Legal
Privacy Policy
RE/cation is a circular marketplace for travel gear. To run it we need to process some personal data about sellers, buyers and Keepers. This policy explains what we collect, why, who we share it with, and what rights you have. We have tried to write it in plain language. If anything is unclear, ask us.
1. Who is responsible
Racation AS (organisation number 937980272)
Eidvegen 638, 9105 Kvaløya, Norway
Email: anders@recation.app
Racation AS is the data controller for the RE/cation app and the website recation.app. We are established in Norway and follow the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account: name, email, password (stored hashed), preferred language, optional phone number and profile photo | To create and secure your account and let other users know who they are dealing with | Contract (GDPR art. 6(1)(b)) |
| Listings: photos, title, description, condition, price, departure date | To show your item to buyers. Listings are public in the app | Contract |
| Keeper profile: street address, map location, bio, photo of storage space, Airbnb link, opening hours | To let sellers choose you and let buyers collect items. Your address and profile are shown to logged-in users looking for a Keeper, and to buyers collecting an item from you. They are not visible without an account | Contract |
| Offers and transactions: amounts, fees, payout amounts, timestamps, Stripe references | To run the sale, hold payment until handover and pay out sellers and Keepers | Contract; legal obligation (bookkeeping) |
| Messages between seller, buyer and Keeper | To coordinate drop-off and pickup | Contract |
| Ratings and reviews | To build trust between users | Legitimate interest (a safe marketplace) |
| Push notification token | To notify you about offers, sales and pickups. Only if you allow notifications | Consent (via your phone's permission) |
| Device location | To show Keepers and listings near you. Used for the search only and not stored | Consent (via your phone's permission) |
| Technical data: IP address, device type, app version, error logs | Security, fraud prevention and fixing bugs | Legitimate interest |
| Website forms: name, email, message | To answer partner enquiries and send launch updates you signed up for | Consent |
3. Payments
Payments are handled by Stripe. When you pay, you are sent to a Stripe checkout page. We never see or store your card number. Stripe shares with us only a payment reference and status.
Sellers and Keepers receive payouts through Stripe Connect. Stripe is required by law to verify your identity before paying out, and collects identity and bank details directly from you. For that verification Stripe is an independent data controller. See Stripe's privacy policy.
4. Who we share data with
Other users
- Everyone in the app can see your first name, profile photo, ratings, and your listings.
- A Keeper sees the name and contact details of sellers and buyers with items at their location.
- Logged-in sellers see Keeper addresses when choosing where to drop off an item, and buyers see the address of the Keeper holding their purchase.
Service providers (data processors)
We use a small number of companies to run the service. They process data only on our instructions under a data processing agreement.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, login, file storage and server functions | EU (AWS) |
| Stripe | Payments and payouts | EU / USA |
| Expo | Delivering push notifications | USA |
| Apple and Google | App distribution and notification delivery on your device | USA |
| Vercel | Hosting this website | EU / USA |
| Web3Forms | Delivering website contact form submissions to our inbox | USA |
We do not sell personal data and we do not use it for advertising.
Authorities
We may share data when required by law, for example with the police in a theft investigation or with the tax authorities.
5. Transfers outside the EEA
Some providers process data in the USA. Where they do, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Account and profile: until you delete your account.
- Listings and photos: until you delete them or your account.
- Transaction records: 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act. These are kept even if you delete your account, but are no longer linked to a live profile.
- Messages: 12 months after the related transaction is completed or cancelled.
- Technical logs: up to 30 days.
- Website enquiries: until answered and no longer needed, at most 12 months.
7. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong. Most profile data you can edit yourself in the app.
- Delete your account and data. Use Settings → Delete account in the app. Deletion is immediate, except for records we must keep by law.
- Receive your data in a machine-readable format.
- Object to processing based on legitimate interest, and withdraw consent at any time, for example by turning off notifications or location in your phone settings.
- Complain to the Norwegian Data Protection Authority, Datatilsynet, if you think we handle your data unlawfully. We would appreciate the chance to resolve it with you first.
To exercise a right, email us. We answer within 30 days.
8. Security
Data is encrypted in transit and at rest. Access to the database is restricted by row-level rules so that users only see what they are entitled to. Only the two founders of Racation AS have administrative access.
9. Age
RE/cation is for adults. You must be 18 or older to create an account.
10. Cookies on this website
This website does not use tracking cookies or analytics. It loads fonts from Google Fonts and offers an optional Google Translate widget. If you use the translate widget, Google may set its own cookies.
11. Changes
If we change this policy in a way that matters to you, we will notify you in the app or by email before the change takes effect. The current version is always at recation.app/privacy.html.
12. Contact
Questions about privacy: anders@recation.app