Privacy Policy

Version 1.0-draft, effective on the date this policy is published: [OWNER REQUIRED: effectiveDate, set to the publication date when this version is published]
Owner decisions applied: 2026-10-12. Checked against the product: 2026-10-12.

---

1. About this policy

Yardstick (Yardstick Rental Software LLC, "Yardstick", "we", "us") makes software for equipment and trailer rental businesses. This policy explains what personal information we handle, why, who we share it with, how long we keep it, and the choices you have. Yardstick is a US business and the Service is aimed at US rental businesses.

It covers:

• Site visitors to getyardstick.co, including people who ask for a demo;
• Business users: people at rental businesses who have a Yardstick account (owners, managers and staff);
• Renters: people who rent from a business that uses Yardstick.

2. Our two roles

Where Yardstick decides how information is used (we're the "controller" or "business"). This covers:

• business account and administrator information;
• billing administration for Yardstick subscriptions;
• security, fraud prevention and abuse prevention;
• support requests;
• demo requests and other sales leads (for example from our /rescue/ page);
• marketing preferences;
• product feedback sent to us from inside the app; and
• our own measurement of how the product and our campaigns are used.

Where Yardstick processes information for a rental business (we're its "processor" or "service provider"). This covers renter and customer information that a rental business enters into Yardstick or collects through it: rental records, emails to renters, signed agreements, condition photos and AI Damage Check evidence, and identity-verification information handled for the business. The rental business decides what it collects and why, and its own privacy notice applies. Our Data Processing Addendum sets out how we handle that information. Renters: if you have a question or request about your rental data, contact the rental business first (see section 11).

3. Information we collect

Site visitors and demo requests

• The marketing site (getyardstick.co) doesn't use third-party advertising pixels, behavioural-advertising cookies or an analytics service. Its scripts are our own and are served from getyardstick.co. Our hosting provider receives standard request information, such as IP address and browser type, when you visit.
• Demo request form. If you ask for a demo (for example on our /rescue/ page), the form is sent to our application and we store what you enter: your name, business name and email address, and, if you give them, phone number, website, what you rent, how many units, what you use today, rentals per month, what slows you down, and your message. We record that you agreed to be contacted about your request, whether you separately asked for product updates and offers, when, and which version of that wording you saw. If you send the form again with the same email address, we keep one record, count the submissions, and keep what a later submission proposed alongside it without overwriting what you first gave. We also record how we follow up (for example contacted, demo scheduled or closed), with notes from our team.
• Campaign information. When available, we record the campaign tags in the link you followed (the utm_source, utm_medium, utm_campaign, utm_content and utm_term parameters), the referring website's host name (never its full address) and the page you landed on. On getyardstick.co a small script of ours copies these into the form within the page you're viewing; it sets no cookies and stores nothing in your browser. If you follow a link to create an account, the same values are passed to the app, kept in your browser's session storage until you finish signing up (so they survive the "Sign in with Google" step, when Google sign-in is offered) and stored with your new account. We use this only to measure and attribute our own campaigns, not to track you across other websites.
• If you later create an account with the same email address, we may link your demo request to it. With Google sign-up (when it's offered) this happens automatically because Google has confirmed the address; with a password sign-up, our team confirms the match first.
• We don't store your IP address with a form submission. It's used briefly, in memory, to limit repeated submissions.
• If you email us, we receive what you send.

Business account information

• Names, email addresses, phone numbers (if entered) and roles of business users.
• Passwords, stored only as one-way hashes.
• If you use "Sign in with Google" (when it's offered): your Google account ID, email address and name. We don't receive your Google password.
• Business details you enter, such as business name, contact details, locations, equipment, prices, policies and settings.
• Which versions of the Terms of Service and this policy you accepted, when, and how you signed up.

Product feedback

If you send feedback from inside the app, we store your feedback and limited account context: your business account, your user account and role, your plan, the Yardstick page you were using, the app version, your device type (phone, tablet or desktop, based on screen width), whether you agreed to a follow-up, and, when known, how your business first found Yardstick. The feedback form doesn't collect your IP address, browser details, the full page address or screenshots. We use feedback to understand problems, improve the Service and, if you agreed, follow up with you.

Renter information (handled for the rental business)

• Name, phone number and email address.
• Booking details: equipment, dates and times, pickup and return location, whether delivery was requested, prices, notes and damage-waiver choices.
• Electronic signatures on rental agreements: the typed name, an image of the drawn signature, the time of signing and a fixed copy of the agreement that was signed.
• Photos of the equipment's condition at pickup and return, taken by the business's staff or uploaded by the renter on the self-service return page.
• AI Damage Check results on those photos and the business's own review decisions (see section 6).
• Quotes, invoices and payments the business records as taken outside Yardstick (for example cash or check).
• Identity-verification results and any "ID on file" photos (see section 4).

