Everything within the reach of your hands
This policy explains what ReBorSe does with your personal data: what we collect, why, on what legal basis, who else sees it, how long we keep it, and what you can demand from us. It describes the platform as it actually works today. Where something is not yet in operation, we say so rather than reserving the right to do it later.
ReBorSe is operated by Mohamad Saied Sahiouni as a sole trader. He is the controller for all personal data described in this policy, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).
Our full postal address, together with the contact details required by § 5 of the German Digital Services Act (DDG), is published in our imprint. View imprint.
ReBorSe is not a registered company. There is no GmbH, UG or other legal entity behind it; the controller is a natural person, personally responsible for the platform.
We are not required to appoint a Data Protection Officer and have not appointed one. Data protection questions go directly to the controller at privacy@reborse.com.
We collect the following, and only in the situations described:
We run no advertising technology and no cross-site tracking of any kind. We do not build advertising profiles and we do not buy personal data about you from anyone. We do evaluate some of your activity on the platform itself, to personalise recommendations and to keep the marketplace safe; section 3 explains exactly how. If you switch on usage and performance statistics, in the privacy notice or in the cookie and technology settings, your browser sends ReBorSe anonymous records of which pages and steps are used and how fast pages load: the page type (never the item, person or conversation), the step (for example that a booking request was sent), loading times, the language and the device class (mobile, tablet or desktop). These records carry no user, session or visitor identifier and no browser identification, nothing is stored on your device for them, and they cannot be linked to you or to each other. Your IP address is used only briefly, in memory, to limit abuse, and is never stored. We use the records only to improve the platform. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). They are kept in our own database in Frankfurt, Germany, and passed to no one apart from our hosting processors Supabase and Vercel. You can withdraw your consent at any time, with effect for the future, by switching usage statistics off in the cookie and technology settings; nothing is sent after that.
Identity verification is a document check only. No facial scan, selfie match or other biometric processing takes place, by us or on our behalf.
Support chat: when you use the support chat, we store your chat with ReBorSe: the topic you choose, the messages you write, the automatic messages of our assistant (fixed texts, no artificial intelligence and no automated decisions), the replies of our team, the status of the chat and, if you open it from an item, a rental or a dispute case, the link to it — only to one you are a party to. Your first description of the request is also kept as a summary for our team. Only you and the members of the ReBorSe team who handle support can read the chat; other users cannot. We use it to answer your request and, afterwards, as the record of what we told you. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) where your request concerns your account, a rental or a payment, and otherwise our legitimate interest in answering questions about the platform and in being able to show later what was said (Art. 6(1)(f) GDPR). How long we keep it is set out in section 12.
Your information is used to:
Emails: we send you emails that belong to your account, your rentals and your payments, such as security alerts (for example when your phone number or a payment method changes), notices about a payment that could not be collected by its deadline, receipts, the notices of the platform tax reporting described in section 4, and the confirmation that we have received a withdrawal. The legal basis is our contract with you (Art. 6(1)(b) GDPR); for the tax notices and the withdrawal confirmation it is our legal obligation (Art. 6(1)(c) GDPR), and for security alerts also our legitimate interest in protecting your account (Art. 6(1)(f) GDPR). These emails are delivered by our email service provider Brevo (section 7). Marketing emails are sent only with your consent, which you give topic by topic in your notification settings; it is off by default and you can withdraw it at any time. We currently send no marketing emails at all. If an email cannot be delivered, the recipient reports an email as spam, you unsubscribe or you request deletion of your account, we record this against a fingerprint (hash) of the address, not the address itself, so that we do not write to that address again and can prove what you chose (Art. 6(1)(c) and (f) GDPR). The block list and the records of your consent and its withdrawal have no deletion date, because deleting them would mean writing to that address again or no longer being able to prove your choice.
Push notifications: if you switch on push notifications for a device in your notification settings and allow them in your browser, your browser creates a push subscription with the push service of its vendor — Google for Chrome and most Chromium browsers, Apple for Safari and for home-screen apps on iPhone and iPad, Mozilla for Firefox, Microsoft for some Edge versions on Windows. We store that subscription (its address and the two keys that encrypt the messages), the device class (mobile, tablet or desktop) and the version of the text you agreed to, linked to your account. When there is a notification for you, our server sends it to that push service, identified by our own server key (VAPID), and encrypted so that only your browser can read it (RFC 8291); for security, identity, payment, legal and tax notices the push says only that there is an update, and the full text stays in the app. The push service receives the subscription address, the encrypted message and the technical data needed to deliver it; it may process them outside the EU, and the vendors state that they safeguard such transfers with the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR); placing the notification script and the subscription on your device is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). You can withdraw your consent at any time by switching push off in your notification settings or in your browser; this does not affect notifications sent before. We delete our copy of a subscription 30 days after it is switched off or stops working, and after 90 days without use.
