Privacy Policy

Lendlet is owned and operated by MergeCreative, LLC, a Florida limited liability company, which is the controller of the personal information described here. This Privacy Policy explains what personal information Lendlet collects when you use lendlet.co and our services, how we use it, and the choices you have. Using Lendlet means you agree to the practices below.

You give us:

• Account info: name, email, phone number, password (we store a hash, not your password).
• Profile: display name, optional avatar, optional biographical text.
• Listings: the item details, photos, and pickup address you publish as a lender.
• Bookings, messages, and reviews you create on the platform.
• Photo evidence: pickup, return, and claim photos with their embedded timestamp and location, which we validate.
• Support correspondence: emails or messages you send us.

Collected automatically:

• Device and usage data: IP address, browser/user agent, pages viewed, actions taken, approximate location derived from IP.
• Cookies and local storage: small files we use to keep you signed in, remember preferences, and measure how the product is used.

From third parties:

• Identity verification: we use Stripe Identity to verify your government-issued ID and confirm it matches the person using the account. Stripe provides us with the verification result and limited metadata; we do not store images of your ID.
• Payments: Stripe handles card data directly. We store Stripe identifiers (customer IDs, PaymentIntent IDs, Connect account IDs) — never raw card numbers.

• To operate and improve Lendlet — sign-in, search, bookings, payouts.
• To process payments and prevent fraud.
• To verify your identity and eligibility to lend or rent.
• To send transactional emails (booking confirmations, receipts, reminders, cancellation notices, claim updates).
• To respond to support requests and enforce our Terms of Service.
• To measure product usage and diagnose errors so we can fix bugs and ship improvements.

We rely on a small set of trusted vendors to run the service. Each only receives the data they need, and only for the purposes described:

• Supabase — application database, authentication, file storage, realtime messaging.
• Stripe — payment processing, identity verification (Stripe Identity), and lender payouts (Stripe Connect Express).
• Resend — transactional email delivery.
• Sentry — error monitoring (may include limited request metadata).
• PostHog — product analytics (events you trigger in the app, with identifiers we control).
• Vercel — application hosting and CDN.
• Inngest — background job execution (cancellation cron, payout scheduling, reminders).

We do not sell your personal information, and we don't share it with advertisers.

Lendlet treats listing photos and booking-evidence photos differently:

• Listing photos(what you publish on the marketplace) have location and other EXIF metadata stripped before they're displayed publicly.
• Pickup, return, and claim photos retain EXIF timestamp and location because we use those values to verify the rental events. These photos are visible only to the parties of the booking and to Lendlet ops.

On the public listing page we show an approximate area, not the exact pickup point, so that the precise address can't be inferred. The exact address is only shared with a renter once their booking is confirmed.

Information you share through the platform is visible to people you interact with: a renter sees your display name, profile, listing details, and (after confirmation) pickup address; a lender sees the renter's display name and profile. Reviews are blind until both sides have submitted (or 14 days pass), after which both reviews become visible on the reviewer's and reviewee's profiles.

We keep account, booking, payment, and tax records for as long as your account is active and for the period our auditors, legal obligations, and fraud-prevention needs require. When you delete your account, we delete or anonymize data that is no longer needed; some records (e.g., financial transactions, claims) are kept for the period required by applicable law.

• Access and update: review and update your profile from Settings.
• Delete your account: request deletion in Settings or by emailing support@lendlet.co.
• Email preferences:transactional emails can't be turned off while your account is active. We do not send marketing email at launch.
• Cookies: you can clear or block cookies in your browser settings; some product features rely on them and may not work without them.

We use TLS in transit, encryption at rest where supported by our vendors, row-level security in the database, and least-privilege access for our team. No system is perfectly secure; please use a strong, unique password and notify us immediately if you suspect account abuse.

Lendlet isn't intended for anyone under 18, and we don't knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we'll delete it.

Lendlet operates from the United States. By using the service, you understand that your information will be processed in the U.S. and other countries where our service providers operate.

When we change this policy we'll update the “last updated” date above. For material changes we'll give in-product or email notice. Continued use after the effective date means you accept the updated policy.

Questions or requests? Reach us at support@lendlet.co.