← Back to home

Privacy Policy

Last updated: August 24, 2026

This Privacy Policy explains how IXTAbox / IXTArent (“we”, “us”) processes personal data when you use ixtarent.com and related booking, partner, and support services (the “Service”). It applies to guests, customers, distributors, and IXTAowners.

Controller contact: developerixtarent@gmail.com, phone +46-70-2223250, Hudenevägen 34, 524 92 Herrljunga, Sweden.

1. Times and time zones

Booking start and end times, access windows, and related communications are generally presented in Sweden local time using the Europe/Stockholm time zone (CET in winter, CEST in summer), regardless of where you live.

2. What data we collect

Depending on how you use the Service, we may process:

  • Account and profile: name, email, phone number, role (guest, customer, distributor, IXTAowner, admin), and login credentials managed via our authentication provider.
  • Business identity (partners): legal/company name, company registration number, website, contact person, and other details you submit when applying as a distributor or IXTAowner.
  • Booking and payments: rental dates and times, location and box details, amounts, currency, payment status, and transaction references. We do not store full payment card numbers. Card payments are handled by our payment processor (Stripe).
  • Communications: in-app messages, support emails, and booking emails or SMS where you have provided a phone number and opted in.
  • Return photos and access data: photos you upload when returning a box, lock PINs, and unlock-link tokens needed to complete a rental.
  • Technical data: IP address, device/browser type, approximate location derived from IP, and security/troubleshooting logs.

3. Bank account numbers and payout details

We collect bank account numbers in some parts of the Service. This does not apply to ordinary guest or customer bookings.

Specifically:

  • IXTAowners: when you register to host a location and receive rental payouts, we collect your IBAN (international bank account number). We store it on your partner profile so we can identify where payouts should be sent and to complete payment-provider onboarding.
  • Stripe Connect: to actually pay you, you also connect a bank account through Stripe. Stripe may collect the same or additional account details (IBAN or local account number, account-holder name, identity documents, and tax information) under Stripe’s own terms and privacy notice. We may store Stripe’s connected-account identifier on your profile.
  • Admins: authorised IXTArent staff may see payout status and a masked IBAN (for example last four characters) to support verification and troubleshooting. They do not need your card details for customer bookings.
  • Customers and guests: we do not ask for your bank account number to rent a box. If you pay by card, wallet, or similar methods, those account/card numbers are processed by Stripe, not stored by us as full numbers.

Bank account numbers are used only to pay partners, prevent fraud, meet bookkeeping and tax duties, and operate the Service. We do not sell this information.

4. Why we use your data (purposes and legal bases)

  • Contract: to create accounts, take bookings, send access codes, process payments and refunds, and pay IXTAowners.
  • Legal obligation: accounting, tax, and responding to lawful requests. Payment and payout records (including IBAN where relevant) may be kept for the period required by Swedish bookkeeping rules.
  • Legitimate interests: fraud prevention, IT security, support, improving the Service, and enforcing our terms, balanced against your rights.
  • Consent: optional analytics cookies, marketing, and SMS notifications where required. You can withdraw consent at any time.

5. Cookies and similar technologies

We use cookies, local storage, and similar technologies. Strictly necessary storage is needed for login, security, and checkout. Optional analytics (for example Vercel Analytics and PostHog) load only if you choose “Accept all” on our cookie banner. You can change your browser settings; blocking some cookies may limit functionality.

6. Sharing and processors

We share personal data with service providers that help us run the Service, under appropriate agreements:

  • Hosting and application delivery (e.g. Vercel)
  • Database and authentication (e.g. Supabase)
  • Payments and partner payouts (Stripe, including Stripe Connect)
  • Maps (Google Maps)
  • Email delivery (our SMTP email provider)
  • Analytics, only with your consent (Vercel Analytics, PostHog)

We may also disclose information if required by law, or to protect rights, safety, and the integrity of the Service. Partner contact details needed to complete a booking (for example a host’s name or phone after checkout) may be shared with the other party to that booking.

7. International transfers

Some providers may process data outside the EU/EEA (for example payment processing in the United States). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. Retention

We keep personal data only as long as needed for the purposes above. Account data is kept while your account is active. Booking, payment, and payout records (including IBAN where we stored it) are kept as required for accounting, tax, refunds, and disputes, then deleted or anonymised.

9. Your rights (EEA/UK)

You may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is consent-based. To exercise these rights, email developerixtarent@gmail.com. You may lodge a complaint with a supervisory authority (in Sweden, IMY — Integritetsskyddsmyndigheten).

10. Children

The Service is intended for adults (18+). Do not register or book if you are under 18.

11. Changes

We may update this Policy and will post the new version here with an updated “Last updated” date. Material changes may require additional notice where required by law.

Related: Terms of Service.