Reports and measures: when you report something, we send you a confirmation of receipt with a case reference, and when the platform holds or restricts a listing of yours, we send you the reasons and how to challenge them. Both are placed in your notifications and sent by email (through Brevo, section 7). The legal basis is our legal obligation under Articles 16 and 17 of Regulation (EU) 2022/2065 (Art. 6(1)(c) GDPR).
Personalised recommendations: when you are signed in, the listings recommended to you are ranked by a fixed set of rules, using the categories and price range of the listings you saved as favourites or recently viewed, the terms and places you recently searched for, and general signals such as a listing's rating, popularity and age. This is profiling within the meaning of Art. 4(4) GDPR. It only changes the order in which listings are shown to you; no one else sees it, and it has no other effect on you. The legal basis is our legitimate interest in showing you listings that are relevant to you (Art. 6(1)(f) GDPR). Recently viewed items and recent searches are only recorded while you have them switched on in the privacy notice or in the cookie and technology settings. Switching them off stops new entries and clears the copy on your device, but the lists already saved to your account stay there, and continue to influence your recommendations, until you delete them on the Search History page or they are deleted automatically after 6 months. Favourites count for as long as you keep them. If you are not signed in, recommendations are not personalised. You can object to this processing at any time (Art. 21 GDPR) by writing to privacy@reborse.com.
Safety checks and trust score: to protect users from fraud, scams and abuse, we record risk signals automatically. A signal is recorded, for example, when a message or listing contains contact details, links or a request to pay outside the platform; when a listing names forbidden items or asks for an unusually high price or deposit; when an account sends messages, creates or edits listings, requests rentals or files reports in unusual numbers within a short time; when you cancel a confirmed rental; and when another user reports you. We store the type of signal, not the text of your message or listing. From the signals of the last 90 days, with older signals counting less, we calculate a risk score. The risk score itself does not block or restrict anything: it serves our internal review. Signed-in users see a trust score from 0 to 100 on your profile, where a higher score is better. It starts at a neutral 50. It rises when your email address, phone number and identity are verified, with your completed rentals as renter or owner and with good reviews; it falls with poor reviews, with confirmed rentals you cancelled in the last 12 months and with the risk score. Until your account has at least three completed or cancelled rentals, your profile shows "New member" instead of a number. The trust score does not block or restrict anything either. The legal basis is our legitimate interest in a marketplace that people can use safely (Art. 6(1)(f) GDPR). You can object on grounds relating to your particular situation (Art. 21(1) GDPR), or ask us to review your score, by writing to privacy@reborse.com; a person will then look at it.
Some fixed rules also apply automatically. A listing that offers people, animals or regulated substances such as drugs or tobacco cannot be saved. A listing that names weapons, medicines or identity documents is held until a person has reviewed it. A message containing contact details or a request to pay outside the platform shows a notice, and if this happens repeatedly you are asked to confirm before the message is sent. An account that is less than 24 hours old, has no verified phone number and has written in 10 or more different conversations within 24 hours must verify its phone number before it can send further messages. These rules protect other users; they are requirements you can meet, not decisions about your account.
Assessment of reports: when someone reports a listing, a message, a conversation or a person, all open reports about it are assessed together and given a score from 0 to 100 that decides the order in which our team reviews them. For this we use the reasons given, how many different people reported it, the age of each reporting account, whether its phone number is verified and how many of its earlier reports were dismissed (so that a new or repeatedly unfounded account counts less), the result of our automatic content rules applied to the reported listing or message, and how many earlier reports against the same person were upheld. We do not tell the reported person who reported them. If we switch it on, a listing that several independent users with established accounts report and that scores high can be hidden provisionally: never a message, a conversation or an account, never for longer than 72 hours, and always reviewed by a person; its owner is told at once by email, including that this was done by automated means. The legal basis is our obligation to handle notices of illegal content (Art. 6(1)(c) GDPR with Art. 16 of Regulation (EU) 2022/2065) and our legitimate interest in protecting users from fraud and unsafe items and in reviewing the most serious reports first (Art. 6(1)(f) GDPR). The assessment holds identifiers, numbers and categories only, never the text of a report, and is kept for three years after the case is closed.
