Privacy Policy

Last updated: May 27, 2026 · Effective date: May 27, 2026

This Privacy Policy explains what personal information Ridge Link LLC, an Arkansas limited liability company doing business as idle iron ("idle iron," "we," "us," or "our"), collects when you use the Service, how we use it, who we share it with, where we store it, how long we keep it, and what rights you have over it. We have written it in plain language. If anything is unclear, email info@idle-iron.com.

1. Who this policy applies to

This Privacy Policy applies to:

• Account holders: anyone who creates an idle iron Account, whether as a Renter, an Owner, or both.
• Counterparties: anyone whose information is provided to idle iron in the course of a Booking, including operators a Renter designates, individuals authorized to pick up equipment, and individuals named in a damage claim or rental agreement.
• Visitors: anyone who browses idle-iron.com, the marketing pages, or any related sub-domains without creating an Account.

2. Information we collect

2.1 Account information

• First name, last name, email address, and password (stored as a one-way salted hash; we never see plaintext);
• Phone number, if provided;
• Street address, unit, city, state, and ZIP code, if provided;
• The display city you choose to show on listings;
• Role (Renter, Owner, or both);
• If you signed in with a third-party identity provider (Google), the name and email address the provider returned to us, plus the provider's stable user identifier.

2.2 Listing information

• Equipment category, subcategory, make, model, year, hours, weight;
• Daily, weekly, and monthly rental rates;
• ZIP code where the Equipment is located;
• Delivery offered (yes or no), delivery radius, delivery fee;
• Renter requirement (any responsible adult, experienced operator, verified contractor);
• Damage-protection method (card on file, refundable deposit, or both) and deposit amount, if any;
• Free-text description and list of included attachments;
• Photographs of the Equipment that you upload.

2.3 Booking information

• The listing booked, the Renter, the Owner, the start and end dates, the rates in effect at the time of booking, and the total amount;
• The Booking status (pending, confirmed, in progress, completed, cancelled, disputed);
• Messages exchanged between the parties through the Service;
• The Rental Agreement signed by the parties, including any signatures, signature timestamps, and the IP addresses from which signatures were made;
• Damage-claim filings, including photographs, descriptions, repair estimates, and the parties' responses.

2.4 Verification information

• If you complete an identity-verification step: name, date of birth, government-issued identification document (a driver's license, state ID, or passport), a live selfie taken at verification time, and the verification provider's pass/fail result.
• If you connect a payout method as an Owner: the limited identifying information the payment processor returns to us, such as the last four digits of the connected bank account or card and the processor's account identifier.
• If you provide a Form W-9 or equivalent tax form for 1099-K reporting: name, business name (if applicable), tax classification, address, and taxpayer identification number.

2.5 Communications and support information

• The content of any email you send to info@idle-iron.com or other published support address;
• The content of any contact form you submit on the Service;
• Notes we make in your Account record while assisting you.

2.6 Automatically collected information

• IP address and approximate geographic location derived from IP;
• Browser type and version, device type, operating system, screen size, language;
• Referring URL, the pages you view, the actions you take in the Service, timestamps;
• Performance and error logs;
• If you opt in to push notifications, the push subscription identifier and delivery records.

We do not use Google Analytics, Facebook Pixel, advertising cookies, or any third-party behavioral-advertising tracker on the Service. We do not sell your personal information and we do not engage in cross-context behavioral advertising.

3. How we collect the information

We collect personal information in three ways:

1. Directly from you, when you create an Account, complete a profile, create a listing, request or accept a Booking, send a message, upload a photograph, file a damage claim, contact support, or otherwise interact with the Service;
2. Automatically, when you access or use the Service, through standard web technologies such as server logs, cookies (Section 5), and the device characteristics your browser reports;
3. From third parties, including the identity provider you use to sign in (if you sign in with Google, we receive the name and email address Google returns), the payment processor (when you make or receive a payment, the processor returns limited information about the transaction), and the identity-verification provider (when you complete a verification, the provider returns a pass/fail result and any required underlying data).

