Privacy Policy

For the data of your account and our business relationship, the controller is MELKIN SINGLE MEMBER P.C., VAT number 802023072, Kokkini Chani, 71500 Heraklion, Crete, Greece. For personal-data matters, write to us at info@melkin.gr or through the contact form with the topic "Personal data".

For the data of your customers (the renters who book or sign a contract), the rental business is the controller. We process that data as a processor, only on the business's behalf and following its instructions.

• Account details: full name, email, business name, phone. Your password is only ever stored hashed.
• Billing details: business name, VAT number, address and payment history. Card details are processed by Viva and never reach us.
• Technical data: IP address, device and browser type, logs and sign-in records, for security and to run the service.
• Communications: whatever you send us by email or through a contact form.

When you use RentSMART, you enter data about your customers, such as:

• full name, contact details, address, date of birth,
• driving licence details and, if you upload them, scans of ID or licence documents,
• bookings, contracts, payments and, if you enable it, declarations to the AADE Digital Client List.

For this data we commit to: process it only to provide the service to you; keep it isolated from other businesses' data; use only the sub-processors listed below; help you answer your customers' requests; and delete it when your account is closed.

If you are a customer of a rental business and want to exercise your rights, contact that business first. Where needed, we will help it respond to you.

• To provide the service we agreed on (performance of a contract).
• For invoicing and tax obligations (legal obligation).
• To keep the platform secure, protect it from automated abuse and improve the service (legitimate interest).
• For newsletters, only with your consent, which you can withdraw at any time.

We do not sell personal data. We share it only with providers we need to run the service:

• Supabase — database, user sign-in and file storage.
• Vercel — hosting of the application and the booking websites.
• Resend — sending email (confirmations, contracts, notifications).
• Cloudflare — Turnstile bot check on forms.
• Viva — payments for the subscription and packages.
• Elorus — issuing invoices.
• AADE — only if you enable the Digital Client List, and then on your behalf.

The payment providers you connect for your customers' bookings (for example Stripe, PayPal, Revolut, Viva) receive data under your own contract with them.

The database and the application servers are currently hosted in data centres in the United States. Some of the providers in the previous section may also process data outside the EU.

In those cases the transfer relies on the European Commission's Standard Contractual Clauses or on the EU-US Data Privacy Framework, where the provider is certified.

• Account and business data: for as long as the account is active. Deleted, files included, within 30 days of closing it.
• Invoices and payment records: for as long as tax law requires (normally 5 years).
• Backups: rotated and deleted within 7 days.
• Logs: up to 30 days.

All traffic is encrypted (HTTPS). Each business sees only its own data, isolated at the database level. Payment provider keys are stored encrypted and are never shown again after you enter them. Our staff's access is limited to what support and operations require.

We use only cookies and technologies needed for the service to work:

• sign-in cookies, to keep you logged in,
• language preference cookies,
• the Cloudflare Turnstile security check on forms, which is not used for advertising or tracking.

We do not use advertising or analytics cookies. If that changes, we will ask for your consent first.

You have the right of access, rectification, erasure, restriction of processing, portability and objection. Where processing relies on consent, you can withdraw it at any time.

To exercise a right, write to us through the contact form. We reply within one month.

If you believe the processing breaks the law, you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

If we change this policy materially, we will tell you by email or in the app before the changes take effect.