Privacy Policy

Depending on how you interact with COVABL, we may collect the following categories of personal information:

A. Account and Contact Information

• Name;
• Email address;
• Telephone number;
• Account login and authentication information;
• Delivery, pickup, billing, or mailing address;
• Service-area or ZIP-code information.

B. Profile, Sizing, and Preference Information

• Clothing size and sizing preferences;
• Style preferences;
• Typical occasions or rental needs;
• Wishlist, heart, favorite, or saved-product activity;
• Designer, product, category, or merchandising interests;
• Other information you voluntarily add to your profile or provide to COVABL.

C. Transaction and Rental Information

• Keyholder purchase and COVABL credit information;
• Rental orders, rental dates, and order history;
• Items rented or saved;
• Prices, discounts, credits, refunds, cancellations, and payment status;
• Delivery and pickup details;
• Late-return, damage, loss, repair, or other rental-issue records;
• Customer-support communications and account notes.

D. Payment Information

COVABL currently expects to use Stripe to process online payments. Payment processors may collect payment-card numbers, billing information, transaction identifiers, and related fraud-prevention information. COVABL does not intend to store full payment-card numbers in its own application database, although COVABL may receive and retain payment tokens, card type, last four digits, billing status, transaction identifiers, chargeback information, or similar payment metadata necessary to administer transactions.

E. Identity, Security, and Fraud-Prevention Information

For certain transactions, including higher-value rentals or transactions that present an increased risk of fraud or unauthorized activity, COVABL may require additional verification before approving or fulfilling a rental.

This verification may include confirming your identity, account ownership, payment information, delivery details, or other information reasonably necessary to protect COVABL, its customers, and its inventory. Depending on the circumstances, COVABL may use a third-party identity-verification provider to verify information such as a government-issued identification document and, for select transactions, a photograph or selfie used to confirm that the person completing the transaction matches the identification provided.

COVABL may also receive fraud-prevention and transaction-risk information from payment processors, identity-verification providers, delivery partners, and other service providers, such as payment verification results, device or account signals, transaction risk indicators, and verification status.

COVABL does not intend to independently store copies of government-issued identification documents when verification is performed through a third-party provider, except to the extent information is provided to or retained by COVABL as necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcement of our agreements.

Additional verification may be required based on factors such as the value of the items being rented, account or rental history, transaction characteristics, delivery information, or other security and fraud-risk considerations.

F. Device, Usage, and Technical Information

When you use the Site, COVABL and its service providers may automatically receive information such as IP address, browser type, device type, operating system, approximate location derived from IP address, pages viewed, interactions, referring URLs, timestamps, session information, and other technical or usage information.

G. Communications

We may collect information you provide when you email, call, text, submit a form, communicate with customer support, respond to a survey, or otherwise contact COVABL.

We may collect personal information:

• Directly from you when you create an account, complete a profile, make a purchase or rental, save a product, contact us, or provide information to a courier or support team;
• Automatically from your browser or device through cookies, logs, and similar technologies;
• From service providers that help us process payments, operate the Site, authenticate accounts, deliver email, complete courier deliveries and pickups, prevent fraud, or provide other business services;
• From social platforms if you interact with COVABL’s public social pages or links, subject to the platform’s settings and privacy practices.

COVABL may use personal information to:

• Create, authenticate, maintain, and secure customer accounts;
• Determine service-area eligibility;
• Process Keyholder purchases, issue and track COVABL credit, and administer promotions;
• Process and fulfill rentals, including courier delivery and pickup;
• Manage availability, order history, returns, extensions, refunds, cancellations, damage, loss, and other rental matters;
• Personalize the customer experience and understand sizing, style, occasion, and inventory preferences;
• Use wishlist/heart data and other demand signals to inform merchandising and inventory decisions;
• Process payments and prevent fraud, abuse, unauthorized transactions, and account misuse;
• Provide customer support and respond to questions, disputes, and requests;
• Send transactional communications regarding accounts, payments, orders, delivery, pickup, security, and service updates;
• Send marketing communications where permitted and subject to your choices;
• Operate, maintain, troubleshoot, secure, and improve the Site and Services;
• Conduct analytics and measure business performance;
• Comply with legal, tax, accounting, recordkeeping, and regulatory requirements;
• Protect COVABL, our customers, service providers, property, and legal rights.