Blocking: if you block another user, we store which account you blocked and when. We use this to stop that account from messaging you or sending you booking requests, to stop you from messaging it or booking its listings, to hide its listings from you in search, on the map, on the home page and in recommendations, and to show each of you only a limited version of the other's profile. A follow between the two of you is removed. Bookings you already have with that user, and their payments, are not affected. We do not tell the other user that you blocked them, but they may notice that they can no longer contact you. Only you can see your block list, in Settings → Privacy → Blocked users, where you can lift a block at any time; lifting it deletes the stored information, and it is also deleted when either account is erased. The legal basis is the performance of our contract with you, because blocking is a feature of the platform you use (Art. 6(1)(b) GDPR), and our legitimate interest in protecting users from unwanted contact (Art. 6(1)(f) GDPR).
Invitations and partner links: every account has a personal invitation code and link, and admitted partners also have a partner link and campaign links. When someone signs up or signs in through one of these links with an account that is new — created no more than 24 hours before — we store with that account the code that was used, which account invited them or which partner and campaign the link belongs to, and the time. Only the first link applied to an account counts, and nobody is counted for their own link. If you sign up through such a link, the sign-up page tells you so. Nothing is stored on your device for this — no cookie and no similar technology: the code travels only in the link itself and in the sign-up. The person who invited you, or the partner, sees only a number — how many accounts were created through their link or campaign — never your name or anything else about you. The legal basis is our legitimate interest in understanding where sign-ups come from, in preventing abuse such as fake accounts or self-referral, and in crediting partners correctly (Art. 6(1)(f) GDPR); for partners, showing them their links and counts is part of our contract with them (Art. 6(1)(b) GDPR). If you apply to the partner programme, we store what the application asks for — the kind of channel, the link to it, the audience size, the country, your message and your two confirmations — together with the decision, its date and any note our staff add; we use it to decide on your application and to run your admission (Art. 6(1)(b) GDPR). Section 12 says how long these records are kept.
We process personal data only where the GDPR allows it. Depending on what we are doing, our basis is one of the following:
Optional features, such as maps, recently viewed items, recent searches and usage and performance statistics, only run after you accept them in the privacy notice, turn them on in the cookie and technology settings or, for maps, use the Enable maps button. You can withdraw that choice at any time, with effect for the future, by switching them off again.
Data is transmitted over encrypted connections and stored on managed infrastructure with access controls, row-level authorisation rules and encryption at rest. Private files such as message attachments and dispute evidence are held in non-public storage that is only reachable through short-lived, permission-checked links. Access to production data is limited to the controller.
Protection against automated abuse: when you send a booking request, a message, a report, the feedback form, a waitlist sign-up or a withdrawal declaration, your browser first runs an invisible check provided by our hosting provider Vercel (Vercel BotID). A short script, loaded from our own address only at that moment, evaluates technical characteristics of your browser and sends the result along with your request; our server then asks Vercel whether the request came from a person, and refuses it if it did not. Vercel receives the technical data of the request for this, such as your IP address and the browser information the check needs. The check stores nothing on your device: it sets no cookie and writes nothing to your browser's storage. We use it on the basis of our legitimate interest in protecting the platform and its users from spam, fraud and automated attacks (Art. 6(1)(f) GDPR); reading the browser information it needs is strictly necessary to provide the service you request securely (§ 25(2) no. 2 TDDDG). Vercel acts as our processor.
No system is perfectly secure, and we do not claim otherwise. We do not currently commission external penetration tests or hold a security certification. If a breach ever occurs that is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours and inform you where the law requires it.
Location is used to show items near you and to estimate distances. You control it in two ways. Your device's precise location is only read if you allow it in your browser or device settings, and is used for the current search rather than stored as a location history. The pick-up area you enter for a listing or profile is deliberately coarsened before it is shown publicly: other users see an approximate area, never your exact address. Exact addresses are shared only between the two parties to a confirmed rental, and only where the rental requires it.
Map tiles and address search are provided by MapTiler AG, Switzerland; Photon, operated by komoot, is used as a fallback. Maps only load once you allow them, in the privacy notice, in the cookie and technology settings or with the Enable maps button. Your browser then loads the map data (map style, map tiles, fonts and map symbols) directly from MapTiler, which receives your IP address and the technical data of each request, such as your browser information and the map area requested. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); you can withdraw it at any time, with effect for the future, by switching maps off in the cookie and technology settings. Address search: while you type into an address field (for example the location of a listing, your home city, a search location or a billing address) or share your location in a chat, your browser asks MapTiler directly for matching places; MapTiler receives the text you type or the coordinates, and your IP address. This happens only when you use one of these functions; the legal basis is our contract with you (Art. 6(1)(b) GDPR) and, for the search location and chat sharing, our legitimate interest in offering a working place search (Art. 6(1)(f) GDPR). If MapTiler does not answer, our server forwards the search to Photon instead, operated by komoot; komoot then receives only the search text, not your IP address. Our server also uses Photon to confirm a home city you select. When you choose the owner's delivery or return service, our server sends the address you enter for it to Photon to calculate the distance the price depends on; komoot receives only that address text, not your name or account, and the coordinates it returns are not stored.
