Privacy Policy

Last updated: January 2025

1. Introduction

YSA Inc. ("YSA," "we," "our," or "us") operates a peer-to-peer rental marketplace for South Asian occasion wear. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and related services (collectively, the "Service").

By accessing or using the Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

  • Account Information: Name, email address, phone number, profile picture, and password when you create an account
  • Identity Verification: Government-issued ID, date of birth, and other verification documents if required
  • Payment Information: Credit card numbers, bank account details, and billing addresses (processed and stored by Stripe)
  • Shipping Information: Mailing addresses, recipient names, and phone numbers for rental deliveries
  • Listing Information: Photos, descriptions, measurements, pricing, and other details about items you list
  • Communications: Messages between users, support inquiries, and feedback you provide
  • Tax Information: Social Security Number or EIN for Listers receiving payouts (required by law for tax reporting)

2.2 Information Collected Automatically

  • Device Information: Device type, operating system, browser type, unique device identifiers, and mobile network information
  • Log Data: IP address, access times, pages viewed, links clicked, and the page you visited before navigating to our Service
  • Location Information: General location based on IP address; precise location only with your consent
  • Cookies and Tracking Technologies: Information collected through cookies, pixel tags, web beacons, and similar technologies
  • Usage Data: Features used, actions taken, time spent on pages, search queries, and browsing patterns

2.3 Information from Third Parties

  • Authentication Providers: If you sign in with Google or other providers, we receive your name, email, and profile picture
  • Payment Processors: Transaction status, payment confirmation, and fraud risk assessments from Stripe
  • Shipping Partners: Tracking information, delivery status, and shipping events from carriers
  • Analytics Providers: Aggregated usage data and analytics from third-party services

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process rental transactions, payments, and payouts
  • Facilitate shipping, tracking, and delivery of items
  • Create and manage your account
  • Verify user identity and prevent fraud
  • Send transactional communications (order confirmations, shipping updates, reminders)
  • Respond to inquiries and provide customer support
  • Enforce our Terms of Service and protect user safety
  • Detect, investigate, and prevent fraudulent or illegal activities
  • Comply with legal obligations and tax reporting requirements
  • Analyze usage patterns and improve user experience
  • Send marketing communications (with your consent, where required)
  • Personalize content and recommendations

4. How We Share Your Information

4.1 With Other Users

  • Renters receive: Lister's display name, general location (city/state), and return shipping address after booking
  • Listers receive: Renter's name, shipping address, and phone number to fulfill orders
  • Public Profile: Your display name and any information you choose to make public in your profile

4.2 With Service Providers

We share information with third-party vendors who perform services on our behalf:

  • Stripe: Payment processing, payout distribution, and fraud prevention (Privacy Policy)
  • Shippo: Shipping label generation, rate calculation, and tracking
  • Supabase: Database hosting and file storage
  • Vercel: Website hosting, edge functions, and analytics
  • Sentry: Error tracking and performance monitoring
  • Inngest: Background job processing
  • Email Service Providers: Transactional and marketing email delivery

4.3 For Legal Reasons

We may disclose information when we believe it is necessary to:

  • Comply with applicable laws, regulations, or legal processes
  • Respond to lawful requests from government authorities
  • Enforce our Terms of Service and other agreements
  • Protect our rights, privacy, safety, or property
  • Protect the safety of our users or the public
  • Investigate potential violations or fraud

4.4 Business Transfers

In connection with a merger, acquisition, bankruptcy, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

  • Essential Cookies: Required for the Service to function (authentication, security, session management)
  • Functional Cookies: Remember your preferences and settings
  • Analytics Cookies: Help us understand how users interact with the Service
  • Marketing Cookies: Track effectiveness of our advertising (if applicable)

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

  • Encryption of data in transit using TLS/HTTPS
  • Encryption of sensitive data at rest
  • Secure storage with access controls
  • Regular security assessments and monitoring
  • Employee access restrictions and training
  • Secure third-party service providers

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

7. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy. Specifically:

  • Account Data: Retained while your account is active and for 3 years after deletion for legal compliance
  • Transaction Records: Retained for 7 years for tax and legal purposes
  • Communications: Retained for 2 years after resolution
  • Usage Data: Aggregated or anonymized after 2 years

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or legitimate business purposes.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information (subject to legal retention requirements)
  • Portability: Request your data in a structured, machine-readable format
  • Objection: Object to processing of your information for certain purposes
  • Restriction: Request restriction of processing in certain circumstances
  • Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@ysa.dev. We will respond within 30 days. We may request verification of your identity before processing requests.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the CCPA:

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
  • Right to Delete: Request deletion of your personal information
  • Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell personal information)
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your CCPA rights, contact us at privacy@ysa.devor call us at the number provided on our website.

10. Do Not Track

Some browsers include a "Do Not Track" (DNT) feature. We do not currently respond to DNT signals. We treat all users consistently regardless of DNT settings.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe we have collected information from a child, please contact us at privacy@ysa.dev.

12. International Data Transfers

Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

By using the Service, you consent to the transfer of your information to the United States and other countries. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by:

  • Posting the updated policy on this page with a new "Last updated" date
  • Sending an email notification for significant changes
  • Displaying a prominent notice within the Service

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

For data protection inquiries, you may also contact our Data Protection Officer at dpo@ysa.dev.