We may disclose personal information to service providers and other recipients as reasonably necessary to operate COVABL. These may include:

• Supabase: Backend database, authentication, application infrastructure, and storage of customer/application information.
• Stripe: Payment processing, payment-related fraud prevention, refunds, disputes, and transaction administration.
• Lovable: Website/application development and platform infrastructure.
• Brevo: Email marketing and/or automated customer email communications.
• Google Workspace: Business email and related business communications.
• Courier provider(s): Delivery and return pickup. COVABL may provide the customer name, address, telephone/contact information, order/pickup details, access instructions, and other information reasonably necessary to complete delivery or pickup.
• Professional advisers: Lawyers, accountants, insurers, auditors, and other professional advisers where reasonably necessary.
• Authorities / legal recipients: Government authorities, law enforcement, courts, payment networks, or other parties when required by law or reasonably necessary to protect rights, investigate fraud, enforce agreements, or respond to legal process.
• Business transaction parties: Potential or actual buyers, investors, financing sources, acquirers, successors, or advisers in connection with a financing, merger, acquisition, restructuring, or sale, subject to appropriate safeguards and applicable law.

COVABL does not sell personal information for monetary consideration.

COVABL may use third-party advertising, analytics, attribution, and measurement technologies, including services provided by platforms such as Meta, TikTok, and Google. These technologies may be used to understand how visitors interact with the COVABL Site, measure the effectiveness of advertising campaigns, attribute visits, sign-ups, or purchases to particular marketing efforts, create or measure advertising audiences, and deliver or improve advertising.

Depending on how these technologies are configured and used, COVABL may disclose information about your interactions with the Site to advertising or analytics providers. This information may include device and browser information, IP address, online identifiers, referral information, pages or products viewed, products saved, and actions taken on the Site.

Certain disclosures made through advertising technologies may constitute “sharing” of personal information for cross-context behavioral advertising under applicable privacy laws, even where COVABL does not receive money in exchange for the information. California law, for example, treats certain disclosures for cross-context behavioral advertising as “sharing.”

COVABL may also disclose personal information to service providers, contractors, and other vendors that assist us in operating our business, including providers that support website hosting and infrastructure, payment processing, customer communications, analytics, fraud prevention and identity verification, customer support, and delivery and pickup services. These disclosures are made for legitimate business and operational purposes and are not made for the purpose of selling personal information.

Where required by applicable law, COVABL will provide consumers with the ability to opt out of the sale or sharing of personal information and will honor applicable legally recognized opt-out preference signals, including Global Privacy Control, as required by law.

COVABL does not knowingly sell or share the personal information of individuals under 16 years of age without the affirmative authorization required by applicable law.

COVABL uses, and may in the future use, cookies, local storage, pixels, tags, scripts, and similar technologies to operate the Site, maintain account sessions, remember preferences, support payment processing and fraud prevention, understand Site usage, measure communications and advertising performance, and improve our services.

These technologies may include:

• Strictly necessary and functional technologies used to operate the COVABL Site, authenticate users, maintain account sessions, remember preferences, and provide core Site functionality, including technologies associated with COVABL’s website infrastructure and Supabase;
• Payment, security, and fraud-prevention technologies associated with Stripe and other service providers used to process transactions, authenticate payments, assess transaction risk, and help prevent unauthorized or fraudulent activity;
• Platform and infrastructure technologies used by COVABL’s website and hosting providers, including Lovable and related service providers, as necessary to operate, secure, and maintain the Site;
• Email and communications technologies, including technologies used by Brevo and similar providers to deliver communications and, where enabled, measure email opens, clicks, and engagement;
• Analytics and measurement technologies, which may include Google Analytics or similar services, used to understand how visitors use the Site, evaluate Site performance, measure traffic and engagement, and improve COVABL’s services; and
• Advertising, attribution, and marketing technologies, which may include Meta Pixel, TikTok Pixel, Google advertising technologies, and similar tools used to measure advertising effectiveness, attribute visits or purchases to marketing campaigns, create or measure advertising audiences, and, where applicable, support targeted or cross-context behavioral advertising.