We do not sell your personal data, we do not trade it, and we do not share it with advertising networks or data brokers. Data is passed only to the following, and only for the purposes named:
Every provider acting as our processor is bound by a data processing agreement under Art. 28 GDPR and may use your data only on our instructions.
Our database, file storage and backups are located in Frankfurt, Germany, inside the European Union. The platform itself is served from infrastructure within the EU where the provider offers it.
Some of our providers are established outside the EU or EEA, or may access data from there. Vercel, Stripe and Twilio are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). For Supabase, and for OpenAI, which receives writing-suggestion requests through Vercel, the transfer is covered by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). MapTiler is established in Switzerland, for which an adequacy decision applies; Brevo (France) and komoot (Germany) are established in the EU. If you sign in with Google, Google is responsible for its own transfers. You may request a copy of the safeguards that apply by writing to privacy@reborse.com.
Reviews and ratings you write or receive are visible to other users, along with your public profile, which for signed-in users also shows the trust score described in section 3. This is how trust works on a rental marketplace, and it is part of the service you sign up for.
Some public elements are optional and off unless you turn them on — appearing in the public leaderboard, and showing individual achievements or status badges on your profile. Turning any of them off removes you from public display immediately and costs you nothing you have earned.
We use technologies that are strictly necessary to run the platform, technologies that store a setting you choose yourself (such as your language, theme, favourites or starred conversations), and optional features that only run once you accept them in the privacy notice or turn them on in the cookie and technology settings, such as maps, recently viewed items, recent searches and our own usage and performance statistics. We do not use analytics, advertising or tracking cookies; the usage statistics store nothing on your device. Our cookie policy is generated directly from the platform's own technology registry, so it lists exactly what runs in production and cannot drift out of date. For the full list, read our Cookie Policy.
Under the GDPR you have the right to:
You can exercise several of these yourself in the app: your profile settings let you correct your data, the privacy settings let you request a full export, and your account settings let you start deletion. For anything else, write to privacy@reborse.com.
To exercise these rights, contact us through the app or by email at privacy@reborse.com. We answer within one month, and will tell you if we need longer because a request is complex.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may instead complain to the authority where you live or work.
We do not make decisions about you by automated means alone that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Recommendations only change the order of listings, the risk score does not block or restrict an account, and the fixed safety rules in section 3 are requirements you can meet. Apart from the two cases below, a person decides before an account is suspended or restricted. Two things follow fixed rules and are announced to you in advance: the block that the Platform Tax Transparency Act prescribes if tax details are still missing after a request and two reminders (Art. 22(2)(b) GDPR), which ends as soon as the details are complete; and the closing of unused accounts described in section 12, which you can prevent by signing in. A listing hidden provisionally after reports (section 3) is not such a decision either: it is temporary, ends after at most 72 hours, and a person reviews it. If you disagree with any automated outcome, write to privacy@reborse.com and a person will review it.
We keep as little as we can for as short as we can, and we delete on a schedule rather than on request alone. The periods below are the ones we actually apply:
Where a legal hold applies, for example because a dispute or an authority's request is still open, the relevant data is kept until that hold ends, and then deleted on the schedule above.
ReBorSe is a rental marketplace for adults. Renting involves entering into contracts and making payments, so the platform is not designed or intended for children.
We do not ask for your date of birth when you sign up — only the tax profile asks for it, for the tax reporting described in section 4 — and we do not operate an age check, so we cannot and do not claim to verify anyone's age. We knowingly collect no data from children. If we learn that an account belongs to a child, we will delete it and the data associated with it. If you are a parent or guardian and believe your child has created an account, write to privacy@reborse.com and we will act on it.
When the platform changes, this policy changes with it. We will announce material changes in the app or by email before they take effect, and the date at the top of this page always shows when it was last revised. We will not quietly widen what we do with your data and rely on you not noticing.
For any question about this policy, your data, or to exercise any of the rights above, write to privacy@reborse.com. You can also reach us through the support channels in the app, and our full postal details are in the imprint.
Last updated: 12 October 2026