Rentablez Guard Privacy Policy

1. Who This Policy Covers

This Privacy Policy explains how Squapl Digital Media Technologies (OPC) Pvt Ltd, which operates Rentablez ("Rentablez", "we", "us"), handles personal data in Rentablez Guard: the Guard web application, the Rentablez Guard agent installed on Windows, macOS and Linux (Beta) devices, and the Guard features inside the Rentablez rental management software.

It covers two groups of people:

• Staff users: the people at a rental business (the "Customer") who sign in to the Guard web application. For their account, billing and usage data, Rentablez is the data controller.
• End users: the people who hold a managed device, usually the Customer's own renting customers. For data reported by a device, the Customer is the data controller and Rentablez is the data processor acting on its instructions, as set out in the Rentablez Guard Data Processing Agreement. End users exercise their rights through the Customer (see section 7).

The general Rentablez Privacy Policy continues to apply to the rental management software and the rentablez.com website.

2. Information We Collect

2.1 From staff users of the Guard web application

• Name, email address, role and organisation.
• The organisation email address and WhatsApp or mobile number used to receive alerts, and the alert channel choices.
• Sign-in records, and an audit trail of actions taken in Guard (who locked, unlocked, located, paired, approved an uninstall, revealed a BIOS password, or offboarded Guard, and when).

2.2 From the agent on a managed device

• Device identity and hardware: asset tag, hostname, agent version, and a hardware fingerprint made up of component identifiers and serial numbers (processor, memory, storage, network adapters, motherboard). Where the Customer's unit record is blank, the serial number, manufacturer and RAM / storage are filled in from this record.
• Device status: check-in times, online or offline state, lock state, lock and unlock history, offline unlock code use, pairing codes and pairing records, uninstall requests and the decision on them, and agent events.
• Network and approximate location: the public IP address the device connects from, used to work out an approximate, city-level location. The address is kept to avoid repeated lookups and is not shown to staff users.
• Security settings: reported BIOS anti-theft and operating-system format protection status (Beta), and a BIOS supervisor password the Customer chooses to store, kept encrypted.
• Machine health (Linux, optional): processor and memory use, system load, disk space per filesystem, the highest temperature reading, uptime and the names of failed system services.

2.3 Precise location (optional)

Only when the agent was installed with Precise location switched on, and the end user consented, the device reports its Wi-Fi or GPS position and accuracy. Rentablez turns the coordinates into a street address for display. The Customer may switch this off, and the agent reports when it has been turned off on the device.

2.4 Billing

Licence counts, invoices and payment status. Card and bank details are entered with Stripe or Razorpay and are never stored by Rentablez.

2.5 What the agent never collects

The agent does not read documents or files, capture the screen, log keystrokes, record the camera or microphone, or track browsing, application use or logon hours. "Machine health" describes the condition of a Linux device, not the health of any person.

3. How We Use Information

• To lock, unlock and locate devices on the instruction of the Customer's authorised staff, and to show device status.
• To pair devices to the Customer's account, pass uninstall requests to the Customer, and carry out approved uninstalls and offboarding.
• To detect hardware changes against a device's recorded baseline and send the alerts the Customer has chosen.
• To show Linux machine health and alert the Customer when a reading is critical.
• To manage licences, renewals and payments, and to provide support.
• To keep the Service secure, including the per-device signed requests and the audit trail.
• To comply with the law and respond to lawful requests from authorities.

Rentablez never sells personal data, never uses it to train artificial-intelligence or machine-learning models, never uses it for advertising, and never locks, unlocks or locates a device on its own initiative.

4. Sharing Information

Rentablez shares personal data only with the service providers needed to run Rentablez Guard, each bound by data protection obligations:

• Cloud hosting providers for infrastructure, storage and backups.
• Email and WhatsApp delivery services, only to send the alerts the Customer has turned on to its own staff.
• Payment providers (Stripe, Razorpay) for subscription payments.
• Map and reverse-geocoding providers (Ola Maps in India, OpenStreetMap elsewhere) to turn a precise location into an address and show maps. Only coordinates are sent; no device or person is identified.

Approximate location is worked out from the IP address using a database hosted by Rentablez itself; the address is not sent to a third party for that purpose. Rentablez may also disclose data where required by law or a lawful order, or to protect the rights and safety of end users, customers or Rentablez.

5. How Long We Keep Information

• Location history is deleted automatically after 90 days.
• Machine health history is deleted automatically after 30 days; only the latest reading is kept beyond that.
• The Customer may delete a device's agent, hardware, location, BIOS, format protection and health records from Guard at any time. The audit record that the deletion took place is kept.
• Uninstalling the agent stops all further reporting from that device.
• After a Guard subscription ends, the Customer may export its data within 30 days. Rentablez deletes it from active systems within 60 days and purges backups within 90 days, unless Indian law requires longer.

6. Security

• Data is encrypted in transit (TLS) and at rest on cloud infrastructure.
• Every device has its own key, and every request from the agent is signed, so one device cannot report for, or receive commands meant for, another.
• Each Customer's data is separated and visible only to that Customer's users.
• Stored BIOS supervisor passwords are encrypted with a dedicated key (AES-256-GCM) and can be revealed only by the Customer's administrators.
• Access by Rentablez staff is role-based, limited to what support requires, and covered by confidentiality obligations.
• If a confirmed security incident affects personal data, Rentablez notifies the affected Customer within 72 hours of becoming aware of it.

7. Your Rights

Staff users can see and correct their account details in the Guard web application, and can ask Rentablez to export or delete their data by email.

End users who want to know what a managed device reports, or who want it corrected or deleted, should contact the business that rented them the device. That business controls the data and decides how to respond. If Rentablez receives a request directly from an end user, it passes the request to that business without undue delay and helps it respond.

Under India's Digital Personal Data Protection Act, 2023, you may also have the right to nominate another person to exercise your rights and to raise a grievance; see section 12.

8. Cookies and Browser Notifications

The Guard web application uses cookies strictly needed to keep you signed in and to protect the session. It does not use advertising or cross-site tracking cookies.

You may turn on browser notifications from the bell in the Guard web application, for uninstall requests and new agent builds. This stores a push subscription for that browser, which you can remove at any time from the bell or your browser settings.

9. Children

Rentablez Guard is a business service and is not directed at anyone under 18. Rentablez does not knowingly collect personal data from children. Where a managed device is used by a minor, the renting business is responsible for the lawful basis of that use.

10. Where Information Is Processed

Rentablez Guard is hosted on cloud infrastructure that may be located outside the country of the Customer or the end user. Where data about people in other jurisdictions (for example, the European Union) is processed, Rentablez cooperates with the Customer to put appropriate safeguards in place.

11. Changes to This Policy

Rentablez may update this policy to reflect changes in law, in what Rentablez Guard collects, or in its business practices. Material changes are announced at least 30 days in advance by email or in the Guard web application, and the version and effective date at the top of this page are updated.

12. Governing Law and Contact

This policy is governed by the laws of India, with exclusive jurisdiction of the courts of Bangalore, Karnataka. Questions, requests and grievances about this policy can be sent to contact@squapl.com.