Skip to main content

Privacy Policy

Last updated: October 3, 2026

1. Controller

The controller responsible for the processing of personal data on this website and within the Renuir platform, within the meaning of Art. 4(7) GDPR, is Renuir UG (haftungsbeschränkt), Hönower Wiesenweg 57, 10318 Berlin, Germany. For any privacy matter, including to reach the person responsible for data protection, contact us at privacy@renuir.com. We have not appointed a statutory Data Protection Officer because we are not currently required to do so under Art. 37 GDPR; if this changes, the contact details will be published here.

2. Data We Collect

We collect and process the following categories of personal data:

  • Account and delivery data: name, email address, phone number, date of birth and verified-age/identity status, password (hashed), and a shipping address when courier delivery is requested
  • Item photos and descriptions uploaded when reporting lost or found items
  • Location data: venue or approximate location associated with a lost/found report
  • Chat messages exchanged between users and venues within the platform
  • Purchase and payment history: app-store product identifiers, transaction references, entitlement status, and payment records required for fraud prevention and accounting; payment card details remain with the payment provider
  • Technical and diagnostics data: IP address, browser and device information, a stable per-install identifier, push-notification token, crash reports, performance traces, security logs, and cookies

3. Legal Basis for Processing

We process personal data on the following legal bases under Art. 6(1) GDPR:

  • Consent (Art. 6(1)(a)): for analytics cookies and optional communications
  • Contract performance (Art. 6(1)(b)): to provide the Renuir service, process claims, and facilitate returns
  • Legitimate interest (Art. 6(1)(f)): for fraud prevention, platform security, and service improvement
  • Legal obligation (Art. 6(1)(c)): for tax records, regulatory compliance, and law enforcement requests

4. Third-Party Processors

We share data with the following categories of processors, all bound by data processing agreements:

  • Hosting and infrastructure: Google Cloud, Firebase, Expo, and Vercel, for API, database, media, authentication, notifications, application updates, and website hosting
  • Payments and verification: Apple App Store, Google Play, and Stripe, including Stripe Identity for document and matching-selfie verification; Renuir does not store identity images
  • AI services: Google Cloud services for safety analysis, text extraction, image recognition, and item matching, with data minimized for the requested operation
  • Diagnostics and service improvement: Sentry for crash reports and performance traces, and consent-based website analytics

5. Data Retention

We keep personal data only as long as needed to operate the service. Account deletion requests enter a 14-day grace period before permanent removal. Resolved item reports are normally removed after 60 days. Messages, claims, moderation, payment, tax, security, fraud-prevention and legal records may be retained longer where required by law, needed for disputes or necessary to protect the service. Any legal preservation hold applies only to the affected records.

6. International Transfers

Some of our processors operate outside the EU/EEA. Where data is transferred internationally, we ensure adequate protection through EU Standard Contractual Clauses (SCCs) or adequacy decisions. Stripe and Vercel maintain EU data processing commitments.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15): obtain a copy of your data
  • Right to rectification (Art. 16): correct inaccurate data
  • Right to erasure (Art. 17): request deletion of your data
  • Right to restriction (Art. 18): limit processing of your data
  • Right to data portability (Art. 20): receive your data in a machine-readable format
  • Right to object (Art. 21): object to processing based on legitimate interests
  • Right to withdraw consent: withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@renuir.com. We will respond within 30 days.

8. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany.

9. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on our website. The current version is always available at this URL.