RentalOS Back home

Privacy Notice

Last updated: July 14, 2026

This Privacy Notice explains how CortexForge ("we", "us", "our") collects, uses, shares, and protects personal data in connection with the RentalOS service ("Service").

1. Data controller

CortexForge, an individual sole proprietor, acts as the data controller for personal data processed through the Service. If you have any questions, you can reach us through the support channel listed on our website.

2. Personal data we collect

  • Account data: name, email address, password (hashed), and profile settings.
  • Company data: business name, address, contact details, and preferences you enter in Settings.
  • Customer & rental data: the information you enter about your own customers, inventory, reservations, and invoices ("User Content").
  • Support data: messages, screenshots, or attachments you send us for support.
  • Usage & telemetry: pages visited, features used, error reports, device type, browser, and IP address.
  • Cookies and similar technologies: essential cookies for authentication and, if enabled, analytics cookies.

Payment card data is entered directly on Paddle's checkout and is not collected or stored by us — see "Sharing" below.

3. Purposes and legal bases

  • Provide the Service (contract): creating your account, storing your data, generating documents, sending transactional emails.
  • Security & fraud prevention (legitimate interests / legal obligation): detecting abuse, protecting accounts, and maintaining audit logs.
  • Improve the Service (legitimate interests): understanding how features are used, diagnosing errors.
  • Customer support (contract / legitimate interests): responding to your inquiries.
  • Billing & tax (contract / legal obligation): processing subscriptions via Paddle and issuing invoices.
  • Marketing (consent, where required): occasional product updates you have opted into.

4. Sharing with third parties

We share personal data only with the following categories of recipients:

  • Merchant of Record — Paddle.com Market Ltd. for payment processing, subscription management, invoicing, and sales-tax / VAT compliance.
  • Infrastructure & hosting subprocessors that host the application, database, storage, and email delivery on our behalf.
  • Product analytics and error-monitoring tools that help us diagnose issues and improve the Service.
  • Professional advisers (accountants, lawyers) where necessary and under a duty of confidentiality.
  • Authorities where required by law, court order, or to protect our legal rights.

We do not sell personal data, and we do not use User Content to train third-party AI models.

5. International transfers

Some of our subprocessors are located outside your country or region and may process personal data internationally. Where such transfers occur from the UK, EEA, or another regulated jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Data retention

We keep personal data for as long as your account is active and for a reasonable period after termination to satisfy legal, accounting, or audit requirements, resolve disputes, and enforce our agreements. Backups are rotated on a routine schedule. Data that is no longer needed is deleted or anonymised.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict or object to processing of your personal data, withdraw consent, and receive a portable copy of your data. To exercise these rights, contact us through the support channel on our website. You also have the right to lodge a complaint with your local data-protection authority. Where GDPR applies, we will respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and secure credential storage. No system is perfectly secure, and we cannot guarantee absolute security.

9. Cookies

We use cookies that are strictly necessary for authentication and to remember your preferences. Where optional analytics or marketing cookies are used, we obtain consent first and provide controls to manage your preferences.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be highlighted on the Service or notified by email.