Renttool — Privacy Policy

Effective date: October 12, 2026

Last updated: October 12, 2026

Renttool ("the App"), provided by MerchBytes ("we", "us", or "our"), lets Shopify merchants run a rental desk at Shopify POS: keep a catalog of rental items priced fixed or by the second, minute, hour or day, give items out with rental orders, take deposits, put the rent for the elapsed time and any extra products into the POS cart when the items come back, print receipts with a QR code, and export rental orders ("the Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it and what rights you have when you install or use the App with your Shopify store.

Information the App Collects

We process only the information needed to provide the Service:

  • Store and account information: your store's myshopify domain, your Shopify store ID, the store contact email address that Shopify provides when you open the App, and when and whether the App is installed. The App keeps a copy of that email address in its settings, where it is shown; it is taken when the App is first opened and is not updated later.
  • Authentication information: the Shopify access token and refresh token with their expiry times, and the session tokens used to connect the App to your store and to verify each request from your Shopify admin and Shopify POS.
  • Rental catalog and settings: each rental item's name, price, price type (fixed or per second, minute, hour or day), stock count, product code and colour, and, for an item imported from your products, the ID of that Shopify product variant. A rental item you delete is marked as deleted and kept, so that past orders stay readable. Your settings: whether a receipt is printed when an order is created, the order of items, and the stock tracking mode.
  • Rental orders: for each rental order: an order code made from the time it was started, the rented items with their names, prices, price types and quantities, the start time, the due date, and whether the order is completed; the customer's name, phone number and a note, as typed by your staff; the deposit type (none, note, cash or card), the deposit amount or note, and whether the deposit was returned; the Shopify order ID and order number of the sale in which a card deposit was taken, and the Shopify order ID of the sale in which the rent was taken; and any extra store products added to the order (product variant ID, name and price at the time they were chosen). The customer fields are free text and optional. The App does not link them to Shopify customer records.
  • Cash deposits: when a cashier takes or returns a cash deposit, the App sends our server the ID of the POS device, the ID of the POS staff member signed in with their PIN and your store currency, and our server records the amount in that device's open Shopify cash session. Renttool does not keep these IDs in its own records; like other request details, they may appear in our server request logs.
  • Subscription information: the status of your Renttool subscription, which we read from Shopify billing to check access to the Service. Shopify handles the billing.
  • Order exports: when you export rental orders, a record of the email address you entered, the period and time zone requested, whether the download link was opened, and a random code for a download link that expires after 24 hours. The email address is kept with the export record until your store's data is deleted, and, like other request details, it may appear in our server request logs.
  • Technical and support information: request and error logs kept by our servers; operational alerts our team receives by email, for example when the App is installed or uninstalled or when a request to Shopify fails, which may contain your store domain and the error details; authentication details where needed to diagnose a failed sign-in; and the information you send us when you contact support or make a privacy request.

We receive this information from Shopify and Shopify POS, from what you and your staff enter in the App, and from your messages to us.

What we do not collect. Renttool does not read your Shopify customer records or your orders: after a sale, the App's block on the Shopify POS screen uses only the order ID and order number of that sale. It stores no staff names. It never receives or stores payment card details: payments, refunds and returns are made by Shopify POS. The App adds no scripts, cookies or tracking to your online store and does not use advertising or analytics trackers.

Customer details you enter. The customer name, phone number and note of a rental order are entered by your staff, so you decide whether to record them. Please enter only what you need to run your rentals, and tell your customers that you record these details.

Information kept in your Shopify store. When a cashier completes a rental order or takes a card deposit, the App adds lines to the POS cart: custom sales named after the rented items (for example "Bike x2") or "Deposit (Bike)", and the extra store products of the order. These lines carry two hidden line properties, _renttool_order (the rental order code) and _renttool (the kind of line: rent, item or deposit), which Shopify POS does not show on screens or receipts. A cash deposit is recorded in the POS device's Shopify cash session with the note "<items> (deposit)" (for example "Bike (deposit)"), the amount, the staff member and the time. All of this becomes part of the orders and cash records in your Shopify store. The App does not change your products or customers.

On the POS device. The App keeps a few entries in its storage on the Shopify POS device: the rental orders and kinds of lines in the current sale, so that the Renttool block can record them after payment; and, while a card deposit or the rent of an order waits for checkout, that rental order itself, including the customer name, phone number and note, and its extra products. An entry is deleted once the block has recorded it. Entries older than two hours are not used and are deleted the next time the App saves a new one. The device also remembers whether completed orders are shown. In the App's admin, your browser remembers the same choice in its local storage.

Shopify Permissions

  • read_products: to import one of your product variants into the rental catalog (its title, price, SKU and ID) when you choose it in the product picker.
  • read_cash_tracking and write_cash_tracking: for cash deposits, to find the open cash session of the POS device and record the cash added to it or taken out of it.

