Privacy Policy

1. Who we are

DepotEase is operated by Dylan Graham trading as DepotEase, a UK sole trader. In this policy, “DepotEase”, “we”, “us” and “our” refer to that business.

Email: support@depotease.com

Website: https://depotease.com

2. Our role and the hire business's role

DepotEase acts as a controller for personal information used to manage its own account holders, subscriptions, support, security and business administration.

A hire business using DepotEase generally decides why and how it uses information about its own customers, contacts, hires, invoices, return photographs and related records. DepotEase provides the software used to process that information on the hire business's behalf. The exact legal roles can depend on the circumstances and should be considered alongside the agreement with the hire business.

If you are a customer or contact of a hire business, that hire business is normally your first point of contact about information it has entered into DepotEase.

3. Information we handle

Depending on how DepotEase is used, the service may handle:

• Owner and Staff names, email addresses, authentication identifiers and account status;
• the versions and timestamps of Terms acceptance and Privacy Policy acknowledgement;
• business names, contact details, addresses, VAT and invoice settings;
• staff invitation details and invitation status;
• customer and contact records entered by a hire business, including names, email addresses, telephone numbers and addresses;
• equipment, availability, hire, return and invoice information;
• notes and other free-text information entered by users;
• return photographs and business logos;
• Stripe customer, subscription and billing-status identifiers;
• support emails and other communications with DepotEase; and
• IP address, browser, device, request, timestamp and security or error-log information where it is generated or made available by the application and its service providers.

DepotEase does not store full payment-card details. Card details are handled by Stripe through its hosted Checkout and Customer Portal services.

4. How we obtain information

We receive information directly from account holders, from Owners who invite Staff, from hire businesses entering records about their operations and customers, and from the technical services used to operate DepotEase. Stripe also sends subscription and payment-status information to DepotEase.

5. Why we use personal information

We use personal information where relevant to:

• create, verify and operate DepotEase accounts;
• record the policies accepted when an account is created;
• provide equipment, customer, hire, return and invoice functionality;
• authenticate users and protect accounts, data and the service;
• manage trials, subscriptions, payments and account access;
• send account verification, password recovery, staff invitation and invoice emails;
• answer support requests and administer our business;
• detect, prevent and respond to abuse, fraud and security problems; and
• meet legal, accounting, tax, dispute-resolution or regulatory obligations where applicable.

6. Lawful bases

Where DepotEase acts as controller, the lawful basis depends on the purpose. We generally rely on contract where processing is needed to provide an account or subscription; legitimate interests for proportionate service administration, support, security, fraud prevention and improvement; and legal obligations where records or disclosures are required by law. We consider the interests and rights of affected people when relying on legitimate interests.

DepotEase does not currently use personal information for consent-based marketing tracking or a marketing-email system.

7. Service providers and sharing

We use the following providers to operate DepotEase:

• Supabase — authentication, PostgreSQL database services and private file storage;
• Stripe — subscription billing, hosted Checkout and the Customer Portal;
• Resend — transactional account, invitation and invoice email delivery;
• Netlify — website hosting, application runtime and deployment; and
• IONOS — the DepotEase support and business email mailbox where relevant.

These providers receive only the information needed for their technical role. We may also disclose information where required by law, to establish or defend legal rights, or to protect users, the public or the service from fraud, abuse or security threats. We do not sell personal information.

8. International processing

Some service providers may process information outside the United Kingdom depending on their systems, operations and the configuration used. DepotEase's current application repository does not specify a hosting region or a particular international-transfer mechanism, so this policy does not claim one. Where data-protection law requires safeguards for a transfer, the relevant provider arrangements and safeguards must be considered for that processing.

9. How long information is kept

DepotEase does not currently apply one fixed retention period to every category of information. We keep information while it is needed to provide and secure the service, administer the business and meet legitimate legal, accounting, tax, dispute or security requirements.

Historical hire and invoice records may remain. Issued invoices are intentionally locked against normal editing, and archived customer or equipment records are not necessarily deleted. Uploaded return photographs and business logos may also remain while connected records or legitimate retention needs continue. Ending a subscription or deactivating a Staff user does not automatically delete the business's records.

Contact support@depotease.com to ask about an account or data request. Some information may need to be retained where the law permits or requires it.

10. Security

DepotEase uses reasonable technical measures including Supabase authentication, database row-level security and tenant isolation, private storage buckets, time-limited signed file links and server-side validation for sensitive operations. Access is restricted according to account and business roles. No internet service can guarantee absolute security, and users must also protect their credentials and devices.

11. Your data-protection rights

Depending on the circumstances, you may have rights to be informed, access personal information, correct inaccurate information, request erasure or restriction, object to certain processing, and receive certain information in a portable format. These rights are not absolute and legal exemptions may apply.

To make a request about information controlled by DepotEase, email support@depotease.com. If the information was entered by a hire business about its customer or contact, we may need to refer the request to that business.

You may also complain to the UK Information Commissioner's Office. The ICO provides current guidance and complaint routes at https://ico.org.uk/make-a-complaint/.

12. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The date at the top identifies the current version.