Privacy Policy

The Hire Site Ltd (“we”, “us”, “our”) operates thehiresite.co.uk. We are registered in England and Wales. This Privacy Policy explains how we collect, use, share and protect your personal data when you use our platform.

If you have questions about this policy, contact us at privacy@thehiresite.co.uk.

We collect the following categories of personal data:

• Account data: Name, email address, password (hashed), phone number
• Profile data: Location, bio, profile photo, trade credentials, insurance documents
• Transaction data: Booking history, payment records, Stripe payment tokens
• Communications: Messages sent between hirers and listers on the platform
• Usage data: Pages visited, searches performed, device type, IP address
• Verification data: Identity documents, insurance certificates (where provided voluntarily)

We use your data to:

• Provide and operate the platform and your account
• Process bookings and payments securely
• Verify credentials and award trust badges
• Send transactional emails (booking confirmations, payment receipts)
• Send marketing communications (only where you have opted in)
• Detect and prevent fraud or misuse
• Comply with legal obligations
• Improve the platform through anonymised analytics

We process your personal data under the following lawful bases (UK GDPR):

• Contract: To fulfil our agreement with you when you create an account or make a booking
• Legitimate interests: To improve our service, prevent fraud, and keep the platform safe
• Consent: For marketing emails and non-essential cookies
• Legal obligation: To comply with financial regulations and tax requirements

We share data only where necessary:

• Stripe: Payment processing. Governed by Stripe's Privacy Policy.
• Supabase: Database hosting. Data stored in EU/UK data centres.
• Resend: Transactional email delivery.
• Anthropic: AI processing, in the United States, and only if you have agreed to it. See “AI features” below.
• Other users: Your public profile (name, rating, city, bio) is visible to other users. Your contact details are never shared without consent.
• Legal authorities: Where required by law or to protect against fraud.

We never sell your personal data to third parties.

Some optional features use artificial intelligence provided by Anthropic PBC in the United States. We ask for your permission before any of your data is sent there, and you can withdraw it at any time in the app under Edit profile, or by contacting us. Everything else on the platform works without it.

What we send, and only when you use that feature:

• Listing photographs — when you ask for a listing to be written from them. These may show the inside of your home, your yard or your vehicles.
• Condition report photographs — taken at handover and return, to identify damage.
• Insurance certificates — when you upload one for verification. These contain your name, address and policy number.
• Text you enter — search wording, and a web address if you ask us to build a profile from one.

What we never send: card or bank details, passwords, your phone number, or your messages with other users.

Anthropic processes this data on our instructions as a processor, does not use it to train its models, and retains it only as long as needed to return a result. Because Anthropic is based in the United States, this is a transfer outside the UK; it is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Our lawful basis is your consent (UK GDPR Article 6(1)(a)). Withdrawing it stops any further processing; it does not undo processing already carried out. AI output is a suggestion — a draft listing, a damage assessment, a check on an insurance document — and is never the sole basis for a decision with legal or similarly significant effects. A person reviews any disputed outcome.

You can delete your account yourself, at any time, without asking us: in the app under Account → Delete my account, or on the website at Delete my account. You do not need to email or phone us.

Deleting erases your name, email address, phone number, photograph, address, trade profile and documents, takes your listings down, cancels any subscription, and frees your email address so you can sign up again later if you wish. You are signed out and cannot sign back in.

Two things survive, and it is worth being straight about why. Records of completed hires remain on the other party's account, showing you as “Deleted user” — that is their record of a transaction they were part of, and erasing it would take their history with yours. The invoices behind those transactions are kept for six years, as UK tax law requires. This is permitted by UK GDPR Article 17(3), which allows retention for legal obligations and where erasure would override someone else's rights.

If you have a hire in progress or money held in escrow, you will be asked to finish or cancel it first — otherwise the other party would be left with nobody to return the equipment to, or nobody to pay.

We retain your account data for as long as your account is active, plus 6 years thereafter for legal and financial compliance purposes. You can request deletion at any time (see Your Rights below).

Booking and payment records are kept for 7 years to comply with HMRC requirements.

Under UK GDPR, you have the right to:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data (subject to legal retention obligations)
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: At any time, for consent-based processing

To exercise any right, email privacy@thehiresite.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We use cookies for authentication, analytics, and optional personalisation. See our Cookie Policy for full details and opt-out options.

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and restricted database access. No system is 100% secure — if you suspect a breach, contact us immediately at security@thehiresite.co.uk.

We may update this policy periodically. We'll notify you of significant changes by email or by a notice on the platform. Continued use after changes constitutes acceptance.