4. How we use the information

We use personal information for the following purposes only:

• To provide the Service: authenticate you, render the listings you have access to view, render the Bookings you are a party to, route messages, process payments, generate Rental Agreements, manage damage claims, send transactional and account-related email and push notifications.
• To enforce these Terms: detect and prevent fraud, abuse, harassment, off-platform-payment evasion, and other prohibited conduct under Section 26 of the Terms of Service.
• To verify identity and prevent fraud: when you complete identity verification, we use the result to confirm that the person operating the Account is the person identified.
• To complete tax and regulatory reporting: file 1099-K forms for Owners crossing federal payment-volume thresholds; respond to lawful requests from tax authorities; respond to lawful requests from law enforcement.
• To support you: answer questions, troubleshoot issues, send transactional notices about your Account.
• To improve the Service: analyze aggregated, de-identified usage to identify bugs, usability issues, and opportunities for new features.
• To comply with law: respond to subpoenas, court orders, and other legal process, and exercise our legal rights.

We do not use your personal information to train artificial-intelligence models, and we do not send it to any third-party AI provider. Our in-product help chatbot runs entirely in your browser: it matches your question against our published FAQ and answers from a built-in list. Nothing you type into the chat widget is sent to idle iron's servers or to any third party, and no chat transcript is stored. We will update this Privacy Policy before any change to that design takes effect.

5. Cookies and similar technologies

We use only the following cookies and similar technologies:

• Authentication session: set by Supabase to keep you logged in. Cleared when you sign out.
• Bot protection: short-lived tokens set by the bot-protection provider (Cloudflare Turnstile or equivalent) during signup, sign-in, and password reset to verify you are a human.
• Push notification preference: local-storage entries that remember your push-notification subscription, if you have opted in.

No advertising cookies. No third-party trackers. No cross-site or cross-context behavioral profiling. Because we do not use tracking cookies, no cookie banner is required for visitors in California, the European Union, or elsewhere. If we ever add tracking cookies, we will add the appropriate banner first.

6. Sharing personal information with other users

idle iron is a marketplace, which means we share information between users as needed to complete Bookings. The categories of information shared between users are:

• Public profile: visible to anyone using the Service, including visitors without Accounts. Includes your first name, the city you choose to display on listings, your verification badge (if you completed identity verification), and your "on idle iron since" month.
• Listing content: your published listings are visible to anyone using the Service. Includes equipment details, photos, ZIP code, rental rates, delivery options, requirements, and damage-protection method.
• Booking-only information: information shared only between the Owner and the Renter of a confirmed Booking, including last name, full address (for delivery or pickup logistics), phone number, and messages exchanged through the Service.
• Damage-claim records: the contents of a damage claim, including photos, repair estimates, and the parties' written responses, are visible to both the Owner and the Renter of the Booking concerned.
• Rental Agreement: the signed Rental Agreement, including signatures and timestamps, is available to both parties for their records.

7. Service providers (subprocessors)

We share personal information with the following service providers (subprocessors) as needed to operate the Service. Each is bound by a data-processing agreement or equivalent contractual protection.

• Supabase (Supabase, Inc., USA) — database, authentication, file storage, real-time sync. Stores Account information, listings, photos, Bookings, messages, agreements, and damage claims.
• Cloudflare (Cloudflare, Inc., USA) — DNS, content delivery, web application firewall, bot protection, email routing.
• SendGrid (Twilio, Inc., USA) — outbound transactional email delivery (sign-up, password reset, booking notifications, damage-claim notifications).
• Payment processor (currently Stripe, Inc., USA, when billing is enabled) — handles card payments, payouts to Owners, identity verification, and 1099-K reporting. We provide the processor only with the information needed to complete those tasks; the processor stores full card numbers and bank account numbers on its own systems, not ours.
• Identity verification (the provider used by the payment processor for Stripe Identity, or a stand-alone provider if engaged) — verifies your identity when required. Receives the documents and information you submit for verification.
• Google (Sign-in with Google) (Google LLC, USA). When you choose to sign in with Google, Google receives the OAuth request and returns your name and email address. The in-product help chatbot does not use Google or any other AI provider; it runs entirely in your browser (Section 4).
• Insurance referral partner (Insureon or a comparable provider, if and when an insurance-referral feature ships) — receives the limited information needed to follow the referral, with your consent at the time you click through. The carrier or broker the partner introduces you to has its own privacy policy.
• Hosting and operations (Cloudflare Pages for static site hosting; reserved for any operational provider engaged to keep the Service running) — does not receive personal information beyond what is required to deliver the Service.

