Privacy Policy
In brief. We collect the data needed to let you rent, lend, sell and buy safely: your account data, your identity document for verification, your location to show nearby items, and the data required for payments and shipping. We do not sell your data to anyone and we do not run behavioural advertising. You can request access, correction, or deletion of your data at any time by writing to privacy@lendmates.ai.
1. Data controller
The data controller of your personal data is Lendmates S.r.l., registered office at Via Aldo Moro 13, Brescia (BS), Italia - codice fiscale and partita IVA 04808160982 - which manages the Lendmates mobile application and the lendmates.ai website.
For any questions related to your personal data, you can write to privacy@lendmates.ai.
2. What data we collect
2.1 Data you provide directly
| Data | When we collect it | Required |
|---|---|---|
| First and last name | Registration | Yes |
| Email address | Registration | Yes |
| Phone number | Profile | No |
| Date of birth | Identity verification | Yes |
| Identity document and selfie | Identity verification (KYC) | Yes |
| Physical address | Shipping and invoicing | Yes for shipped sales |
| Bank details (IBAN) | Receiving payments | Yes for lenders or sellers |
| Item photos, titles and descriptions | Listing publication | Yes to publish |
| Chat messages | Conversations with other users | No |
| Reviews and ratings | After a transaction | No |
2.2 Data collected automatically
- Geographical location (approximate or precise, based on your OS-level consent), to show nearby listings and calculate distances. You can withdraw permission at any time from your device settings: the app will keep working, but you'll need to enter your search area manually.
- Device identifier and push notification tokens, to send you updates about bookings, offers and messages.
- Technical and usage data: device model, operating system version, app version, error logs and crashes, and interactions with the screens. This helps diagnose problems and improve the product.
- IP address and connection data, for security, fraud prevention, and regulatory compliance.
2.3 What we do NOT do
- We do not use the Advertising ID and we do not run cross-app behavioural advertising.
- We do not sell or share your personal data with third parties for marketing purposes.
- We do not store payment card numbers on your device or on our servers.
3. Why we process them and on what legal basis
| Purposes | Data involved | Legal basis (Article 6 GDPR) |
|---|---|---|
| Create and manage your account | Personal details, email, credentials | Contract performance |
| Verify your identity (KYC) | Document, selfie, date of birth | Legal obligation (D.Lgs. 231/2007 (anti-money laundering)) and contract performance |
| Publish listings and connect you with other users | Photos, descriptions, chat, location | Contract performance |
| Process payments, deposits and refunds | Payment data, IBAN, amounts | Contract performance and legal obligation |
| Handle shipping and tracking | Address, order data | Contract performance |
| Send you transactional notifications | Push tokens, email | Contract performance |
| Prevent fraud and abuse, and manage disputes | Logs, IP, transaction data | Legitimate interest |
| Improve the product with aggregated statistics | Usage and crash data | Legitimate interest |
| Meet tax and accounting obligations | Transaction and invoicing data | Legal obligation |
| Send you promotional communications | Consent, withdrawable at any time |
4. Who we share them with
We share your data only with providers necessary to deliver the service. Each one is appointed as a data processor under art. 28 GDPR (processor obligations) and is contractually bound to process it only on our behalf.
| Provider | Data shared | Purpose |
|---|---|---|
| Trustap | Name, email, transaction data, payment details | Payment processing, managing held funds, deposits, refunds and disputes |
| Amazon Web Services (AWS) | Identity document, selfie | Biometric comparison for identity verification; hosting and storage |
| Google Cloud | Identity document | Optical reading (OCR) of document data |
| ShippyPro S.r.l. and connected couriers | Recipient name and address, order data | Shipping label generation and tracking |
| Expo (Software Mansion) | Device push tokens | Delivery of push notifications |
Some of your profile data is also visible to other users: name, profile photo, city or approximate area, posted listings, received reviews, and verification status. Your exact address is shared with the other party only when it's needed to complete a swap.
We may also share data with judicial authorities or law-enforcement officers when required by law, or to establish, exercise or defend a right in court.
5. Transfers outside the European Union
Some providers may process data outside the European Economic Area. In this case, the transfer is based on a European Commission adequacy decision or on Standard Contractual Clauses adopted by the Commission, supplemented where necessary with additional security measures. You can request a copy of the applied safeguards by writing to privacy@lendmates.ai.
6. How long we keep them
- Account data: for the entire relationship duration and for 12 months after closure, unless different obligations apply.
- Identity documents and KYC data: 10 years from the end of the relationship, as required by anti-money laundering regulations.
- Transaction data, invoices and accounting documents: 10 years, for tax and civil obligations.
- Chat messages: 24 months from the last message, or longer if related to an ongoing dispute.
- Technical and security logs: 12 months.
- Reviews: remain published in anonymised form even after account closure, to preserve the reliability of the reputation system.
7. Your rights
As a data subject, you have the right to:
- Access - obtain confirmation of processing and a copy of your data.
- Rectification - correct inaccurate or incomplete data.
- Deletion - request deletion of data no longer needed. See the page Delete your account.
- Restriction - request that processing be paused in certain cases.
- Portability - receive your data in a structured, machine-readable format.
- Objection - object to processing based on legitimate interest.
- Withdrawal of consent - at any time, without affecting the lawfulness of prior processing.
To exercise these rights, write to privacy@lendmates.ai. We respond within 30 days. If you believe the processing violates the GDPR, you can file a complaint with the Garante per la protezione dei dati personali.
8. Data security
- All communications between the app, site and servers take place over an encrypted channel (HTTPS/TLS).
- Databases and file archives are encrypted at rest.
- Access to personal data by our staff is limited to those who need it operationally, and access is logged.
- Payment card data is handled exclusively by our certified provider and does not pass through our systems.
9. Minors
Lendmates is intended for people aged 18 and over. We do not knowingly collect data from minors. If we learn that an account was created by a minor, we close it and delete the related data. If you are a parent and you believe your child provided us with personal data, write to privacy@lendmates.ai.
10. Changes to this policy
We may update this policy to reflect service or legal/regulatory changes. If we make substantial changes, we will let you know by email or with an in-app notice at least 15 days before they become effective. The current version is always published on this page, with the last update date at the top.