	Apply the multi-day rental discount you configure.

Check us against this list. The permissions Shopify shows you on the install screen should match the table above exactly. If that screen asks for more, stop and email us before installing. The comparison is yours to make, not something you have to take on trust.

Under Shopify's Protected Customer Data rules we request two fields and two only: customer name and customer email, for the single purpose of rental lifecycle emails. Not phone, not address, not order history. Shopify publishes the protected fields an app has requested, so this paragraph is checkable against the platform rather than against us.

What the app stores

Your rental setup: which products are rentable, how many units exist, availability rules, buffers, deposit amounts, discount and late-fee settings.
Booking records: product reference, rental start and end dates, quantity, status, deposit status, the related Shopify order reference, and the order's language. If you use the equipment features, also which physical unit went out, pickup and return timestamps and who handled them, meter readings, and any note about condition or damage on return.
Customer name and email taken from the rental order, used to send that customer their booking confirmation, return reminder and self-service cancellation link.
A log of which emails were sent for which booking, including the recipient address, so nobody receives the same reminder twice.
One security-relevant item, spelled out: we keep the token from that order's Shopify status-page URL. It is what lets a renter open their own cancellation link without creating an account, so it is a secret of the same kind as the Shopify order link itself. It is stored as-is because it has to be compared against the incoming link, and it is deleted when the booking is deleted.
Your staff session: the name, email and Shopify access token of the store user who installed or opened the app. Be clear-eyed about that token, because it is the key that lets HyreKit act on your store and it is the most valuable thing we hold. Two things bound it. It works only within the permissions in the table above, so it cannot reach your payouts, your staff list or your other apps. And you can destroy it without asking us: uninstalling HyreKit deletes it from our database and Shopify invalidates it on their side. The kill switch is in your admin, not in our inbox.
Equipment and maintenance records if you use those features: asset tags, serial numbers, service history, engine hours.
Scanner pairing: if you connect the Android Companion app, its device token is stored only as a bcrypt hash. That token itself is never written to our database, and you can revoke one device without disturbing the others.

What the app never sees

Card numbers and payment credentials. Payment is handled entirely by Shopify and your payment provider, and none of it passes through HyreKit.
Customer passwords or account credentials.
Phone numbers and shipping addresses. We do not ask Shopify for these fields and we do not store them. One honest caveat: the raw order notification Shopify pushes to us can contain them, because Shopify sends the whole order. We read the rental lines out of it and keep nothing else. A second caveat for later: we are building optional booking-form questions you can write yourself, and whatever a renter types into your own question is stored with the booking. If you ask for a phone number, we will hold a phone number. This page will say so plainly on the day that feature ships.
Storefront browsing behaviour. HyreKit installs no advertising pixel and no visitor tracker on your shop. You can verify this in thirty seconds: open a rental product page with your browser's network tab and watch where the requests go.
Your other apps, your payouts, your staff list. All of it sits outside the permissions above.

The one claim we will not make. Plenty of vendors write "nobody can see your data, not even us". We cannot say that and stay honest. Every shop's records sit in one database on one server, and our operator can read that database directly when debugging a problem or restoring a backup. That is one named person at a company of our size, not a support department, and it is the same access any small self-hosted vendor has whether or not they mention it. There is no screen anywhere in HyreKit that shows one merchant another merchant's data, and every query the app makes is filtered to a single shop.

Where the data lives

The application and its database run on Fly.io in Frankfurt, Germany (region fra), inside the EU. Nothing is mirrored to a second country. The storage volume has encryption at rest enabled, and all traffic is forced onto HTTPS, so the data is encrypted both where it sits and while it moves.

Backups in plain terms: the disk is snapshotted automatically and the last five snapshots are kept, which is roughly five days of history. If the machine and its disk were both lost, we would restore from the most recent snapshot, and you could lose up to a day of bookings. We would tell you exactly which day rather than restore quietly and hope you did not notice.

The half of that story most vendors leave out: HyreKit runs on one machine in one city, with no automatic failover. If it goes down, your shop keeps selling everything else, but the rental calendar and the booking form are unavailable until it is back. For a rental business whose week is decided on Saturday morning, that is a real risk to weigh rather than read past. When the traffic justifies a second machine, this paragraph changes and you will hear about it.

Who else touches the data

Sub-processor	Role	Location
Shopify Inc.	The platform your store already runs on	Per your Shopify agreement
Fly.io	Application and database hosting	Frankfurt, Germany (EU)
Resend	Delivery of booking confirmation and reminder emails	United States

One small flow, for completeness: when HyreKit is installed or uninstalled, the app sends your shop's domain name, and nothing else, to our own internal notification system, so that a human knows a new shop has arrived and can check in.

