YardGuild

Effective 2026-05-25

Privacy policy

This page is intentionally plain. Your operator account on YardGuildis yours; the renter records you store about your customers are theirs. Here's how we treat both.

Note: This document is a starter template suitable for a v1 launch. Before serving customers in a regulated industry or processing large-scale renter data, have a privacy lawyer in your jurisdiction review.

1. Who we are

YardGuild is operated from Sydney, NSW, Australia. Contact details are at hello@yardguild.com.

2. What we collect — operator data

When you (the yard operator) sign up, we collect:

  • Email address, given name, family name
  • Country, timezone, tax identifier (ABN / NZBN / VAT / EIN if you provide it)
  • Yard name, optional address, alert email, optional SMS number
  • Inventory you create (asset names, daily rates, photos)
  • Subscription state (tier, status, billing dates)
  • Audit logs of significant actions taken in your tenant

3. What we collect — renter data (your customers)

When you create a contract for one of your renters, we store the data you type in:

  • Renter name, email, phone (if provided)
  • Contract details (period, assets, rental amount, bond amount)
  • Waiver signature (image + IP + timestamp)
  • Bond record (payment method note, reference number, ID-sighted indicator — never the ID photo itself)
  • Condition photos uploaded by you at check-in/out

You are the data controller for renter data. YardGuild is the data processor — we hold and operate on this data on your behalf, governed by our Terms.

4. Where it lives

Each tenant is pinned to one AWS region at signup, picked from the email top-level domain or the country you choose. Data stays in that region:

  • AU — AWS Sydney (ap-southeast-2)
  • NZ — AWS Auckland (ap-southeast-6)
  • UK / IE — AWS London (eu-west-2)
  • CA — AWS Montréal (ca-central-1)
  • US — AWS N. Virginia (us-east-1)

Email (inbound + outbound transactional) is routed via AWS SES in ap-southeast-1 (Singapore) regardless of your tenant region. Static marketing assets are served from CloudFront edge locations globally.

5. Sub-processors

  • Amazon Web Services — hosting, storage, email (per regions above)
  • PayPal — subscription billing for the YardGuild SaaS fee
  • Cognito — authentication (AWS sub-service)
  • Unsplash — default asset photos (no PII passed to them; URL fetch only)

We don't use third-party analytics, ad-trackers, or session-replay tools. There's no Google Analytics, Mixpanel, FullStory, or similar.

6. How we use the data

  • Run the service — process contracts, send notifications, render reports
  • Bill your subscription via PayPal
  • Send transactional email + SMS you've opted into (overdue alerts, weekly summary, due-back SMS)
  • Detect abuse and meet legal obligations (audit logs, fraud prevention)

We don't use your data — or your renters' data — to train any AI model. We don't sell or share it with marketers.

7. Retention

  • While your subscription is active: indefinitely
  • After cancellation: 90 days, then full deletion (or sooner on request)
  • Audit logs (account-level actions): 7 years for tax-residency compliance, then deleted
  • Email forwarder S3 bucket (operator inbox): 30-day lifecycle, auto-purged
  • Lambda + API logs: 7 days, auto-rotated

8. Your rights

Depending on where you're based, you can:

  • Access — see what we hold about you (covered by /counter/, plus we'll send a full export on request)
  • Correct — edit any field from /counter/settings
  • Export — download all your data as CSV from /counter/reports, or request a full JSON dump
  • Delete — close your account and have your data wiped (90-day grace, then purge)
  • Object to processing — relevant under GDPR (UK/IE) and CCPA (US-CA)
  • Lodge a complaint with your local privacy regulator (OAIC AU, OPC NZ, ICO UK, DPC IE, OPC CA, FTC US)

Send privacy requests to privacy@yardguild.com. We respond within 30 days (often faster).

9. Cookies

We use one session cookie set by AWS Cognito to keep you signed in. No tracking cookies, no advertising cookies, no analytics cookies. The marketing site uses no cookies at all.

10. Children

YardGuildis for adult business operators. The service isn't designed for anyone under 18, and we don't knowingly collect data about minors. (Your renters' ages aren't something we track at all.)

11. Changes to this policy

If we change anything material, we'll email all active subscribers at least 30 days before it takes effect. Less-material changes (typo fixes, new sub-processors at the same risk level) are versioned at the top of this page; the "Effective" date reflects the most recent update.

12. Contact

privacy@yardguild.com for anything specific. For general queries: hello@yardguild.com.