The short version
We collect the minimum we need to deliver a rental, send a receipt, and follow up after. We don't sell your data. We don't share it with marketers. We use a small set of named processors (Stripe, Supabase, Resend) to actually run the business — they're listed below. You can ask us what we have on you and we'll tell you, or delete it on request.
Who we are
KC Mobility Scooter Rentals LLC, a Kansas LLC operated by Jeffrey Guzman. Physical address: 703 Pennsylvania Ave, Leavenworth, KS 66048. Reachable at (913) 775-1098 or jeff@kcmobilityrentals.com. We are a hospitality rental and refurbishment business — not a medical or healthcare provider, durable medical equipment supplier, or covered entity under HIPAA.
What we collect
You give us, directly:
- Reservation info: name, email, phone number, delivery address (when applicable), rental dates, equipment selection, height and weight (used for fitting recommendations only — not stored beyond the rental window).
- Payment info: card details enter Stripe directly through Stripe Checkout. We never see or store full card numbers. Stripe sends us a transaction record (last 4 digits, brand, transaction ID, charge amount).
- Rental agreement: the e-signature you submit through our signing flow, with timestamp and IP, kept for the legal duration of the contract.
- ID verification (in-person events): at our event booth we record the driver's-license or state-ID number and address you provide, and verify them against your physical ID before handing over equipment. They are used only to confirm identity for that rental, and are purged after a clean return — see retention below.
- ID held instead of a deposit (in-person events, your choice): if you'd rather not pay a security deposit, you can leave a government-issued ID with our booth staff. We keep the physical card secured at the booth and hand it back to you when the equipment is returned.
- ID photo (occasionally — outdoor events and store pickups): staff may take one photo of your ID. It is saved straight to our private, access-controlled storage — never kept on a staff phone — and is deleted automatically once the equipment comes back in good condition.
- Communications: emails, texts, or call notes you send us.
- Sell or haul-away inquiries: if you contact us to sell equipment or schedule a free pickup, we keep the photos you sent and the contact info you provided for the duration of the transaction plus a year for accounting records.
Collected automatically:
- Server logs: IP address, browser, requested URL, referrer, timestamp. Used for security and capacity planning. Retained ≤30 days.
- Cookies and local storage: a session cookie when you sign in as a customer or admin (so we know it's still you). The kiosk tablet uses sessionStorage to hold form state during a single rental flow and wipes it between customers. We do not use third-party advertising cookies.
- Analytics: we use Google Analytics 4 to understand aggregate site traffic (pages viewed, general location, device type). We have IP-anonymization on and do not use it for advertising or to build profiles of individuals. Google retains this data for 14 months. When you first visit, a banner lets you accept or decline analytics cookies; you can change your choice anytime on Do Not Sell or Share My Info. We honor the Global Privacy Control browser signal automatically. You can also use Google's browser add-on. We do not use third-party advertising cookies.
- How you found us: when you book online we note the website that sent you (for example a search engine or AI assistant), any campaign tag in the link, and the first page you visited. It is kept in your browser until you book, then stored with your booking so we know which channels work. It is never shared.
How we use it
- To process the rental, sale, or haul-away you asked for.
- To send transactional email — receipts, signing links, payment links, pickup confirmations, return reminders.
- To follow up after the rental and ask if everything went well.
- To improve the service — anonymized aggregate analysis only.
- To meet our legal, tax, and accounting obligations.
We do not use your information for behavioral advertising. We do not sell or rent customer lists. We do not share data with marketing affiliates.
Who we share it with
We use a short list of named service providers, each scoped to one job:
- Stripe (Stripe Inc., US/EU): payment processing, refunds, receipts. Stripe sees card details. We see only the last 4 + brand + amount. Stripe's privacy policy.
- Supabase (Supabase Inc., US): our database, customer authentication, file storage, and Edge Functions. All customer data we hold lives there. Supabase's privacy policy.
- Resend (Resend Inc., US): transactional email delivery. Resend's privacy policy.