The US question, and the switch that answers it. Your renters' emails are delivered by Resend, a US company that processes in the United States. The recipient's name and email address therefore leave the EU in order to be delivered. Resend covers those transfers with Standard Contractual Clauses and certifies under the EU-US Data Privacy Framework. Your booking database itself never leaves Frankfurt.

If you would rather no renter data went to a US provider at all, you do not have to negotiate with us. Open Emails in the HyreKit admin and switch off confirmation, reminder and late notice. With all three off, no renter name or address is ever sent to Resend, the booking calendar keeps working exactly as before, and you send whatever emails you want from Shopify instead.

One thing stays true even then, so you hear it here rather than discover it: your own store address is still used with Resend for operational alerts to you, such as a customer cancelling a booking or an automatic refund failing. That is your address, not your customers'.

GDPR, and what you can ask for

For the data your renters give you, your store is the data controller and HyreKit is your processor. We act on your instructions and on the requests Shopify forwards to us. If your accountant or data protection officer needs a written processor agreement under Article 28 before you install, email us and we will send one.

Shopify's three mandatory privacy webhooks are implemented and live:

customers/data_request. When Shopify forwards one of your customers' access requests, a person here compiles what HyreKit holds for that customer's orders, meaning their bookings and the record of emails sent, and returns it to you so you can answer inside your own one-month deadline. This one is answered by a human rather than automatically, and we would rather say so than let you assume a machine has it covered.
customers/redact, which deletes the bookings belonging to that customer's orders, together with the email log entries for them.
shop/redact, which erases your shop's bookings, rental products, sessions, assets, maintenance plans, service events, blackout dates and holds.

Being precise about that last one, because "everything" would be a stretch: the automatic sweep does not yet clear your cached app settings, the send log for emails already delivered, or paired-scanner records. We are changing that. Until it ships, ask us and we will delete them by hand and confirm in writing, and we would rather publish that sentence than leave you to discover it.

If you uninstall HyreKit, the erasure above runs on Shopify's notification, normally within 48 hours. Under the GDPR you and your customers may request access to, correction of, deletion of, or a copy of the data held, and may object to processing.

How long we keep it. While the app is installed, booking records stay for as long as you keep them, because a rental business needs last season's history and we do not silently expire it. If you want a limit, for example clearing renter names and email addresses twelve months after a rental ends, ask and we will set it for your shop.

If something goes wrong

If we discover a breach affecting your shop's data, we email the address on your Shopify account without undue delay and in any case within 72 hours of becoming aware, and we tell you what happened, which data was involved and what we have done, before we work out how it looks. You are the controller, so the clock for informing your own supervisory authority is yours. Our job is to get you the facts fast enough to meet it. If we do not yet know the full scope, you get the partial picture on time rather than the complete picture late.

Getting your data out

Your orders, products and customers were never ours. They live in Shopify and they stay there when HyreKit goes. What HyreKit adds on top is the booking calendar, the rental settings and the equipment records.

There is no one-click export button for those inside the app today. That is a gap, and on a page like this it would be dishonest to leave it out and let you find it at three hundred bookings. Until we build it, email us and we will send your bookings and equipment records as CSV, free, whether or not you are still a customer.

What we do not claim

Security pages tend to imply more than the company behind them has. Ours will not.

We are not SOC 2 or ISO 27001 certified. Those audits cost more than a company of our size can currently justify, and implying an equivalent would be dishonest.
There is no round-the-clock security operations centre. There is a small team in Estonia that answers its own email quickly, including evenings and weekends. That is a support promise, not a monitoring promise. Nobody here is watching an alarm dashboard at three in the morning and we are not going to imply otherwise.
HyreKit is a young app with a short public track record. Rather than ask you to take that on faith, here is what you can check without us. Offsite OÜ, registry code 14061956, is a matter of public record in the Estonian Business Register, including incorporation date, registered address, board member and filed annual reports. The permission list on your install screen should match the table at the top of this page. And the no-tracker claim takes half a minute to test in your own browser. Judge us on those and on how fast we answer, not on this page's tone.

What we do commit to: your data is never sold, never rented, never shared for advertising, and never used to train AI models. The same goes for the sub-processor table above. If we add one, this page is updated and installed merchants are emailed before any data reaches the new provider, so you have time to object or to leave. When any of this changes, it gets written here first, not afterwards.

Contact

Offsite OÜ · Estonia, EU · hyrekit@offsite.ee · +372 5885 7474 · Registry code 14061956

A security concern you would rather not raise in a public channel goes to the same address. You get a human reply rather than a ticket number.

Offsite OÜ · Reg. 14061956 · Estonia, EU · Privacy Policy · Support · HyreKit