We do not sell, rent, license, or trade your personal information for any purpose, and we do not share it with third parties for their own marketing.

8. Identity verification

If you complete identity verification, the verification provider collects and processes the identification document you upload, a live selfie, and any other data required by the provider's process. The provider returns to us only a pass/fail result and the timestamp of verification. The underlying document and selfie are stored by the provider under the provider's own security and retention practices, not by idle iron, except as required to maintain an audit trail. We will identify the specific provider in this Privacy Policy when the verification feature is enabled.

9. Payments and tax information

When billing is enabled and you make a payment, the payment processor collects your card data directly. We receive only display-level details, such as the last four digits of the card and a customer identifier issued by the processor. We do not store full card numbers, CVVs, or bank account numbers on our own systems.

When billing is enabled and you receive a payout as an Owner, the payment processor collects your bank-account information, Social Security Number or Employer Identification Number (as applicable), and any other information required to comply with U.S. tax law. We receive only a confirmation that the payout method is in place, not the underlying numbers. The processor issues any required Form 1099-K on our behalf.

10. Communications

We send the following categories of communications:

• Transactional: account creation, password reset, booking requests and acceptances, rental-agreement signing reminders, damage-claim notices, payout notifications. These cannot be unsubscribed from while you have an active Account; they are required to operate the Service.
• Push notifications: only if you opt in. You can disable push notifications from your browser, your operating system, or your Account settings at any time.
• Product updates: occasional emails about new features, important changes, or material policy updates. You can opt out by clicking the unsubscribe link in any such email or by emailing info@idle-iron.com.

11. Where data is stored

idle iron's database and primary storage are hosted by Supabase in the United States (us-east-1 region). Subprocessors listed in Section 7 maintain their own data-center footprints, predominantly in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. The Service is not designed for use outside the United States and is not offered there. You acknowledge that U.S. law may differ from the law of your country of residence.

12. How long we keep data

Retention periods:

• Active Account: for as long as you maintain an Account, plus a wind-down period of up to 90 days after Account closure to permit reactivation, dispute resolution on pending Bookings, and export of your data on request.
• After Account closure: most Account information is deleted within 90 days of closure, except as described below.
• Booking records: complete records of Bookings (the listing as it appeared at booking time, the messages, the signed Rental Agreement, any damage claim, the payment records) are retained for seven (7) years after the Booking is completed, to comply with tax law, to support any later-arising claim by either party, and to enable any 1099-K correction or supplementary tax filing.
• Identity-verification records: a verification result (pass/fail and timestamp) is retained for the life of the Account plus seven (7) years.
• Billing and tax records: retained for seven (7) years, as U.S. tax law requires.
• Backups: encrypted backups may persist for up to 30 additional days after live data is deleted before being overwritten.
• Marketing inquiries: contact-form submissions, support emails, and similar inquiries that do not become an Account are retained for up to 24 months and then deleted, unless they convert to active customer matters first.
• Legal hold: information subject to a litigation hold, subpoena, court order, or regulatory request is retained for the duration of the hold.

13. Your rights

Regardless of where you live, you have the following rights with respect to personal information we hold about you:

• Access: request a copy of the personal information we hold about you;
• Correct: ask us to fix inaccurate information;
• Delete: request that we delete your Account and associated data, subject to retention requirements in Section 12 (tax records, signed agreements, and damage claims may need to be retained even after Account closure);
• Export: receive a copy of your listings, Bookings, messages, and Rental Agreements in a portable format;
• Opt out of non-essential communications: turn off product-update email and push notifications.

To exercise any of these rights, email info@idle-iron.com from the address on your Account or, if you cannot, send a letter to the address in Section 19. We respond within 30 days. We may require you to verify your identity before fulfilling a request, especially for access, correction, deletion, and export requests.