Information collected through these technologies may include IP address, browser and device information, online identifiers, referral information, pages or products viewed, products saved, interactions with the Site, and actions such as account creation, purchases, or other conversions.

Some cookies and similar technologies are necessary for the Site to function and may not be capable of being disabled through COVABL’s privacy controls. Other analytics, advertising, or measurement technologies may be subject to consent, opt-out, or preference-management requirements depending on applicable law and how those technologies are configured.

Where required by applicable law, COVABL will provide appropriate cookie, consent, or privacy-choice mechanisms and will honor applicable legally recognized opt-out preference signals.

COVABL may update the technologies described in this section as its Site, service providers, analytics tools, and advertising practices evolve. Material changes to our use of personal information will be reflected in this Privacy Policy as appropriate.

Some browsers transmit “Do Not Track” signals. Because there is no universally accepted standard for responding to Do Not Track signals, the Site may not respond to them unless required by applicable law.

Where applicable law requires COVABL to recognize a legally valid browser-based opt-out preference signal, such as Global Privacy Control, COVABL will honor the signal as required for the applicable data practices.

COVABL may send transactional emails or text messages reasonably necessary to administer your account, Keyholder participation, rentals, payments, delivery, pickup, returns, security, or customer support. These communications are not treated as optional marketing communications where the law permits them to be sent for service administration.

COVABL may send promotional email or SMS communications where permitted by law and subject to applicable consent requirements. You can unsubscribe from marketing emails using the unsubscribe link in the message. SMS marketing, if used, will be subject to separate disclosures and consent where required.

COVABL retains personal information for only as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to maintain customer accounts, process and fulfill transactions, administer COVABL credits, provide customer support, prevent and investigate fraud or misuse, resolve disputes, enforce our agreements, and comply with legal, tax, accounting, insurance, and recordkeeping obligations.

Retention periods may vary depending on the type of information and the purposes for which it is used. In determining appropriate retention periods, COVABL may consider factors including whether an account remains active, the date of the customer’s last transaction, any outstanding credits, payments, claims, disputes, or other obligations, applicable statutes of limitation, legal or regulatory requirements, fraud and security needs, and whether the information may be necessary to establish, exercise, or defend legal claims.

Certain information may be retained after an account is closed or a deletion request is made where retention is reasonably necessary or permitted by law, including transaction and payment records, records of agreements and customer consent, COVABL credit records, fraud and security records, customer support communications, and information associated with disputes, claims, chargebacks, losses, or other legal or financial obligations.

When personal information is no longer reasonably necessary for the purposes for which it was retained, COVABL will delete, anonymize, or otherwise dispose of it in accordance with applicable law and its then-current data retention practices.

COVABL may establish and update more specific internal retention periods for particular categories of information as its operations, legal requirements, and business needs evolve.

COVABL uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, loss, misuse, alteration, or disclosure.

These safeguards may include authenticated account access, role-based administrative permissions, access controls that limit personal information to authorized users, secure third-party payment processing, fraud-prevention measures, system monitoring and logging, and security protections provided by COVABL’s hosting, database, payment, and other infrastructure providers.

COVABL also seeks to limit access to personal information to employees, contractors, and service providers who reasonably need access to perform services or support COVABL’s operations and who are subject to appropriate confidentiality or data-protection obligations.

COVABL may update and enhance its security practices as its systems, services, and operations evolve.

Despite these safeguards, no method of transmission over the Internet, electronic storage, or information-security system is completely secure. Accordingly, COVABL cannot guarantee the absolute security of personal information.

Depending on your relationship with COVABL and applicable law, you may have the right or ability to:

• Update certain account, profile, sizing, delivery, and preference information;
• Unsubscribe from promotional email communications using the unsubscribe link provided in those communications;
• Withdraw consent to marketing text messages by following the instructions provided in the applicable message;
• Request access to, correction of, or deletion of certain personal information;
• Request closure or deletion of your COVABL account;
• Opt out of certain uses or disclosures of personal information where required by applicable law; and
• Exercise other privacy rights available to you under applicable law.

