Last updated 2 September 2026
This software photographs people's driving licenses. We have written this policy on the assumption that you will actually read it, because the person whose license it is deserves that much.
1. Two different roles, and why it matters
EZRentalYard handles two kinds of personal information, and we are not in the same position for both.
| Information | Whose decision it is | Our role |
|---|---|---|
| Rental-yard account data — the owner and staff who sign in, billing contact, support correspondence | Ours | Controller. We decide what to collect and why, and this policy governs it. |
| Renter data — the customers your yard rents to: name, contact details, license, tow vehicle, signatures, inspection photos | The rental yard's | Processor. We hold and process it on that yard's written instructions. The yard's own privacy notice governs it. |
If you rented a trailer and want to know what is held about you, contact the yard you rented from, not us. They control that record; we cannot alter or release it without their instruction. If you cannot reach them, write to us and we will pass your request on and tell you we have.
2. What we collect about a rental yard
- Account: business name, the name, email, phone and username of each person you give a login, and a password we store only as a salted hash.
- Billing: your business billing address and a record of what we invoiced and when. We never see or store your full card number — that stays with our payment processor.
- Support: what you send us, so we can answer it and find it again later.
- Technical: IP address, browser user-agent, and timestamped records of actions taken in the software. These exist for security and for the audit trail, and they are the reason we can tell you who changed a record and when.
We use it to run your account, take payment, provide support, keep the service secure, and email you about the service. We will only email you marketing if you asked for it, and every such email carries an unsubscribe link.
3. Driver's license images — the part that matters most
A photograph of a driving license carries the license number, the date of birth, the home address and the face in one file. It is close to everything a person needs to open credit in somebody else's name. There is no upside to holding a three-year-old one and considerable downside, so the software destroys them on a schedule rather than keeping them.
What is destroyed
- The image file itself, and the document record pointing at it.
- The text read off it — the license number and date of birth extracted by scanning. Deleting the photograph while keeping a transcription of it would be theatre.
What survives, and why
A record that a scan happened: who ran it, when, and whether it succeeded. Those are the questions asked after an incident, and none of them require the license.
Read that precisely, because it is easy to read as more than it is. What the purge destroys is the photograph and the copy of it produced by scanning. It does not empty the customer's own record. If the yard keeps a license number, an address or a date of birth on the customer — and most do, because that is the business record of who rented a trailer — those fields stay, under whatever retention that yard applies to its customer records. The purge removes the image and its transcription, not every trace of the license.
The clock
It does not run from upload. A license captured for a rental that runs three months is still in use. It runs from the later of the upload date and the end of that customer's most recent rental, and a customer with a rental still open is never purged.
How long
The default is 90 days. Each yard can set its own period, up to a ceiling of three years, which is as long as a claim from a hire can realistically take to surface. A yard can also set it to keep images indefinitely — the software makes that a deliberate choice rather than a default.
License images are sent to Amazon Textract to read the fields off them. Amazon has been instructed, by an account-level opt-out policy, not to retain that content or use it to improve or train its services, and not to move it out of the region we operate in.
The face on the license is not processed
Textract reads printed text. It is the same kind of recognition used on a receipt or an invoice, and it is the only thing the image is sent for.
No face recognition of any kind runs on these images. The photograph on the license is not measured, not matched against anything, and not compared with any other picture. No faceprint, face template or other biometric identifier is created, derived or stored — not from the license, not from anywhere else. There is no face-matching step in this software, and there is nothing to switch on.
We say this in its own section because it is the question a person is entitled to ask about a photograph of their face, and because a policy that merely stays silent on it is not an answer. If that ever changes, this paragraph is wrong, and it changes in the same release.
4. What we never do
- We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no exception to this and no "partner" list.
- We do not use your renters' data to market to them, or to market to you.
- We do not build machine-learning models, and we do not train anything on your data or your renters'. Where we send data to a third party that runs its own models, we say so by name in section 5 and describe what that provider is permitted to do with it.
- We do not run face recognition, and we do not create or keep biometric identifiers. No faceprint or face template is derived from a license photograph or from anything else. Reading the printed text off a license is not face recognition and is not done with it — see section 3.
- We run no advertising trackers, no analytics pixels and no third-party scripts on the software. Fonts are served from our own servers, not a CDN.
- We do not send text messages to your renters. Deliberately — every text needs documented consent and a STOP keyword, and the exposure is real.
