Privacy Policy

1. Introduction

Splitt ("we," "our," or "us") connects renters with vendors who list high-value outdoor gear (ATVs, jet skis, e-bikes, tents, and other camping and adventure equipment) for rent. Because we handle identity verification, saved payment methods, and security deposits for high-value transactions, we want to be direct about what we collect and why. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform (the "Service"). Please read it carefully; if you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

We collect information you provide directly, information we need to verify your identity for high-value rentals, and information generated through your use of the Service.

2.1 Account Information

When you register, we collect your name, email address, date of birth, and a password (which we store using a salted, industry-standard one-way hash; we never store or can see your actual password). Phone number and profile photo are optional and can be added from your profile. If you sign up or log in with Google or Apple instead, we receive your name and email address from them and never see a password.

2.2 Identity Verification (KYC)

Because Splitt facilitates rentals of high-value equipment, we ask you to verify your identity before booking or listing certain gear. This includes:

• A photo or scan of a government-issued ID (such as a driver's license or boater's license), which we store in cloud object storage and make available only for identity review. We are actively strengthening the access controls on these document images.
• Sensitive details from that document (your license number, full legal name, and date of birth), which are separately encrypted at rest (AES-256) and only decrypted when needed for review or to confirm your identity.
• Where offered, an optional biometric liveness check (a live selfie compared against your document) for the highest tier of verification on our highest-value equipment.

We may use automated text-extraction (OCR) on uploaded documents to speed up review, but that automation only assists. It never makes the final call. A human member of our team always reviews and decides whether to approve or reject a verification. Once approved, we retain your verified legal name on file (separate from the display name shown to other users) so we can confirm you're renting or listing under your real identity.

2.3 Address & Emergency Contact

For certain high-value rentals, you can (or may be asked to) provide a home address and an emergency contact name and phone number. We use this only for insurance and emergency purposes. For example, if you're injured or unreachable during a rental. It is never shown on your public profile or to other users.

2.4 Payment Information

All payments are processed by Stripe, our PCI-compliant payment processor. Splitt never sees or stores your full card number. When you book, Stripe securely vaults your payment method so we can charge it again, off-session, for the specific things you agreed to at checkout: the rental price, a security-deposit hold, an approved damage or incidental charge, or a date-change charge. Security deposits are placed as a card authorization hold (not an upfront charge), and that hold may be re-authorized if your rental is still active or runs overdue.

2.5 Booking, Review, Messaging & Claims Data

• Booking history: the dates, pricing, and status of your rentals.
• Reviews: what you write about a rental is stored and shown publicly on the relevant listing or profile; we run reviews through automated content moderation before they're visible, to catch abusive or unsafe content.
• Messages: conversations between a renter and a vendor about a booking are stored so both sides have a record. A conversation is visible only to its two participants and to Splitt (for support and safety purposes).
• Waiver signatures: when you sign a liability waiver, we keep a snapshot of the exact waiver text and version you agreed to, along with your typed signature and timestamp, and we email you a copy for your records.
• Damage claims: if a claim is filed for damage or an incidental charge, we store the claim details and any supporting evidence (photos, documentation) submitted by either side.
• Vendor insurance records: vendors may submit their own liability/property insurance information (carrier, policy number, coverage type, dates, and a supporting document) so we can confirm coverage on their listings.
• Usage & device data: pages visited, search queries, and standard technical data like IP address and browser type.

3. How We Use Your Information

We use the information above to:

• Provide, operate, and improve the Service, including matching renters with vendors
• Verify your identity and eligibility for high-value or age-restricted gear
• Process bookings and payments, including security deposits and disclosed off-session charges
• Send booking confirmations, receipts, verification updates, and other service communications
• Provide customer support and resolve disputes, damage claims, and disagreements between users
• Run automated and human content moderation on reviews and messages to keep the platform safe
• Send marketing communications, but only if you've opted in (see Section 5)
• Detect, investigate, and prevent fraud and other illegal activity
• Comply with legal, tax, and insurance obligations

4. Cookies & Tracking Technologies

We use cookies and similar browser storage (like localStorage) to run the Service. We split them into two groups:

• Essential (always on): keeps you signed in, protects against fraud and abuse, and remembers functional choices like your currency and your cookie-consent decision itself. These can't be switched off without breaking core features.
• Analytics (only with your consent): first-party usage analytics and, if enabled, third-party tools, so we can understand how Splitt is used. Nothing in this category runs until you choose "Accept all", or switch Analytics on under "Preferences", in our consent banner.

You can change your choice anytime via "Cookie Preferences" in the footer. See our Cookie Policy for the full breakdown of what we store and why. You can also block cookies entirely in your browser settings, though features like staying signed in may stop working.

5. Marketing Communications & Your Choices

Marketing is opt-in, not opt-out. When you register, the marketing checkbox starts unchecked. We only send you deals, tips, and product updates if you actively choose to receive them. You can change your mind at any time: every marketing email includes a one-click unsubscribe link, and you can manage your preferences (marketing offers vs. product updates) from your email-preferences page.

Transactional emails (booking confirmations, verification status, payment receipts, security alerts, and other account notices) are not marketing. We send these regardless of your marketing preference because they're necessary to operate your account and keep you informed about your own transactions.