To let cashiers pick extra store products for a rental order, the App uses the product search of Shopify POS on the device. The App does not request permission to read orders, customers or staff accounts.

How We Use Information

We use information to:

  • Connect the App to your store and authenticate requests.
  • Show your rental catalog and rental orders in Shopify POS and in your Shopify admin, and keep stock counts in line with your rental orders.
  • Create, update and complete rental orders, record deposits and their return, and record cash deposits in the POS cash session.
  • Put the rent and extra products of a rental order into the POS cart, and link the paid Shopify order to the rental order.
  • Show the number of overdue rental orders on the POS tile.
  • Print rental receipts and provide order exports.
  • Check your Renttool subscription through Shopify billing.
  • Respond to support and privacy requests.
  • Diagnose problems, keep the App secure and improve it.
  • Meet legal obligations and address disputes or misuse.

We do not sell or rent personal information and do not use it for advertising.

If the EU or UK General Data Protection Regulation applies to you, we process your store information to provide the Service you installed (performance of a contract), to keep the App secure and to support you (our legitimate interests), and where the law requires it (legal obligations). For information about your customers and staff that you process with the App, such as the customer details of rental orders, POS staff member IDs and order IDs, we act on your behalf as your service provider (processor), and you decide what is recorded.

Sharing Information

We exchange information with Shopify as needed to provide the Service. Shopify's own handling of your data is described in Shopify's Privacy Policy. Rental orders and exports are available to people who have access to the App for your store.

We use service providers to host and operate the App. Our servers and database run on Amazon Web Services (AWS) in the United States, and export emails and operational alerts are sent through AWS. Google Firebase Hosting serves the files of the App's admin interface (pages, scripts and styles); it stores none of your store's data, but like any web host it receives technical request information, such as IP address and browser type, when the admin loads. Our team receives operational alerts in an email inbox hosted by Google. If you use the App from outside the United States, your information is transferred to and processed in the United States.

An order export is a file with your rental orders, including customer names, phone numbers and notes. Anyone who has its download link can download it until the link expires 24 hours after it is created, so share the link only with people who should see these details.

When you print a rental receipt, its content (the word "Receipt", the rental order code and its QR code, the rented items with their prices, the cash or card deposit amount and the start time) is sent through Shopify POS to a connected printer, or to the printer you pick in the print dialog. The receipt does not contain customer details.

We may disclose information when required by law, to respond to lawful requests or to protect our rights.

Data Retention and Deletion

We keep information while the App is installed on your store and as long as needed to provide the Service. You can ask us to delete your store's data at any time by writing to the address below. In the App, you can delete an open rental order, together with its customer details; a completed rental order cannot be deleted in the App, so ask us if you need it removed.

When you uninstall the App, we mark your store's installation as uninstalled. About 48 hours later Shopify sends us a shop data erasure request (shop/redact). If the App is still uninstalled at that time, we permanently delete all of your store's Renttool data: the rental catalog and settings, rental orders with their customer details and extra products, export records with the email addresses entered, and the installation record with the store contact email and the access and refresh tokens. If you reinstall the App before that request arrives, your data is kept.

Export download links expire 24 hours after they are created, and a generated export file is deleted from our server once it is downloaded.

The customer details of rental orders are free text entered by your staff and are not linked to Shopify customers, so customer data requests from Shopify (customers/data_request and customers/redact), which identify Shopify customers and orders, cannot find them. If one of your customers asks for their details, delete the rental order in the App or contact us and we will help.

Server logs, operational alert emails and backups are not part of this deletion; we keep them only as long as needed to operate and secure the App. Orders, cash records and printed receipts in your Shopify store, including the hidden line properties described above, follow your own and Shopify's retention practices.

Your Rights

Depending on the laws that apply to you, including the GDPR and US state privacy laws, you may have the right to access, correct, update, export or delete personal information we hold about you, to object to or restrict some processing, and to complain to a data protection authority.

To make a request, email us at the address below, name the Shopify store concerned and describe the request. We may need to verify your identity or your authority to act for the store. We respond within the time required by the applicable law.

If you are a customer or staff member of a store that uses Renttool, for example if your name and phone number were recorded with a rental, please contact that store first; we will help the merchant respond.

Security

Requests between Shopify POS, your Shopify admin and our servers use HTTPS, and the App's API for your rental catalog, rental orders and settings accepts only requests verified with a Shopify session token for your store. Receipt links are signed with a short-lived Shopify session token. Export download links use a random code and expire after 24 hours. Access to our systems is limited to people who need it to operate the App.

Changes

We may update this Privacy Policy to reflect changes to the App, our practices, or legal or regulatory requirements. We will publish the updated policy on this page and change the "Last updated" date above.

Contact Us

For questions about our privacy practices, privacy requests or complaints, email contact@merchbytes.com or write to:

MerchBytes
8 The Green, STE A
Dover, DE 19901
USA