Payment information

• Yardstick subscriptions are billed by Stripe, which collects and holds card details. Yardstick stores the Stripe customer and subscription IDs, the plan, the subscription status and the billing-period dates, not card numbers.
• Renter card payments aren't currently offered through Yardstick. If we add them, they'll be processed by Stripe for the rental business, and we'll update this policy first.

Information collected automatically

When you use the app or a renter page, our hosting provider and our application record technical information needed to run and secure the Service, such as IP address, browser type, the page or action requested and error details. Our application logs avoid recording email addresses and secret links. IP addresses are also used, in memory only, to limit repeated requests.

4. Identity verification and ID photos

Stripe Identity. Some rental businesses require identity verification for some rentals. This is done by Stripe Identity: the renter photographs a government ID and takes a selfie on a page hosted by Stripe, and Stripe checks that they match. Stripe performs that identity and biometric matching under its own privacy policy and retention practices (https://stripe.com/privacy). Yardstick doesn't do facial recognition. Yardstick receives the verification status and the verified name, and stores those with the booking. Yardstick doesn't receive the ID images, the selfie or Stripe's biometric identifiers. Before starting, the renter sees a notice on the Manage Rental page explaining this. A renter who can't or would rather not verify online can contact the rental business, and an owner or manager can release the rental another way with a recorded reason.

"ID on file" photos. Separately, a rental business's team can attach a photo of a renter's ID and a photo of the renter to a booking, for example at the counter. Yardstick stores these for the business. Only the business's owners and managers can view them; other staff can add them where the business allows it but can't browse them. Yardstick doesn't analyze them or use them for face matching. See section 10 for how long they're kept.

5. How we use information

We use personal information to:

• provide the Service to rental businesses, including bookings, agreements, inspections, quotes, invoices and renter self-service pages;
• send transactional emails on behalf of rental businesses and service emails to business users (see section 7);
• run AI Damage Checks and AI Help (see section 6);
• show identity-verification results to the business that requested them;
• sync invoices with accounting software when a business connects it;
• keep each business's activity log (see section 8);
• bill Yardstick subscriptions;
• reply to demo requests, decide whether Yardstick may suit the business, arrange a demo or guided onboarding, and, only for people who asked for it, send product updates, educational content and offers;
• measure which of our campaigns bring in requests and sign-ups, using the campaign information above, counted in our own database;
• understand product feedback and improve the Service;
• secure the Service, prevent fraud and abuse, and fix problems;
• meet legal, tax and accounting obligations.

We don't sell personal information, and we don't "share" it for cross-context behavioural advertising. We don't use renter information or photos to train AI models. We don't use third-party advertising pixels or behavioural-advertising cookies. If we ever want to add an analytics service or an advertising pixel, we'll update this policy before turning it on.

6. Artificial intelligence

Yardstick uses Anthropic's Claude models, through the Anthropic API, for two things. Details are on the AI Damage Checks page.

• AI Damage Check. By default, when return photos are recorded for a rental that also has pickup photos (whether staff or the renter upload them), up to 8 pickup and 8 return photos and the equipment's name are sent to Anthropic for analysis, within the business's monthly allowance. An owner or manager can turn the automatic check off; a team member can still run one by hand. The result flags possible changes for a person to review. It doesn't decide fault, liability, repair cost or whether to charge anyone; a person at the business makes every decision.
• AI Help. When a business user asks the in-app Help assistant a question, the question, up to 8 earlier messages in that conversation, the app page, the user's role and a minimal set of account facts (such as plan, counts and which settings are on; no renter names, contact details, booking details or amounts) are sent to Anthropic. Anything the user types is sent as written. AI Help takes no action in the account. Yardstick doesn't keep the question text on its servers.
• Photo suggestions. When a business adds equipment, its name and category may be sent to Anthropic to suggest which photos to take.

What Anthropic does with it. Anthropic's Commercial Terms of Service (last updated June 17, 2025) say Anthropic "may not train models on Customer Content from Services". Anthropic's Privacy Center article "How long do you store my organization's data?" (https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data, updated July 1, 2026, checked 2026-10-12) says API inputs and outputs are automatically deleted from Anthropic's back end within 30 days, unless a longer period is agreed, is needed to enforce its Usage Policy (up to 2 years for flagged content), or is required by law. [OWNER REQUIRED: confirm the Yardstick API account is on Anthropic's standard Commercial Terms and Data Processing Addendum with no different retention arrangement, and re-check both pages on the publication date.]

