Privacy Policy

HyreKit is a rental booking app for Shopify, developed and operated by Offsite OÜ (registry code 14061956), Estonia, EU. This policy explains what data the app accesses, why, where it is stored, and how it is deleted.

Data the app accesses

To run rental bookings, HyreKit reads order data from your store through Shopify’s Admin API, meaning order and line-item details that are tied to rental products (rental dates, quantities, product references), together with the customer name and email address on the order. Under Shopify’s Protected Customer Data rules we request those two fields only, for the single purpose of rental lifecycle emails. HyreKit does not request or store phone numbers or shipping addresses.

Data the app stores

• Per-store configuration: your rental products, stock units, availability rules, cleaning buffers, deposits, late-fee and discount settings.
• Booking records: product reference, rental window (dates), and the related Shopify order reference.
• The customer name and email address from the rental order, plus the order’s language, used to send booking confirmations, return reminders and the self-service cancellation link.
• A log of which emails were sent for which booking, including the recipient address, so no reminder is sent twice.

The application and its database are hosted in an EU data centre (Frankfurt, Germany), on storage with encryption at rest enabled. Booking confirmation and reminder emails are delivered by Resend (see Subprocessors below), which processes in the United States.

A fuller, plain-language account of what the app can and cannot see is published at Data and Security.

How the data is used

Solely to operate HyreKit’s rental features inside your store admin and storefront: calculating availability, preventing double-bookings, and managing deposits, extensions and returns. Your data is never sold, rented, or shared for advertising, and it is not used to train any model.

Subprocessors

• Shopify Inc., the platform your store runs on.
• Fly.io, EU application hosting (Frankfurt).
• Resend, delivery of booking confirmation and reminder emails. Resend is a US company and processes in the United States, relying on Standard Contractual Clauses and the EU-US Data Privacy Framework. Customer lifecycle emails can be switched off entirely in the app’s Emails settings, in which case no customer data is sent to Resend.

Retention and deletion

Data is kept while the app is installed. When you uninstall HyreKit, your store’s data is erased in line with Shopify’s mandatory data-erasure request (shop/redact), normally within 48 hours of Shopify’s notification. Customer data access and erasure requests are handled through Shopify’s customers/data_request and customers/redact webhooks.

Security

All traffic is encrypted in transit (TLS). Stored data is accessible only to the HyreKit application and the operator.

Your rights

Under the EU General Data Protection Regulation (GDPR), merchants and their customers may request access to, correction of, or deletion of data held about them. Contact us and we will respond.

Contact

Offsite OÜ · Estonia, EU · hyrekit@offsite.ee · +372 5885 7474 · Registry code 14061956