Privacy notice
Draft for legal review · version 0.1 of 12 Oct 2026 · not yet in force
This explains what personal data grabbi processes, why, for how long and who we share it with, and what your rights are. We follow Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection (Slovakia).
1. Controller
The controller of your personal data is GRABBI s. r. o., with its registered office at Veľká okružná 17, 010 01 Žilina, Company ID (IČO) 57 936 757, entered in the Trade Register (Okresný úrad Žilina, č. živnostenského registra 580-86559) ⟦and in the Commercial Register of the Žilina District Court, section Sro, file no. …⟧. Contact for personal data matters: ahoj@grabbi.sk. We haven’t appointed a data protection officer, because Article 37 GDPR doesn’t require us to. ⟦Check with a lawyer given the extent of location and message processing.⟧
2. What data, for what purpose, on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, phone, password (only as a hash), language | Account, sign-in, contact at handover | Contract — Art. 6(1)(b) GDPR |
| Neighbourhood and exact handover address | Show offers nearby; the other side sees the address only after the booking is confirmed | Contract |
| Work site address (with a machine and operator) | So the operator knows where to come; the owner sees it with the request, to be able to decide | Contract |
| Approximate device location (only if you allow it) | Offers within 10 km; we don’t store it on the server | Consent — Art. 6(1)(a), withdrawable in your device settings |
| Offers and their photos | Publish the offer | Contract |
| Rentals, condition photos, handover code, chat messages and photos | Carry out the rental, evidence of condition, settling disputes | Contract; legitimate interest in defending claims — Art. 6(1)(f) |
| Payments: Stripe identifiers, card brand and last 4 digits, amounts | Payment, deposit, refunds, payouts | Contract; legal obligation for accounting records — Art. 6(1)(c) |
| Ratings | Trust between users | Legitimate interest |
| Profile: first name with the initial of your surname, neighbourhood, verification badge, ratings, when you joined grabbi and your offers | Trust between users. Anyone can see the profile of someone who offers something; someone who offers nothing is visible only to the people they have rented with | Contract; legitimate interest |
| Reports, blocks, decisions and the log of staff actions | Safety, meeting the Digital Services Act, showing who did what | Legal obligation (Regulation 2022/2065); legitimate interest |
| Rental shop application (name, Company ID, note) | Assess the application; the shop’s name and Company ID are then shown to renters before they order | Steps before entering a contract; legal obligation (§ 16 of Slovak Act No. 108/2024 Coll.; § 11b of Czech Act No. 634/1992 Coll.) |
| IP address and device type at sign-in, attempt counters | Account security, protection against password guessing | Legitimate interest |
| Push notification token | Send notifications to your phone | Contract; turn them off in your device settings |
| E-mail notifications | Keep you informed about a rental | Contract; optional ones can be turned off in your profile |
| Error reports (account identifier, screen address, error description) | Fix bugs | Legitimate interest |
| Date of birth, birth number or tax ID, country of tax residence and rental income | Reporting to the tax office under the DAC7 directive — only from owners who rent out means of transport or offer a machine with an operator | Legal obligation — Art. 6(1)(c) GDPR, Slovak Act No. 442/2012 Coll. implementing Directive (EU) 2021/514 |
We don’t store ID documents or selfies in grabbi. ⟦Once a verification partner is chosen, add what it processes.⟧ Card details are processed only by Stripe.
We don’t carry out automated decision-making or profiling with legal effects under Article 22 GDPR. A person always decides on disputes, account suspensions and hiding offers.
If you don’t give us the data needed for the contract, we can’t provide you with an account or a rental.
3. Who sees your data
- Other users: your first name and the initial of your surname, neighbourhood, rating, number of rentals, verification badge and your offers.
- The other side of a confirmed rental: also your phone number and exact handover address, and the messages and photos from that rental.
- Authorised grabbi staff: the data needed for support, settling disputes and safety, including the messages and photos of a rental they are deciding on. Every action they take is logged.
4. Processors and other recipients
| Recipient | For what | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Payments, deposit, payouts and owner verification (an independent controller for its own legal obligations) | Ireland; transfers to the US under the EU–US Data Privacy Framework and standard contractual clauses |
| Neon (Databricks) | Database | EU — Frankfurt |
| Hetzner Online GmbH | The server that runs the app and stores photos | EU — Germany (Falkenstein) |
| ⟦Resend⟧ | Sending e-mails | ⟦to be added once enabled⟧ |
| Google (Firebase Cloud Messaging), Apple (APNs) | Delivering push notifications | US; EU–US Data Privacy Framework |
| ⟦Sentry⟧ | Error reports | ⟦add region once enabled⟧ |
| ⟦S3 photo storage⟧ | Photos, if we move them off the server | ⟦to be added⟧ |
| OpenFreeMap | Map tiles; your browser fetches them directly (it sees your IP address and the area shown) | EU ⟦verify⟧ |
| OpenRouter, Inc. and Anthropic PBC (the Claude model) | The suggested price and deposit for a listing: they get its first photo (without where it was taken), name, category and description, not your name or contact details; they don't train models on it ⟦lawyer: how long the providers keep it (Anthropic up to 30 days)⟧ | USA; EU–US Data Privacy Framework ⟦lawyer: verify both certifications, the Art. 28 agreement and standard contractual clauses⟧ |
| OpenStreetMap Foundation (Nominatim) | Finds the neighbourhood and a rough point for the map from the address where you hand a thing over; it gets only the address, not your name | United Kingdom ⟦verify: adequacy decision, Art. 28 agreement⟧ |
| Financial Directorate of the Slovak Republic | DAC7 report on owners of means of transport and machines with an operator; it shares it with tax authorities of other EU states | Slovakia |
We have contracts with our processors under Article 28 GDPR. We also share data with public authorities where the law requires it. We don’t sell data or use it for advertising.
5. How long we keep data
- Account and profile: for as long as you use your account.
- When you close your account, we delete your sign-in details, sessions, cards saved at Stripe, saved items, notifications, blocks, and offers that were never rented. We replace your name, e-mail, phone and address with an anonymous record.
- Rentals, payments, condition photos, messages, ratings and reports you were part of are kept after you close your account, because they also belong to the other side and serve to defend claims: for the limitation period, at most 4 years after the rental ends (§ 101 et seq. of the Slovak Civil Code). Accounting records of payments for 10 years (§ 35 of Act No. 431/2002 Coll. on Accounting).
- Logs of staff actions and content decisions: 5 years.
- Data for the DAC7 report: 10 years from the end of the year it was reported for.
- A sign-in session lasts 90 days from last use; a password reset link 60 minutes; an e-mail confirmation link 48 hours.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time, without affecting the lawfulness of processing before you withdrew it.
Send requests to ahoj@grabbi.sk. We handle them within one month (Art. 12(3)). You can also correct your name, phone and e-mail yourself in your profile, and close your account there.
If you think we are handling your data unlawfully, you can complain to the supervisory authority: the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava (dataprotection.gov.sk), or the authority of the country where you live — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).
7. Security
We store passwords only as hashes, communication is encrypted (HTTPS), rental photos are available only through time-limited signed links, and staff access is limited to those who need it and is logged. If a data breach is likely to seriously harm you, we will tell you (Art. 34 GDPR).
8. Children
grabbi is for people aged 18 and over. We don’t knowingly process children’s data; if we learn of such an account, we close it.
Registered office: Veľká okružná 17, 010 01 Žilina
Company ID: 57 936 757
Okresný úrad Žilina, č. živnostenského registra 580-86559
ahoj@grabbi.sk