7. Emails

• To renters, for the rental business: quotes, booking request received, confirmed, declined and cancelled emails, agreement-signing links, identity-verification links, Manage Rental links, steps left before pickup and, only if the business turns them on, reminders. They're sent through our email provider, Resend, from noreply@getyardstick.co, in the business's name, with replies going to the business when it has set a contact email. They're transactional, not marketing.
• To business users: service emails such as password resets, team invitations, trial reminders, plan-change confirmations, cancellation and read-only notices. Stripe sends payment receipts and failed-payment notices.
• To people who request a demo: we reply about your request and may contact you about a demo or guided onboarding. That doesn't sign you up to marketing. We send product updates, educational content and offers only if you ticked that separate box, and you can stop them at any time (see section 11).
• See the Communications Policy.

8. Activity log

Each business has an activity log recording important actions in its account (for example bookings created, cancelled or deleted, price overrides, signatures, inspections and damage decisions, identity-verification changes, releases without verification with the reason, deposit changes, settings changes and integration connections), with when it happened and which team member did it. Entries often include the renter's name. All of the business's team members can see it.

9. Who we share information with

We share personal information with the service providers that help us run Yardstick (listed, with what each does, on our Sub-processors page), with the rental business the information belongs to, with services a business or user chooses to connect (such as QuickBooks Online, Xero or Google sign-in, whose own privacy policies apply), or when the law requires it. We may also disclose information to protect rights and safety, or as part of a merger, acquisition or sale of assets, with notice where required.

App and renter pages load fonts from Google Fonts, so Google receives your IP address and browser information when those pages load. The booking page and Manage Rental page also load Stripe's script (Stripe.js), which may set Stripe cookies and collect device information for fraud prevention, even though renter payments aren't currently offered.

10. How long we keep information

These are the maximum periods we've set. [OWNER REQUIRED: before publishing, put a working deletion mechanism (an automated job or a documented manual procedure) behind every period below. Today nothing is deleted automatically: the ID-photo removal job is built but switched off, and no other period has a mechanism yet.]

A subscription ending, or the read-only recovery period ending, doesn't by itself delete an account's data. A business can ask us to delete its account (see section 11).

Secure links sent to renters stop working after a set time: Manage Rental links 30 days after the rental ends, agreement-signing links after 14 days, and quote links after 30 days. The underlying records are kept as described above.

11. Your choices and rights

• Renters: contact the rental business you rented from first. It controls your rental data and can access, correct or delete it, and we'll help it respond. If you can't reach the business, email privacy@getyardstick.co and we'll pass your request on.
• Business users, demo requesters and feedback senders: email privacy@getyardstick.co to access, correct or delete your personal information. You can also update your name and contact details in the app.
• Marketing: you can stop product updates and offers at any time by replying to one of those emails, using its unsubscribe option, or emailing privacy@getyardstick.co. We'll keep honoring your choice and won't add you back unless you make a new request or give new consent. We can still reply about a request you made.
• Service emails that are needed to run your account (such as password resets) can't be turned off while you have an account. Renter emails are about a specific rental; to stop them, contact the rental business.

Depending on where you live, you may have additional rights under law, such as the right to know, access, correct or delete personal information, or to appeal a decision about your request. We'll respond within the time the law requires and won't discriminate against you for using these rights. [COUNSEL REVIEW: which US state privacy laws apply to Yardstick (including CCPA/CPRA thresholds), and the disclosures, request-verification steps, response times and appeal process they require.]

12. How we protect information

• The Service is designed so each business can see only its own data.
• Role-based access lets each business limit some actions and information (for example "ID on file" photos) to owners and managers.
• Connections use HTTPS.
• Passwords are stored as one-way hashes.
• Links sent to renters are long and random, stored only in hashed form, and expire.

No system is perfectly secure, and we can't guarantee security. If we confirm a security incident affecting personal information, we'll notify the affected rental businesses and, where the law requires, regulators and individuals.

13. Children

Yardstick is for businesses and isn't directed at anyone under 18. Business users must be at least 18. We don't knowingly collect personal information from children. If you believe we hold a child's information, contact privacy@getyardstick.co.

14. Where information is processed

Yardstick is based in the United States, and we process information in the United States. [OWNER REQUIRED: the Render region of the app and database (render.yaml doesn't set one); don't publish this sentence until it's confirmed.] Some service providers may process information in other countries under their own safeguards (see the Sub-processors page).

15. Changes to this policy

We may update this policy. If a change is material, we'll tell business users by email or in the app before it takes effect. Each version is numbered and dated at the top.

16. Contact

Yardstick Rental Software LLC
1661 Cash Rd
Creedmoor, NC 27522
United States
Privacy questions and data requests: privacy@getyardstick.co
Product and account help: support@getyardstick.co