Privacy Notice

This Privacy Notice applies to ECO MOVING BINS, operated by Damion D’Ornellas, sole proprietor, 3059 Orion Boulevard, Orillia, ON L3V 8J5, Canada.

Privacy contact: ecomovingbins@gmail.com · 705-400-2467

When you request a booking, we collect the information needed to provide the rental service:

We use customer information for:

Lovable / Lovable Cloud provides the website platform, hosting and application database. The application stores customer contact and delivery details, booking and price records, agreement acceptance and snapshots, payment references/status, email-send timestamps, inventory audit records and address-distance cache entries there. Staff sign-in is also handled through the configured Cloud authentication service. Geographic storage locations, backups and underlying hosting/storage subprocessors have not been verified in this review.

Square provides hosted checkout and payment processing. The application server calls Square directly, not through Lovable's connector gateway. It sends the booking reference, package description, server-calculated CAD amount, business location identifier, payment note and return-page address. Customers enter payment information on Square's checkout. The application retrieves payment/order identifiers, status, amount, currency and location to independently verify payment, and stores payment and webhook-event references in its database. The current server configuration defaults to sandbox testing; customer reservations are disabled and live customer payments are not enabled.

Resend provides transactional email delivery through Lovable's connector gateway. Emails are sent from bookings@ecomovingbins.com, with replies directed to ecomovingbins@gmail.com. Resend receives the recipient email address, first name, booking reference, package, delivery/return dates, delivery address including unit, total paid, agreement version reference and a booking-specific duplicate-send key. The current template includes legal-page links, not an attachment or the historical agreement text. The application records an email-send timestamp after provider acceptance; this does not establish inbox delivery for every message. The owner confirmed receipt of a standalone test email; the paid-booking email flow remains untested end to end.

Resend's verified sending-domain configuration reports region us-east-1, sending enabled, receiving disabled, and open/click tracking disabled. This identifies the configured sending region, not all locations where Resend or its subprocessors store or process information. Sending-domain verification does not create a bookings mailbox; replies use the Gmail contact address above, and correspondence sent there is handled by Google's Gmail service.

Google Maps Routes is connected and its server credentials are configured for address-based driving-distance calculations. The application sends the business origin address and the entered delivery address (with Ontario, Canada appended), driving mode and Canada region through Lovable's connector gateway to Google. It requests road distance, not customer name, email, telephone or payment information. The application stores the normalized address, distance or not-found result and creation time in its database cache. A fresh successful routing request was not tested in this review; connection and credential presence alone do not verify Google permissions, billing or response accuracy.

We do not sell your personal information.

The configured staff authentication client persists sign-in sessions in browser local storage and refreshes sessions. Lovable preview also supports managed sign-in state. This source review does not establish every cookie or storage item used by the hosted platform or third-party checkout.

The application writes operational errors and payment-event identifiers to server logs. Mapping and email failures may log provider response text; these logs must not be assumed to contain only non-personal information. Hosting log access, contents and retention, and any platform analytics or security tracking, remain to be verified.

Marketing communications will require your separate consent where required by law. Booking-related messages are not marketing.

Owner-selected draft periods, pending Ontario lawyer and accountant review: address-distance caches 30 days from creation; delivery addresses, unit details and access instructions 90 days after actual equipment return or cancellation; booking, payment and accepted-agreement records 7 years after the relevant tax year, then deletion or anonymization where legally permitted.

Financial and tax records will be retained for the periods required by law.

Information should not be retained indefinitely and should be deleted or anonymized when appropriate and legally permitted.

These periods are configured as draft review rules only. Automatic deletion is disabled; no cleanup job, booking redaction or cache-expiry enforcement is activated. Existing records and historical legal snapshots are unchanged. Expiring an unpaid reservation releases equipment; it is not deletion of personal information. Expired or abandoned unpaid holds require a separate approved retention rule.

Disputes, legal holds, outstanding equipment and other legal obligations must prevent premature deletion. Before activation, the business must implement hold tracking, confirm the relevant tax year and any legally required invoice address, and account for personal information copied into notes, payment-event payloads, exports and provider systems. A scheduled pickup date alone is not proof of actual return.

Retention periods for Square records, Resend message content and delivery logs, Google routing requests, Gmail correspondence, Cloud backups and operational logs remain unverified. No provider log period has been selected or changed. Local draft settings do not control provider retention; these settings and lawful deletion procedures must be confirmed separately before launch.

You may contact us at ecomovingbins@gmail.com to request access to your personal information, to ask for a correction, or to ask a privacy question.

Nothing in this notice limits any privacy right that cannot lawfully be limited.

The providers above are identified from the current website implementation. This is not confirmation of their contractual terms, all subprocessors, data residency or retention practices. The final notice requires Ontario legal review and owner confirmation before customer bookings are enabled.