5. Who else touches the data
A short list, by name, because a policy that says "trusted third parties" is telling you nothing.
| Who | What for | What they see |
|---|---|---|
| Amazon Web Services (United States) | Hosting and storage — the servers the software and its files run on | Everything the software stores. See section 6 for what is and is not encrypted. |
| Amazon Simple Email Service (United States) | Outbound email — password resets, notifications, customer copies of agreements | Recipient address and message content |
| Amazon Textract (United States) | Reading the fields off a license image | The license image, at the moment it is scanned |
| Stripe (United States) | Subscription billing for rental yards | Your billing contact and card details, which go to Stripe directly and never through us |
All four are United States companies and we operate in United States regions. Personal information is not transferred outside the United States.
If we add a sub-processor that handles personal information, we will update this table before it goes live.
We may also disclose information where we are legally required to, or to protect the rights and safety of a person. Where we are permitted to tell you first, we will.
6. How it is protected
- Encrypted in transit with TLS on every connection, and redirected to HTTPS if you arrive over plain HTTP.
- Off-site backups are encrypted, and a backup that cannot be encrypted is not written at all. Backups are restore-tested on a schedule rather than assumed to work.
- Encrypted at rest on the server itself, since 11 August 2026. The volume holding the database, the license images and the signed documents is encrypted at the storage layer with a managed key, and so is every snapshot taken of it. Until that date this section said the opposite, because it was true. What this protects against is someone obtaining the underlying storage or a copy of it; it is not a substitute for the access controls below, which are what stand between your information and someone who is signed in.
- Every yard runs in an isolated workspace. Isolation is enforced in the data layer, not left to whoever wrote the last query, and it is tested by a suite that deliberately attempts to read another yard's data and asserts that it fails.
- Access on our side is least-privilege and logged. Passwords are stored as salted hashes and cannot be read back, by us or by anyone.
- Every action that changes a record writes an audit entry naming the actor and the time.
- We do not log license images, card data, tokens or personal identifiers to our application logs.
No system is perfectly secure and we will not pretend otherwise. If a breach affects your data we will tell you without undue delay, with what we know and what we are doing about it.
If you believe you have found a vulnerability, please write to security@ezrentalyard.com. Tell us what you found and how to reproduce it, and give us a reasonable chance to fix it before publishing. We will not pursue you for reporting something in good faith.
7. How long we keep things
| What | How long |
|---|---|
| License images and extracted license fields | 90 days by default; set by the yard, capped at 3 years |
| Rental records, agreements and inspection history | While the account is active — these are the yard's business records |
| Yard account and billing records | While active, then as long as tax and accounting law requires |
| Security and audit logs | Retained for their evidential purpose, then deleted |
| Everything, after an account closes | Kept for 30 days so we can produce an export on request, then deleted |
| Residual copies in encrypted backups | Deleted with the backup they sit in, within 30 days of deletion from the live system |
8. Your rights
Depending on where you live you may have the right to access the personal information held about you, correct it, delete it, obtain a portable copy, and object to or restrict certain processing. You also have the right not to be discriminated against for exercising any of them.
If you are a rental yard — email us and we will handle it. We will verify that the request is really from you before we act on it, and we will answer within the time your state's law allows.
If you are a renter — go to the yard you rented from. See section 1.
9. Cookies
We set exactly one cookie: the session cookie that keeps you signed in. It is strictly necessary, it is set only once you sign in, and it tracks you nowhere. The token that protects forms against cross-site request forgery is held in that session on our side, not in a cookie of its own.
There are no advertising cookies, no analytics cookies and no third-party scripts on this site or in the software. That is why you are not being asked to accept anything — there is nothing to accept.
10. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child's information has reached us, tell us and we will delete it.
11. Changes to this policy
If we change this policy materially we will email rental-yard account holders before it takes effect. The "last updated" date at the top always tells you which version you are reading.
Terms of Service · Privacy Policy · Billing & Refunds · Data Processing Agreement
How to reach us
EZRentalYard LLC1022 Samsonite Boulevard, Suite B
Murfreesboro, TN 37129, United States
privacy@ezrentalyard.com
+1 (629) 243-6236
We answer email from a real person, usually the same business day. If your question is about a charge, please write to us before raising it with your bank — see Billing, Cancellation & Refunds.