Privacy Policy

The data controller responsible for your personal data is Rentbox Eesti OÜ (registration code 17268244), at Nööbi tn 10, Aespa alevik, Kohila vald, Rapla maakond, 79705, Eesti. For any data-related enquiry, use the info@rentbox.ee.

We process personal data only to the extent necessary to deliver the consultation service. The categories and purposes are:

We process your personal data on one or more of the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): processing is necessary to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service improvement. We balance these interests against your rights and will not override your interests without justification.
• Legal obligation (Art. 6(1)(c)): retaining records required by applicable law (e.g. financial records, healthcare audit trails).
• Consent (Art. 6(1)(a)): where you have explicitly agreed, for example push notification delivery or where special- category health data is processed. You may withdraw consent at any time.

We do not sell your personal data. We share it only where necessary:

• Video providers — Daily.co or Jitsi (JaaS), depending on your organization's configuration, receive session data to deliver the video call. The production operator must execute any required Data Processing Agreements and document the applicable transfer safeguards.
• Stripe — processes payments on our behalf. Card data is handled directly by Stripe and never reaches our servers. Stripe is PCI-DSS Level 1 certified.
• Email / SMS providers — transactional messaging (Resend or SendGrid for email; Twilio for SMS, if configured) to deliver confirmations, reminders and notifications.
• Object storage — uploaded files are stored in an S3-compatible bucket (configurable per deployment). Files are private and only accessible via short-lived signed URLs.
• Infrastructure — the hosting, database and cache providers selected for the production deployment. Their locations and transfer safeguards must be documented by the operator.

The current deployment-specific sub-processor list is available on request.

Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on an adequacy decision for the recipient country. Details of the transfer safeguards for each sub-processor are available on request.

We retain personal data for as long as necessary for the purposes described above, or as required by law:

• Account and profile data: for the life of the account, unless you use the self-service erasure flow or a longer period is required for a legal claim or statutory record. The current system does not schedule deletion merely because an account becomes inactive.
• Appointment and session data: according to the organization's configured retention window (365 days by default). After a completed, cancelled, no-show or expired appointment reaches that window, identifying appointment, chat, note, consent, review and participant data is scrubbed and associated file deletion is queued.
• Financial records: retained for the period required by the tax, accounting and dispute rules applicable to the operator and organization.
• Audit logs: security metadata, including IP address, user-agent and action metadata, is scrubbed after 12 months. The underlying event row may remain for accountability and legal records.
• Push notification tokens: until the device is deregistered or the account is deleted.

As a data subject in the EEA or UK, you have the following rights, which you may exercise at any time:

• Right of access (Art. 15): request a copy of your personal data.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18): ask us to stop processing your data in certain circumstances.
• Right to data portability (Art. 20): receive a structured, machine-readable copy of your data.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decisions (Art. 22): we do not make solely automated decisions that significantly affect you.

To exercise any of these rights, use the info@rentbox.ee. We will respond without undue delay and ordinarily within one month, subject to any extension permitted by applicable law. You also have the right to lodge a complaint with your national supervisory authority (in Estonia: the Data Protection Inspectorate, aki.ee).

Data export and deletion are also available self-service from your account settings (Settings → Privacy).

Synx Connect uses the following storage technologies:

• Session cookie (httpOnly, Secure, SameSite=Lax): strictly necessary to keep you logged in. No analytics or tracking cookie is set by default.
• Language preference cookie (synx-connect-locale): remembers your selected language for one year. It supports the language preference you request and is not used for advertising or analytics. Signed-in accounts also save this preference in their account settings.
• LocalStorage — theme preference: stores your dark/light mode choice locally in the browser. No personal data is transmitted to our servers.

We do not use third-party advertising or cross-site tracking cookies. If your organization integrates third-party analytics, the organization's own privacy policy applies to those tools.

We implement technical and organisational measures proportionate to the risk:

• Passwords are hashed with bcrypt (cost factor 12).
• Sessions use signed JWTs in an httpOnly cookie, bound to a 7-day expiry and revoked instantly on password reset or account deletion. One-time links (password reset, email verification, booking join links) are random tokens stored only as SHA-256 hashes.
• Files are stored in a private bucket with no public access; download and upload require short-lived signed URLs.
• Production traffic must be served over HTTPS with modern TLS.
• Role-based access control and organization-scoped queries reduce the risk of unauthorized cross-tenant access.
• Sensitive actions create application audit events.

We will notify affected users and relevant authorities of a personal data breach within the timeframes required by GDPR.

The platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we hold data relating to a child, use the info@rentbox.ee immediately.

We may update this policy from time to time. Material changes will be communicated through an appropriate channel when required by applicable law. The effective date at the top identifies the version currently in force.

For any questions about this policy or to exercise your data rights: