Privacy Policy

Carter is a place to rent items between people — so we do hold sensitive data: identity, bank accounts, meetup addresses, and money. This page explains what we collect, what for, and what we will never do. Last updated: 11 October 2026.

This is a translation of the Indonesian original. In the event of any discrepancy, the Indonesian version shall prevail.

1. Data we collect

Account data

  • Name, email, and phone number when you register — used to sign in, verify, and communicate about transactions.
  • City, address, and profile photo you fill in yourself on the Profile page.

Shop data (owners)

  • Shop name, bio, logo, and cover photo shown on your shop page.
  • Payout bank account: bank name, account number, and account holder name — visible only to you and admins for payout processing.

Rental item data

  • Item photos, title, description and specifications, condition notes, and the price and deposit.
  • The city where the item is located and the meetup area. The map coordinate pin is optional — it only exists if you set it yourself.

Transaction & escrow data

  • Rental dates, handover method (meetup or courier) plus the shipping address if you use a courier.
  • The 3-digit unique payment code, the transfer receipt you upload, initial/final condition photos of the item, and evidence if a dispute occurs.
  • Fund movement records (ledger): rates, deposits, fines, commissions, and payouts.

Identity verification

  • The ID card (KTP) photo you upload for owner verification. Stored in private storage — readable only by you and admins.

Communication

  • Chat contents on bookings, pre-booking questions to owners, reviews with their replies, and reports you submit.

Technical data

  • Item page visit counts: IP addresses are hashed before being used to compute view statistics — raw IPs are never stored.
  • Audit logs of admin actions and rate limiting for platform security.

2. Basis & purposes of processing

  • Performing the rental contract: from booking, escrow, documented handovers, to the deposit return.
  • Keeping funds safe: matching payment receipts with the unique code, and verifying payouts to the account of the owner.
  • Preventing fraud and enforcing the rules: identity verification, review moderation, and handling reports and disputes — every admin decision is recorded in audit logs.
  • Transactional communication: booking status emails, due-date reminders, and weekly summaries for owners. All of it can be adjusted or turned off in the email preferences on your Profile.

3. What we never do

  • We do not sell your personal data to anyone.
  • There are no third-party ads on the platform.
  • There are no ad tracking scripts — the only script on this site is the light/dark theme switcher.
  • Sensitive data never appears on public profiles. A public profile only shows name, city, photo, rating, verification status, and shop info — phone, address, and bank account are never displayed.

4. Retention

  • Transaction data (bookings, payments, ledger, condition photos) is kept as records — the anchor if a dispute occurs and the basis for financial reconciliation.
  • Completed bookings are retained so transaction history and wallet balances stay consistent.
  • Verification evidence (ID card) is deleted from the system if verification is cancelled or reset.
  • Items you delete no longer appear in the catalog.

5. Your rights

  • Access & correction: edit your name, phone, address, bank account, and shop appearance at any time on the Profile page.
  • Communication preferences: turn off booking emails or weekly summaries through the email preferences.
  • Account deletion: request it through the Contact page. We delete your personal data, except completed transaction records — kept for the validity of financial records and dispute settlement.
  • Questions about your data: raise them through the Contact page and we will help you sort it out.

6. Security

  • Row Level Security (RLS) is active on every database table: each row of data is readable only by its owner — enforced at the database level, not just in the application.
  • Sensitive files (ID cards, payment receipts, dispute evidence) are stored in private buckets. Transaction participants read them through time-limited signed links, not public links.
  • Rental funds and deposits are held by the platform (escrow) with a 3-digit unique code per transaction.
  • Rate limits and guards: booking limits per minute, upload size limits (5 MB public, 8 MB private), and limits on payment code attempts.
  • IP addresses are never stored raw — they are hashed before being used for view statistics.
  • Every admin decision (moderation, verification, payout) is recorded in audit logs.

Documents & photos you upload

  • ID card / KTP (identity verification): stored in a private bucket — only you and the Carter verification team can open it, via short-lived access links, not public links. The document is deleted when your account is deleted.
  • Payment proofs (transfer receipts): stored privately — only you and the Carter team can open them, for payment matching.
  • Handover photos (initial/final condition of the item): accessible only to the two parties of the transaction and the Carter team — for example when assessing a dispute.
  • Dispute evidence: stored privately and accessible only to the Carter team for dispute resolution.
  • Listing photos (item photos): public by design — shown in the catalog to every visitor.
  • In general, all files are stored on Supabase storage infrastructure with per-row access policies (Row Level Security). Please do not upload information that is not requested — e.g. a family member's ID card or other documents unrelated to your transaction.

7. Contact

For matters about your personal data — access, correction, or account deletion requests — reach us through the Contact & Help page. Response within 24 hours.

8. Policy changes

We may update this policy as the platform grows. The update date is always shown at the top of this page.

For material changes (e.g. new data being collected), we announce them through in-app notifications. By continuing to use Carter after a change takes effect, you are considered to accept the latest version.

The house rules of the platform are covered in the Terms & Conditions.

Carter categories