InflateMate

Privacy Policy

Effective Date: October 10, 2026

At InflateMate (“we,” “our,” “us”), we value your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights. This policy covers InflateMate accounts and our processing of service data. The rental business decides how it uses customer information for its rentals and is responsible for its own privacy notice, retention and off-platform practices. InflateMate processes booking information to provide the business’s requested software features; this platform policy does not replace that business’s notice.

Information We Collect

  • Account Data: name, email, password, and business information.
  • Booking Data: event dates, inventory rented, customer contact and event address details, participant counts or age ranges, event type and free-text instructions. Inquiries include names, contact details and message content.
  • Signing Data: customer or participant information entered or selected for booking documents, signatures, completed documents and available signing audit records. The fields depend on the business’s selected document and booking document policy; a booking may have no signing documents.
  • Payment Data: billing details processed through Stripe (we never store full credit card numbers).
  • Technical Data: IP addresses, browser type, device info, and cookies for analytics.
  • Google Account Data: information from the Google services that a business owner or administrator chooses to connect, as described below.

Google Account Data and Integrations

We access Google account data only after an authorized business owner or administrator chooses to connect a Google integration. We request the Google permissions needed for the selected feature and use the data only to provide the Google integration features you authorize.

  • Google Calendar: When a business connects Calendar, we read the calendars available for selection and export booking events to its selected calendar. Event content can include the event address, customer name, email and phone, participant summary, event type, instructions and rented items. We use these fields to support the business’s event schedule.
  • Google address tools: Where configured, browser Places searches and server address or delivery calculations send address searches and event addresses to Google. They support requested address entry and delivery estimates, separately from optional analytics and advertising consent.
  • Google Search Console: We access the Search Console properties your Google account can manage, your permission level, the property you select, and sitemap URLs and status. We use this information to match your hosted website to the correct property and let you inspect or submit its sitemap. We also read search performance for the connected website: search queries, page URLs, dates, clicks, impressions, click-through rates and average positions. We use these reports to show the business how its website performs in Google Search.
  • Google Analytics reporting: We read the Analytics properties and web data streams available to your Google account, including property and stream identifiers, website addresses and measurement IDs. We use these details to match the selected property to your rental website. We read aggregate users, sessions and page views, including daily visits and popular page paths, to show website visitor reports. Connecting reports does not itself enable browser tracking; visitor tracking has separate setup and consent controls.
  • Google Ads setup: We access the Google Ads accounts available to you, limited account identity and hierarchy information, and conversion actions and their configuration. We use this information to let you select the correct account and find, validate, or create a completed-booking conversion action. We do not access campaigns, ads, keywords, audiences, or cost and return-on-ad-spend reports for this setup feature.
  • Google Ads conversion delivery: If you enable this feature and a visitor provides the required advertising consent, InflateMate may send the selected Google Ads account an eligible Google click identifier, an opaque transaction ID, booking confirmation time, value and currency, and consent state. We do not include the customer's name, email, phone number, payment details, or rented-item details in that delivery. Changes submitted through tenant Privacy choices and GPC-bearing requests stop identifiable unsent conversions. If both the privacy and attribution cookies are deleted, we may be unable to associate a later request with an earlier queued conversion, which can then rely on the last observed choice. Events Google has already accepted cannot be recalled through those controls.

How We Handle Google User Data

  • Limited use: Our use and transfer of information received from Google APIs is limited to providing and improving the user-facing integration features you authorize and is subject to the Google API Services User Data Policy, including its Limited Use requirements.
  • No sale or unrelated advertising use: We do not sell Google user data, use it for targeted advertising, build advertising profiles from it, or allow a service provider to use it for its own purposes. The conversion fields you expressly enable are sent only to the Google Ads destination you select.
  • Security: Google OAuth refresh credentials are encrypted at rest and protected with access controls. Data is encrypted in transit. We restrict human access to cases where you ask for support, where access is needed to investigate security or abuse, or where the law requires it.
  • Limited sharing: We share Google user data only with Google to make the requests you direct, with service providers that process it on our behalf for hosting, security, and operations, or when required by law. Those service providers are not permitted to use it for independent purposes.

How We Use Information

  • To provide and improve our booking and business management services.
  • To process payments and manage subscriptions.
  • To communicate updates, invoices, and support messages.
  • To comply with legal obligations.

Sharing of Information

  • Service Providers: Stripe processes subscription and booking payments and related customer contact and address data. Resend delivers account, inquiry and booking emails. When a booking requests signing documents, DocuSeal processes selected customer or participant fields, signatures and signing records; UploadThing stores completed documents and available audit PDFs. Google receives data for the integrations described above when enabled. Our application uses Vercel for hosting and domain services and Sentry for configured error monitoring. These operational services support the requested software features and are distinct from tenant-selected optional advertising recipients.
  • Legal Compliance: if required by law or court order.
  • No Selling: We never sell personal data to third parties.

Data Retention

We retain account and service data only as long as needed to provide InflateMate, meet legal and security obligations, or resolve disputes. Google connection credentials and selected property, account, and conversion-action configuration are retained while the applicable connection remains active. Search Console and Analytics report results are cached to reduce repeated Google requests. Search Console reports have a six-hour refresh interval and Analytics reports a five-minute interval. Access checks still apply to cached reports, and disconnecting a connection prevents its previous cached results from being served through it.

Disconnecting in InflateMate deletes the stored OAuth credential used by that connection and stops future access through it. Limited non-secret connection, security, and conversion-delivery audit records may remain where needed for service integrity or legal obligations; those records do not contain OAuth tokens. Residual copies in protected backups age out through our normal backup lifecycle.

Your Rights

You can request access to or export of your data, corrections or deletions, and opt out of non-essential communications. You can request deletion of your account and connected Google data by emailing us at the address below. We may need to verify that you are authorized to act for the account before completing a request.

Disconnecting and Revoking Google Access

You can disconnect Search Console, Analytics reports or Google Ads from the applicable InflateMate settings page. A local disconnect stops that feature and removes the credential InflateMate stored for that connection.

A local disconnect may not revoke the underlying Google authorization when the same authorization also supports Google Calendar or another Google feature you connected. To revoke Google access completely, visit your Google Account's third-party connections. Revoking access there may disconnect every InflateMate Google feature covered by that authorization.

Security

We use encryption in transit and at rest, access controls, and monitoring to protect your data.

Contact

Reach us at hello@inflatemate.co with questions or requests related to your privacy.