- Hostinger (Hostinger International Ltd., EU): static-site hosting. Server logs and IP addresses pass through their infrastructure. Hostinger's privacy policy.
- Google (Google LLC, US): Google Analytics 4 for aggregate, IP-anonymized site-traffic measurement (not used for advertising), and Google Drive for our business records and nightly backups, including signed rental agreements. Google's privacy policy.
- Mapbox (Mapbox Inc., US): address lookup and delivery-route planning. Sees delivery addresses only. Mapbox's privacy policy.
- Plaid (Plaid Inc., US): a read-only connection to our own business bank accounts for bookkeeping and tax records. We never connect or see customers' bank accounts, and bank sign-in happens inside Plaid, so we never receive bank passwords. Plaid's end-user privacy policy.
These are processors, not partners — they handle data on our instruction and aren't allowed to use it for their own purposes beyond what their service requires.
Legal disclosure
We will share information when legally required (subpoena, court order, lawful law-enforcement request) or when necessary to protect our rights, property, or the safety of staff or customers. We will tell you if this happens unless legally prohibited from doing so.
How long we keep it
- Rental records: 7 years (tax/accounting requirement under Kansas law).
- Signed agreements: 7 years (legal contract retention).
- Driver's-license number & address (in-person events): purged once staff confirm a clean return at inspection, and in all cases automatically within 24 hours of a completed clean rental. Kept longer only when equipment is damaged or not returned, for the duration of that claim.
- Email correspondence: 3 years for ordinary business; longer if it's part of a legal matter.
- Sell/haul-away inquiry photos: 1 year after the transaction.
- Business bank transactions (via Plaid): 7 years, as tax records; the bank connection itself is revoked and its access token deleted when no longer needed.
- ID photos: deleted automatically the day after a clean return. Kept longer only when equipment is damaged or not returned, for the duration of that claim. ID photos are never included in backups.
- Server logs: 30 days.
- Marketing email opt-ins: until you unsubscribe (we do not send marketing email yet, but if we do, every send includes a one-click unsubscribe).
Your rights
You can, at any time, by emailing jeff@kcmobilityrentals.com:
- Ask what we have on file about you (we'll provide a copy within 30 days).
- Correct anything that's wrong.
- Delete your data — except the parts we're legally required to keep (tax records, signed contracts).
- Opt out of any future marketing communications.
- Take your data with you in a portable format (CSV/JSON).
California and other state privacy laws: we do not sell personal information and do not share it for cross-context behavioral advertising. You can manage analytics cookies on our Do Not Sell or Share My Info page, and we honor Global Privacy Control. We do not knowingly collect from anyone under 16.
EU/EEA visitors (GDPR): we are a small US business and do not target EU customers, but if you reach our site from the EU and we hold data on you, you have GDPR rights — access, rectification, erasure, portability, and the right to lodge a complaint with your local data protection authority. Email and we'll respond.
Children
Our service is for adults. We don't knowingly collect personal information from children under 16. If we learn we've collected information from a child without parental consent, we'll delete it promptly. Parents can email us to confirm.
Security
All site traffic is HTTPS. Customer-facing data is stored in Supabase with row- level security policies. Payment card data never reaches our servers — it goes directly from your browser to Stripe. Admin access is restricted to authorized staff, every admin sign-in requires two-factor authentication, and admin sessions automatically sign out after inactivity and on a fixed time limit. An ID left at an event booth in place of a deposit stays secured with staff and is returned with the equipment. ID photos are stored privately, viewable only by signed-in staff through short-lived links, and deleted automatically after a clean return.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you within 72 hours and report to the appropriate authorities as required by Kansas Stat. 50-7a01 et seq.
Changes to this policy
When we change this policy, we update the "last updated" date at the top and keep the old versions on file. Material changes (adding new processors, expanding data collection) get an email notification to active customers.
Contact
Privacy questions, complaints, data access or deletion requests: jeff@kcmobilityrentals.com or 913-775-1098.