Legal
Privacy Policy
What data we collect, why we need it, who else sees it, and how to get it back or deleted.
What this privacy policy covers
This privacy policy explains how Sharepact collects, uses, stores and shares your personal data when you use our website and mobile app (together, the "Platform"). Sharepact is the data controller for that data.
We follow the EU General Data Protection Regulation and the UK GDPR. Where the two differ, whichever gives you more applies to you.
This policy is written to be read. If something in it is unclear, write to support@sharepact.com and we will explain it in plain words.
Article 1 — Who we are
Sharepact operates the Platform and decides why and how your data is processed.
Contact for anything on this page, including every request under Article 7: support@sharepact.com.
We have not appointed a Data Protection Officer. We are not required to have one: we do not monitor people on a large scale and we do not process special categories of data as our core activity.
Article 2 — What we collect
2.1. What you give us.
- Account: email address, password, and the alias other Users see. Your legal name and surname when you verify your identity.
- Profile: profile photo, city, a short description, phone number.
- Listings: photos, description, category, condition, declared value, price, and a pick-up area.
- Identity: an identity document and a selfie, handled by our verification provider (Article 4). We do not keep the document.
- Payments: your bank details for payouts and your card details for payments, both handled by our payment provider. We never see or store a full card number.
- Tax details: when you cross the reporting thresholds, the information we are required to report (Article 5).
- Messages and support: what you write in chat, in reviews, in a dispute, and to support.
2.2. What we collect while you use the Platform.
- Technical data: device type, operating system, app version, IP address, and the errors the app reports when something breaks.
- Location: only with your permission, and only to show you Objects nearby. The exact coordinates of a Listing are never published: what other Users see is a point shifted by a random offset, so an Object cannot be located at an address.
- Activity: rentals, checklists and their photographs, reviews, and the dates and amounts of each transaction.
2.3. What other Users can see. Your alias, your profile photo, your city, your reviews and your Listings. A business account shows its trading name instead of an alias. Your legal name is never shown. Your phone number and the exact pick-up address are shared with the other party only once a Rental is confirmed, because at that point you have to meet.
Article 3 — Why we process it, and on what basis
| Why | Legal basis |
|---|---|
| Create and run your account | Performance of a contract |
| Run rentals: requests, payments, deposits, checklists, returns | Performance of a contract |
| Verify identity, to keep one person to one account and reduce fraud | Legitimate interest, and legal obligation where it applies |
| Moderate messages and content (Article 4) | Legitimate interest in keeping the Platform safe |
| Support and dispute handling | Performance of a contract |
| Keep the Platform working: error reports, security, abuse prevention | Legitimate interest |
| Report earnings to tax authorities (Article 5) | Legal obligation |
| Send you a newsletter, if you asked for one | Consent, withdrawable at any time |
We do not profile you for advertising, we do not run behavioural remarketing, and we do not sell your data. No decision that affects you legally is taken by a machine alone.
Article 4 — Who else sees your data
We use specialist providers to run parts of the service. Each one acts on our instructions, is bound by a data processing agreement, and may use your data only for the task we give it.
| Category of provider | What it does | What it sees |
|---|---|---|
| Cloud infrastructure | Database, accounts, file storage | What you store on the Platform |
| Payment provider | Payments, deposits, payouts | Card and bank details, amounts |
| Identity verification | Checks your identity document | Your document and selfie |
| Automated content screening | Screens messages for abusive content, drafts listing text, suggests item values | Listing text and the text of messages |
| Notifications | Delivers push notifications | A device token, not the content of your messages |
| Sign-in providers | Sign-in, when you choose it | Your name, email address and an account identifier |
| Error reporting | Crash reports | Technical data about the device |
An up-to-date list of the providers in each category is available on request from support@sharepact.com.
About message moderation. The text of messages sent in chat is checked automatically for abusive content before delivery, by a provider operating within the European Economic Area. No person at Sharepact reads your chats as a matter of routine; we look at a conversation only when someone reports it or opens a dispute.
About identity documents. Your document and selfie go to the verification provider, which performs the check. We receive the outcome, not the document. What stays with us is whether you are verified and a salted fingerprint that prevents the same document verifying a second account. The fingerprint cannot be turned back into your document.
We also share data with public authorities when the law requires it, and with professional advisers under a duty of confidentiality.
Article 5 — Where your data is, and how long we keep it
5.1. Where. Your data is stored on servers in the European Economic Area. Where a provider processes data outside it, the transfer rests on an adequacy decision or on Standard Contractual Clauses, with the additional measures those require.
5.2. How long.
- Account and profile: while your account is open.
- Rentals, invoices and payment records: 10 years after the transaction, because tax and accounting law requires it. This survives closing your account.
- Tax reporting data: for the period the reporting rules impose.
- Chat messages and checklist photographs: while the account is open, and longer where a dispute is open or a claim is still possible.
- Identity verification: the outcome and the fingerprint, while the account is open. The document itself is kept by the verification provider under its own retention rules.
- Error reports: 90 days.
5.3. Tax reporting. European rules require us to report Owners who, in a calendar year, complete more than 30 rentals or earn more than €2,000 through the Platform. We report the identifying and income details those rules specify to the tax authority, which may pass them to the authority of your country of residence.
Article 6 — What happens when you close your account
Closing your account removes your personal details: legal name, photo, city, phone number, pick-up address and notification tokens.
Two things remain, and we would rather be clear about them. Your public alias stays on the conversations you already had, so the person you rented with still sees the name they always saw. And the rental and payment records stay for the period in Article 5.2, because we are required to keep them.
Your Listings stop being visible.
Article 7 — Your rights
You can ask us to:
- give you a copy of your data, in a portable format;
- correct anything that is wrong;
- delete your data, except what we must keep under Article 5.2;
- restrict or object to a processing we base on legitimate interest;
- withdraw a consent you gave, which does not affect what was lawful before.
Write to support@sharepact.com. We answer within one month. We do not charge for this, and we will not ask you why.
If you think we have handled your data badly, you can complain to the supervisory authority in the country where you live. In Italy that is the Garante per la protezione dei dati personali, in France the CNIL, in the United Kingdom the Information Commissioner's Office. We would rather you wrote to us first, but it is your choice and not a condition.
Article 8 — Security
Data is encrypted in transit and at rest. Access inside the Platform is restricted by row-level rules in the database, so one account cannot read another's data even by asking the server directly. Payment details never touch our servers. Passwords are stored hashed and we cannot read them.
No system is perfect. If a breach ever puts your rights at risk, we will tell you and the supervisory authority within the deadlines the law sets.
Article 9 — Children
The Platform is for adults. You must be at least 18 to hold an account. We do not knowingly collect data from children, and we delete it if we find we have.
Article 10 — Cookies
How the website uses cookies, and which ones it actually sets, is set out in our Cookie Policy.
Article 11 — Changes to this policy
We may update this policy. Substantial changes take effect 30 days after publication and we will tell you before they do. Corrections that change nothing for you take effect when published.
Article 12 — Contact
Privacy, data requests and anything else on this page: support@sharepact.com
Last updated: 3 October 2026
