Schack's Yaks

1. Who we are

Schack's Yaks LLC ("Schack's Yaks," "we," "our," or "us") operates kayak rental locations throughout the Greater Cincinnati and Northern Kentucky area. We provide a self-serve kayak rental service through our iOS app, Android app, and web app (collectively, the "Service") at https://kayakrental-10a68.web.app.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, with whom we share it, how long we keep it, and the choices you have about your data. It applies to all customers who create an account or rent a kayak through any version of the Service.

2. Information we collect

We collect only the information needed to rent you a kayak safely and bill you accurately.

2.1 Information you provide directly

Email address and password — to create and sign in to your customer account (via Firebase Authentication)
Legal name — captured on the liability waiver when you start your first rental
Payment details — your credit/debit card information is entered into a payment form rendered by Stripe, our payment processor. We do not store your full card number on our servers; only the last 4 digits and brand are visible to us for receipt purposes

2.2 Information collected automatically

Precise location — when you grant location permission, we use your location to show the nearest kayak rental sites on a map and to confirm you are physically near the kayak when starting a rental. We do not track your location outside of active app use
Bluetooth device identifiers — when starting or ending a rental, your phone communicates with the kayak's electronic lock over Bluetooth Low Energy. We exchange short-lived cryptographic keys with the lock; we do not collect or store identifiers of other Bluetooth devices in your environment
Device and diagnostic data — device model, operating system version, app version, anonymous device identifier, crash reports, and performance metrics (collected by Firebase Crashlytics and Sentry to help us fix bugs and improve stability)
Rental session data — the kayak rented, the location, start and end times, charges, and any error events during BLE handshakes. Used to operate the rental, generate receipts, and support customer-service questions

3. How we use your information

We use the information above to:

Authenticate you and let you sign in to your account
Process kayak rentals (issue digital keys to the lock, time the rental, calculate charges)
Process payments and provide receipts
Display nearby rental locations on a map
Respond to customer-support inquiries
Diagnose crashes and improve app reliability
Detect and prevent fraud, abuse, and Terms-of-Service violations
Comply with applicable laws (tax, accounting, liability)

We do not use your information for cross-app tracking, for third-party advertising, or to build profiles for resale.

4. How we share your information

We do not sell your personal information. We share data with the following service providers only as needed to deliver the Service:

Stripe, Inc. — payment processing. Card details go directly from your device to Stripe's PCI-DSS-compliant servers. See Stripe's Privacy Policy.
Google Firebase (Authentication, Firestore, Cloud Functions, Hosting, Crashlytics, Analytics) — account authentication, database, server-side logic, app hosting, and diagnostic data. See Firebase's Privacy & Security overview.
KeySafe-Cloud (operator of the AXA E-RL 2 lock platform) — we transmit a kayak identifier and a short-lived digital key to KSC to allow the lock to authenticate your phone's unlock request. KSC does not receive your name, email, or payment information.
Sentry — crash reports and error diagnostics. Stack traces may include anonymized device identifiers and rental session metadata. We do not send your name, email, or payment data to Sentry.
Twilio — for the SMS notifications we send the owner when a lock alert fires (e.g., a rental ending unexpectedly). We do not share your contact information with Twilio.
Resend — used to email you rental receipts and password-reset links. Your email address is the only personal data shared.
Government or legal authorities — if we are required to disclose data by law (subpoena, court order, etc.) we will respond as required, and notify you when permitted to do so.

5. Data retention

We retain personal data only as long as needed:

Rental session records — kept indefinitely as our business record (rental history, receipts, accident liability evidence)
Account credentials — kept until you delete your account or request deletion (see Section 6)
Diagnostic + crash data — retained per the provider's default (Crashlytics: 90 days; Sentry: 30 days)
Location data — not retained beyond the active rental session
Payment data — we hold only the last 4 digits and brand of the card used per rental. Stripe retains full payment data per their own retention policy.

6. Your rights and choices

You have the right to:

Access the personal data we hold about you
Correct inaccurate data (in-app for email/name; for other fields contact us using Section 9)
Delete your account and associated personal data (email the request to support@responseiq.ai; we will action within 30 days, except for transaction records we are legally required to retain)
Withdraw consent to location, Bluetooth, or notification permissions at any time through your device settings (the app will continue to function but some features will be unavailable)
Opt out of diagnostic data by uninstalling the app — we do not have a separate analytics opt-out toggle

California (CCPA), European Union (GDPR), and other applicable jurisdictions: you have additional regional rights. Contact us as described in Section 9 to exercise them.

7. Children

The Service is intended for users 18 years or older, or for minors participating under the supervision of a parent or guardian who has signed the liability waiver. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

8. Security

We use industry-standard safeguards: TLS encryption for all data in transit, Firebase Authentication for sign-in, Stripe for tokenized payment handling, and access controls on our Firestore database. No system is perfectly secure; if we become aware of a data incident affecting your information, we will notify you and the relevant authorities as required by law.

9. Contact us

Questions, requests, or complaints about this Privacy Policy or your personal data:

Email: support@responseiq.ai
Phone: 859-468-0376
Mail: Schack's Yaks LLC, c/o Christopher Schack, Cincinnati / Northern Kentucky region

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. The "Effective" date at the top of this page reflects the most recent revision. Continued use of the Service after a change means you accept the revised policy.