14. California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020:

• The right to know the categories of personal information we have collected, the sources, the purposes for which we use them, the categories of third parties with whom we share them, and the specific pieces of personal information we hold;
• The right to delete your personal information, subject to exemptions (tax records, signed agreements, fraud-prevention records);
• The right to correct inaccurate personal information;
• The right to opt out of any "sale" or "sharing" of your personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing operative to opt out of, but the right exists nominally;
• The right to limit use of sensitive personal information. We collect sensitive personal information (precise geolocation, government-issued identifier) only for the purposes of providing the Service and complying with law, which is exempt under the CCPA's "necessary" exception;
• The right to non-discrimination for exercising any of these rights.

Categories of personal information collected in the prior 12 months (CCPA terminology in parentheses):

• Identifiers (name, email, phone, IP address, online identifier);
• Personal information described in Cal. Civ. Code § 1798.80(e) (address, payment information);
• Internet or other electronic network activity information (server logs, click data);
• Geolocation data (approximate, derived from IP; precise, only if you grant device-level permission for delivery or photo metadata);
• Audio, electronic, visual, or similar information (photographs you upload);
• Professional or employment information (when an Owner identifies as a business);
• Sensitive personal information (driver's-license number or other government identifier collected for identity verification; precise geolocation if granted; Social Security Number for tax forms).

Sources of collection: directly from you, automatically from your device, and from service providers (Section 3). Purposes: Section 4. Categories of recipients: Section 7. Retention: Section 12.

To exercise your CCPA / CPRA rights, email info@idle-iron.com with the subject line "California Privacy Request" or use a verified consumer-rights request via your registered Account email.

California consumer-rights notice (Civil Code § 1789.3)

Under California Civil Code § 1789.3, California residents are entitled to the following notice: idle iron is provided by Ridge Link LLC, 1204 NE Bluff Spring Ave, Bentonville, Arkansas 72712. The Service is provided without charge to browse; fees for completed Bookings are described in our Terms of Service. If you have a complaint regarding the Service, or wish to receive further information about its use, contact us at info@idle-iron.com. You may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210 or (916) 445-1254.

15. Residents of other states with privacy laws

Residents of states with comprehensive consumer-privacy laws have rights to access, correct, delete, port, and (in some states) opt out of certain processing. To exercise those rights, email info@idle-iron.com. Identify your state of residence in the email so we can apply the relevant statutory framework. We respond within 30 days, which we may extend by 45 days where the law allows on a complex request, with notice.

16. Security

We protect personal information using:

• TLS encryption for all data in transit;
• Encryption at rest in the Supabase-managed database and storage layers;
• Row-level security policies that enforce isolation between Accounts at the database level (one Account cannot read another's listings, Bookings, messages, or damage claims, even if the application code were compromised);
• One-way salted password hashing (Argon2 or comparable);
• Bot protection on signup, sign-in, and password reset;
• Audit logging on sensitive Account actions;
• Principle-of-least-privilege access to backend systems for human operators;
• Reasonable practices for credential rotation, vulnerability scanning, and dependency updates.

No system is perfectly secure. If you believe you have discovered a vulnerability, please email info@idle-iron.com with details and we will respond promptly. Please do not test in ways that risk other users' data.

Security incident notification

If we discover a security incident that affects your personal information, we will notify you without undue delay, and in any case within the timeframes required by applicable state breach-notification laws. Our notice will describe what happened, the categories of information involved, what we have done in response, and steps you can take to protect yourself.

17. Children's privacy

The Service is intended for adults at least 18 years old and the age of majority in their state. It is not designed for or directed at children. We do not knowingly collect personal information from any person under the age of 13. If we learn that we have collected such information, we will delete it. Parents who believe their child has provided information to the Service should contact info@idle-iron.com.

18. Changes to this policy

We may modify this Privacy Policy from time to time. For material changes, we will notify you by email to the address on your Account, by in-app notice, or by banner on the Service at least 30 days before the changes take effect. Non-material changes (typographical corrections, vendor-name updates, clarifications) take effect on posting. Continued use of the Service after the effective date constitutes acceptance.

19. Contact

Questions, requests, or complaints about this Privacy Policy or your personal information:

Email: info@idle-iron.com
Mailing address: idle iron, c/o Ridge Link LLC, 1204 NE Bluff Spring Ave, Bentonville, Arkansas 72712, United States