Your privacy in this preview

Who is responsible

Legal name: reforge OÜ. Registry number: 17500505. Registered address: Varjula, Orguse küla, Rapla vald, Rapla maakond, 79409, Estonia.

Serdar Mustafa is responsible for privacy and security. Contact him through info@reforge.ee.

What works today

You can browse trailer information and calculate a rental price. Customer accounts, reservations, identity checks and payments are closed. A preview price calculation is not saved as a booking or quote in our database.

Information used to deliver the site

Our hosting provider, Netlify, receives connection and request information, such as your IP address and browser information, to deliver and protect the website. Rental dates and rental-use selections are sent to our server to calculate the requested price. Our purpose is to provide the preview you request and protect its operation; we rely on legitimate interests for these activities.

The PostgreSQL database is hosted by Neon in Frankfurt. Netlify also uses infrastructure outside the European Economic Area, including the United States. An EU database does not mean all processing stays in the EU. Provider agreements, transfer safeguards and exact log retention are being reviewed before customer accounts open. We do not promise a retention period we have not verified.

Language and appearance cookies

If you change the language or appearance, first-party cookies reforge-locale and reforge-theme remember that choice for up to one year. They do not contain your name or email and are not used for advertising. You can change these settings using the header controls or remove the cookies in your browser. The default appearance follows your device setting. We do not use advertising trackers. Optional analytics is described below.

Service diagnostics and device storage

To detect failures and protect operation, application diagnostics record a timestamp, a random request reference, an operation category, response status and duration. We do not deliberately include request bodies, full URLs, card data, email addresses, cookies or authentication secrets in these diagnostics. Hosting logs can separately contain connection information. Provider retention and alert delivery still need operational verification. The installed app stores only a generic offline notice in its service-worker cache.

Optional product analytics

Optional PostHog EU analytics is prepared but disabled pending provider, retention and free-plan review. No optional product events are sent while it is disabled.

We do not capture form values, account/payment pages, identity documents or session recordings. A first-party cookie remembers your choice for six months; the random event reference lives only in page memory. Withdrawal stops future events but cannot recall events already delivered. Protected aggregate business reporting uses existing rental records and does not send those records to PostHog.

EU collection does not mean every provider operation stays in the EU. PostHog’s processing agreement describes international processing and transfer safeguards. Actual event retention and rights handling must be recorded before collection is enabled; a short retention period is not assumed.

PostHog privacy information

Your choices and rights

You may ask us about your information, request access or correction, and request erasure, restriction or object to processing where those rights apply. We may need proportionate information to verify a request. Do not send identity-document copies or passwords in your first email. We aim to respond within one month; any lawful extension will be explained. You can complain to Estonia’s Data Protection Inspectorate.

Estonian Data Protection Inspectorate

Invited operator account

Customer registration remains closed. An invited operator may create an account to administer this preview. We store their email, display name, password hash, encrypted authenticator and recovery information, sessions, rate-limit records and security audit events. If you register a passkey, we also store its public credential, optional device name and security metadata. We never receive your fingerprint, face data or private device key. Resend delivers verification and password-reset emails from Ireland; Netlify and Neon provide the hosting described above. We use this information for our legitimate interest in securely administering the service. Active sessions last up to eight hours; verification links expire after one hour and reset links after 30 minutes. Expiry disables access but does not itself delete database records. Longer-term retention and the customer-account notice remain under review. Contact info@reforge.ee for access, correction or deletion requests; requests are reviewed before deleting records needed for security or legal obligations.

Tracking privacy requests

Signed-in users can submit privacy requests and see their receipts and responses. We record the account reference, request type, receipt time, response target and review outcome to handle the request and document our response. A duplicate open request of the same type keeps its original receipt and target. Submitting a request does not automatically delete data or change processing. The privacy owner reviews applicable rights and any legal retention needs; you can also email info@reforge.ee without signing in. Longer-term retention of these request records is part of the launch review.

Before live rentals

We will publish the notice for customer accounts and rentals before those features open, including their purposes, data categories, providers and retention rules. This preview notice does not describe a live identity, contract or payment service.