5.1 How We Measure Marketing Emails

When we send you a marketing email, we measure how it performed: whether the message was opened (via a small invisible image loaded from our servers), whether you clicked a link in it, and whether that click reached the Splitt site and what you did next in that visit. These measurements are recorded against your account and email address, not anonymously, so we can tell how many people a campaign actually reached and stop sending to people who aren't interested. You can prevent open tracking by turning off remote images in your email client, and you can stop this entirely by unsubscribing from marketing email (see above). We do not apply this measurement to transactional emails you cannot opt out of.

6. How We Share Your Information

We share information only in these circumstances:

• Service providers: Stripe (payments and identity verification), Vercel (hosting and secure file storage for documents and photos), Supabase (our database), and the email/communications providers that deliver the messages described above. Each is contractually limited to using your data to provide their service to us.
• The other party to a booking: renting is inherently two-sided. When you book, the vendor sees your name and booking details to fulfill the rental; when you list gear, renters see your name and listing details. This is how the marketplace works, not an optional share.
• AI-assisted tooling: some content (review text, search queries, and, optionally, verification documents for OCR assistance) is processed by third-party AI providers to help us generate suggestions, moderate content, and speed up manual review. These providers only receive what a given task needs.
• Advertising & analytics measurement: when configured, we may send a minimal signal for a completed booking (its dollar value, currency, and timestamp, keyed to an internal booking ID) to advertising and analytics platforms (such as Meta and Google) so we can measure whether our marketing is working. This does not include your name, email, address, or any contact information. Any browser-based version of this (ad pixels or analytics tags) is also subject to the cookie choices in Section 4.
• Legal & safety reasons: we may disclose information to comply with a legal obligation such as a subpoena or court order, to enforce our Terms, or to protect the safety of our users or the public, for example, investigating a damage claim or safety incident.
• Business transfers: if Splitt is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy.

We do not sell your personal information, and we have not sold it in the past 12 months.

7. Data Retention

We keep your personal information for as long as your account is active or as needed to provide the Service. Some records must be kept longer regardless of account status: signed waivers and transaction records are retained as required by applicable law and for financial recordkeeping, and disputed or claimed transactions are kept until the matter is resolved. We also use automated tools to periodically clean up stale operational data (such as expired sessions or old login records) that we no longer need. When you request deletion under Section 9, we deactivate your account right away and remove it from public view; for 30 days afterward we can restore it if the request was made in error, after which we permanently anonymize the rest (including irreversibly deleting your identity-document images), subject to the legal-retention exceptions above.

8. Security

We use technical and organizational safeguards appropriate to the sensitivity of the data involved: passwords are hashed (never stored in plain text), the sensitive details extracted from identity documents (license number, legal name, date of birth) are encrypted at rest with AES-256, connections to the Service are encrypted in transit (TLS), and payment data never touches our servers. It's handled directly by Stripe. Identity data is used only by the systems and team members who need it for verification, and we continue to harden how document images are stored and accessed. That said, no method of transmission or storage is 100% secure, and we can't guarantee absolute security.

9. Your Privacy Rights

9.1 All Users

• Access & export: download a copy of your data anytime using "Download my data" on your profile. You'll get a JSON file covering your account, bookings, reviews, favorites, and saved searches.
• Correction: update your name, contact details, address, and other profile information directly from your profile page.
• Deletion: email privacy@go-splitt.com or support@go-splitt.com to request deletion of your account and personal information. You can also delete your account yourself at any time from your profile page ("Delete account", password-confirmed): we deactivate it immediately and permanently anonymize it after 30 days, following the process described in Section 7.
• Marketing opt-out: unsubscribe anytime: see Section 5.

9.2 California & Other U.S. State Residents

If you live in California or another state with a comparable privacy law, you may have additional rights: to know what categories of personal information we've collected and why, to request deletion (subject to the legal exceptions above), to correct inaccurate information, and to opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information and have not sold it in the past 12 months. We will not discriminate against you for exercising any of these rights. To exercise a right under this section, contact us at privacy@go-splitt.com.

9.3 Users Outside the United States

Splitt is a U.S. company and the Service is built for the U.S. market. We do not maintain an establishment in the European Union or United Kingdom, and this section is not a substitute for a formal GDPR notice. If you access Splitt from outside the U.S., you may still have rights similar to those above (access, correction, deletion, restriction, portability, and objection to certain processing), and we'll make reasonable efforts to honor them on the same basis as our U.S. process. By using Splitt from outside the U.S., you understand your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

10. Age Requirement & Children's Privacy

Our Terms of Service require you to be at least 13 years old to create an account, and at least 18 years old to book a rental or list gear. We collect your date of birth at registration and check it before you can book or list anything, because high-value rentals involve binding contracts, security deposits, and liability that minors can't legally assume. We do not knowingly collect personal information from children under 13; if we learn that a child under 13 has provided us with personal information, we will take steps to delete it. If you believe a child has given us information, contact us at privacy@go-splitt.com.

11. Changes to This Policy

The July 12, 2026 version was a full rewrite that reflects how Splitt actually operates today (identity verification, saved payment methods and security deposits, cookie consent, and opt-in marketing), replacing an earlier version that no longer matched the product. The August 15, 2026 revision corrected the age requirement in Section 10 to state the real thresholds (13+ to hold an account, 18+ to book or list) and added Section 5.1 disclosing how we measure marketing email. We'll continue to update this policy as our practices change; we'll post revisions here and update the "Last updated" date, and for material changes we may also notify you by email.

12. Contact Us

If you have any questions about this Privacy Policy or want to exercise any of the rights above, please contact us: