Privacy Policy

1. Introduction

BRWD ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our peer-to-peer item rental platform.

2. Data We Collect

We collect the following types of personal data:

• Account information: Name, email, phone number, profile photo
• Identity verification: Government ID, selfie (for KYC)
• Payment information: Bank details processed via Stripe
• Location data: approximate location for nearby item discovery (with your consent), and the precise location recorded with pickup and return photos as evidence of handover (our legitimate interest in resolving disputes)
• Usage data: App interactions, search history, bookings
• Communications: Messages between users, support requests
• Technical data: IP address, device and app version, recorded when you accept these terms and when you confirm a handover
• Consent records: which version of these documents you accepted, when, and from which IP address
• Waitlist signups: if you ask us to tell you when BRWD launches, we store your email address, the language you were reading in, and the IP address the request came from. You do not need an account for this, and we do not create one.

3. Our Legal Bases for Using Your Data

We may only use your personal data where the law gives us a basis for doing so. Ours are:

• Running your account and processing bookings, payments and payouts — performance of our contract with you (Art. 6(1)(b))
• Verifying your identity, assessing risk and preventing fraud — our legal obligations and our legitimate interest in keeping the Platform safe (Art. 6(1)(c) and (f))
• Recording pickup and return photographs with their location and time — our legitimate interest, and that of the other user, in evidencing the condition of an item and resolving disputes (Art. 6(1)(f))
• Showing you items near you using your device location — your consent (Art. 6(1)(a)), which you may withdraw at any time
• Sending you marketing — your consent (Art. 6(1)(a)), which you may withdraw at any time
• Reporting to tax authorities under DAC7 — our legal obligation (Art. 6(1)(c))
• Keeping records of the terms you accepted — our legal obligation and our legitimate interest in establishing and defending legal claims (Art. 6(1)(c) and (f))

Where we verify your identity using a facial image, we process biometric data. We do this only with your explicit consent (Art. 9(2)(a)); if you prefer not to give it, we will tell you what alternative is available.

You may object at any time to any processing based on our legitimate interests, and we will stop unless we have compelling legitimate grounds that override your interests.

4. How We Use Your Data

We use your personal data to:

• Provide and improve our Platform services
• Process transactions and payments
• Verify user identities and prevent fraud
• Send booking notifications and updates
• Comply with legal obligations including tax reporting

We use automated systems to score the risk of a booking, using factors including the value of the item, your account history, your completed rentals, your reviews, and the consistency of your location and device information. A high score may require you to complete additional identity verification before a booking can proceed, or may cause a booking to be declined. You have the right to obtain human intervention, to express your point of view, and to contest the outcome by contacting support@brwd.app.

5. Data Sharing

We share your data with: other users (limited profile info for transactions), payment processors (Stripe), identity verification providers (Vove), cloud hosting and notification providers acting on our instructions (Amazon Web Services, Expo), and tax authorities as required by law (DAC7).

6. International Transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where they do, we rely on an adequacy decision of the European Commission — including the EU-US Data Privacy Framework where the provider is certified under it — or on the Commission’s Standard Contractual Clauses together with additional safeguards. You may ask us for a copy of the safeguards that apply by writing to privacy@brwd.app.

7. Tax Authority Reporting (DAC7)

Under EU Directive 2021/514 (DAC7), we must report to tax authorities if you exceed certain thresholds: more than 30 transactions OR more than €2,000 in earnings per year. Reported data includes your identity, tax ID, address, and earnings. This is a legal requirement we cannot opt out of.

8. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data — you can delete your account yourself in Settings > Legal and your data
• Object to processing
• Data portability
• Withdraw consent at any time

9. Data Retention

We keep different data for different periods. Account and profile data is kept while your account is open. Rental, payment and tax records are kept for 7 years after the transaction, as EU tax law requires (DAC7). Handover photos and their location and IP metadata are kept for 24 months, or until any related dispute is resolved. Records of the terms you accepted are kept for the limitation period after your account closes, so both sides can evidence the agreement. Everything else is deleted or anonymised when you delete your account. A waitlist entry is kept until we have sent you that launch email or you ask us to remove it, and in any case no longer than two years from the last time you asked to be on it.

10. Security

We implement industry-standard security measures including encryption, secure servers, and access controls to protect your data. However, no method of transmission over the Internet is 100% secure.

11. Data Breaches and Complaints

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours of becoming aware of it, and we will tell you directly without undue delay where the risk to you is high.

If you are unhappy with how we handle your data, please contact us first at privacy@brwd.app. You also have the right to lodge a complaint at any time with the AEPD (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the supervisory authority of the EU country where you live or work.

12. Marketing Communications

We only send marketing emails and notifications if you have opted in, and you can withdraw that consent at any time in Settings > Marketing preferences or via the unsubscribe link in any marketing email. Withdrawing it does not affect transactional messages about your bookings, payments and safety, which we send as part of providing the service.

If you join the waitlist on brwd.app you are asking us for one thing: an email when BRWD launches in your area. That is your consent under Art. 6(1)(a), and it covers that message and nothing else — waitlist addresses are not added to any other mailing and are not shared with anyone. Write to privacy@brwd.app and we will delete your entry. You do not need an account to ask, and we will not ask you to create one.

13. Contact Us

For privacy enquiries or to exercise your rights, contact us at privacy@brwd.app