Account Closure and Deletion

COVABL may provide a self-service option within your account settings to request closure or deletion of your account. You may also submit a privacy or account-deletion request by contacting hello@covabl.com.

For security purposes, COVABL may take reasonable steps to verify your identity before processing a request to access, correct, close, or delete an account or personal information.

Submitting an account-deletion request does not necessarily result in the immediate deletion of all information associated with your account. COVABL may retain information where reasonably necessary or permitted by applicable law, including to:

• Complete or document transactions;
• Administer COVABL credits or other outstanding account balances;
• Complete an active rental, delivery, pickup, return, refund, or other customer obligation;
• Process outstanding payments, charges, refunds, disputes, or chargebacks;
• Prevent, investigate, or respond to fraud, theft, misuse, or security incidents;
• Maintain records of agreements, consents, transactions, and customer communications;
• Comply with tax, accounting, insurance, regulatory, or other legal obligations; or
• Establish, exercise, or defend legal claims.

If an account has an active rental, unreturned item, outstanding payment or dispute, or another unresolved obligation, COVABL may restrict or close account access while retaining information necessary to resolve that matter before completing the deletion process.

When COVABL grants a deletion request, personal information that is not subject to an applicable retention exception will be deleted, deidentified, or otherwise handled in accordance with applicable law and COVABL’s retention practices.

Requests may be submitted through any privacy-request mechanism made available through the COVABL Site or by emailing hello@covabl.com.

COVABL is based in California and provides this Privacy Policy in accordance with applicable California privacy laws, including the California Online Privacy Protection Act (“CalOPPA”), as applicable.

California residents may have additional rights regarding their personal information depending on the laws applicable to COVABL and the circumstances of the request. COVABL will provide and honor privacy rights required by applicable California law.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), provides certain California residents with rights relating to the collection, use, disclosure, sale, and sharing of personal information when the CCPA applies to a business. These rights may include the right to know or access certain personal information, request correction or deletion, opt out of the sale or sharing of personal information, limit certain uses of sensitive personal information where applicable, and receive equal service and pricing when exercising applicable privacy rights.

To the extent COVABL is subject to the CCPA, COVABL will provide California residents with the notices, rights, request methods, privacy choices, and opt-out mechanisms required by applicable law, including any required mechanism to opt out of the sale or sharing of personal information.

COVABL does not discriminate against individuals for exercising privacy rights available to them under applicable law.

California residents may submit privacy-related requests using the methods described in the Your Choices and Requests section of this Privacy Policy.

As COVABL’s business, data practices, and legal obligations evolve, COVABL may update this Privacy Policy and its privacy-rights processes to reflect applicable California law.

COVABL has chosen, as a matter of business policy, to limit rental accounts and rental transactions to individuals who are 18 years of age or older. This age requirement reflects the nature and value of the items offered through COVABL and is not intended to suggest that applicable law generally prohibits individuals under 18 from renting goods.

Individuals under 18 may not create a COVABL rental account, enter into a rental transaction, or otherwise represent that they are eligible to rent through COVABL.

The COVABL Site and services are not directed to children under 13, and COVABL does not knowingly collect personal information online from children under 13. If COVABL learns that it has collected personal information from a child under 13 in circumstances requiring parental consent under applicable law, COVABL will take appropriate steps to delete or otherwise address that information.

COVABL may take reasonable steps to confirm that a customer satisfies applicable age requirements, particularly in connection with account creation, higher-value rentals, identity verification, or other transactions presenting increased security or fraud risk.

The Site may link to third-party websites or social platforms, including COVABL’s social profiles. COVABL does not control the privacy practices of those third parties. Your interactions with third-party services are governed by their own privacy policies and settings.

COVABL does not currently plan to offer Rental Services outside the United States. If you access the Site from outside the United States, your information may be processed in the United States or other locations where COVABL’s service providers operate, subject to applicable law.

COVABL may update this Privacy Policy from time to time. The “Last Updated” date will identify the current version. If changes are material, COVABL will provide additional notice where required by applicable law.

Questions or requests regarding this Privacy Policy or COVABL’s privacy practices may be directed to:

COVABL

hello@covabl.com