Privacy policy

Last updated September 24, 2026.

ROC Tote & Go is a small local business run by two people. We collect only what we need to rent you totes, we don't sell it, and this page says exactly what happens to it.

What we collect

Booking details: your name, phone, email, delivery and pickup addresses, dates, package, add-ons, notes, and an on-site contact phone if you give us one.
Addresses: when you pick an address from the suggestions in the booking form, that text is sent to Google's address service to confirm the address and work out the driving distance from our base. Google's own privacy policy covers that lookup. Confirmed addresses and distances are cached on our server so we don't look them up twice.
Payment: card payments are handled by Stripe. We never see or store your full card number. Stripe gives us a payment record, the last four digits, and a code that identifies the card without revealing it, which we keep to spot fraud, such as someone referring themselves. Every payment goes through 3D Secure: Stripe shares the payment details with your card issuer so it can confirm it's you, and we keep only the result (authenticated or not) and Stripe's risk rating.
Identity verification: on larger orders we ask Stripe Identity to check a government ID and a selfie. Stripe collects the images and reads the document; we never see or store the photos. We keep only that the check passed, the kind of document (driver's license, passport) and the issuing country, and the ID number of Stripe's session. If the name on the ID differs from the booking, a person on our team looks at Stripe's result before confirming.
Your account: you sign in with a link we email you, not a password. If you tap a tote tag or ask to stay signed in, your phone keeps a sign-in cookie for the length of your rental plus a week, up to 60 days.
Your packing list: if you use the tags on the totes, the room, contents, fragile and unpack-first marks, and any photo you take of an open tote. This is yours: staff can see the room list to help at delivery, but never your photos.
Photos we take: we may photograph the stacked totes and the outside of the delivery spot at delivery and pickup, and any damaged tote, to record condition. Not the inside of your home.
Messages: what you send through the contact form or by email, and our replies.
Trusted status: whether we've marked you a returning customer who skips the identity check, who set it and why.
Codes and referrals: which coupon or referral code you used, and, if you refer a friend, that your friend booked and when their totes were delivered. Your friend sees your first name on their discount line. You see your friend's first name in the email that tells you your credit is ready.
Gift cards: if we offer them, the buyer's name and email, the recipient's name and email, the message, and every use of the card. Card numbers are stored scrambled.
Basic site data: standard server logs (IP address, browser, pages visited), a session cookie that makes the forms work, and a security token on forms. We use Plausible Analytics to count visits: it sets no cookies, keeps no personal data, and does not follow you across other sites. We don't run advertising trackers.

How we use it

To confirm, deliver, and pick up your rental, and to contact you about it by email, or by phone on delivery and pickup days.
To charge your saved card for extra weeks you ask for and for fees under the rental agreement, after we've told you.
To answer your questions.
To run discounts, referrals and gift cards honestly, including checking that a referral isn't someone referring themselves.
To keep records we're required to keep for tax and accounting.
To see which pages and offers work, in the aggregate, so we can run a small business well.

We don't send marketing email or texts. Every message we send is about your rental, your credit, or a question you asked.

Who we share it with

Only the services that help us run the business, and only what they need: Stripe for payments, sales tax, 3D Secure and identity verification (Stripe's own privacy policy covers what it does with a document and selfie), Google for address lookups, Plausible for visit counts, and our web host. A partner whose code you used (a realtor, say) is told the date and town of the booking, never your name or address. If the law requires it, we'll share what it requires. We don't sell or rent your information to anyone.

Your phone number

All our messages to you come by email. We ask for a phone number only so we can call if we can't find you on delivery or pickup day. If you give us an on-site contact's number, we call it for the same reason. Your number is never shared or used for marketing.

How long we keep it

Booking and payment records: as long as tax and accounting rules require.
Street addresses on cancelled bookings: removed after a period, keeping only the town and zip.
Delivery and pickup photos: reduced to small thumbnails after 12 months. Photos that support a damage fee or a card dispute are kept for 3 years.
Your packing list: kept in your account as your own record after the rental. The contents you wrote against each tote are detached from the totes at pickup, and the photos you took of your totes are deleted 90 days after the rental ends.
Identity checks: we ask Stripe to delete the document and selfie from its systems 90 days after your booking closes, unless a card dispute is open. Our own record of the result stays with the booking.
Sign-in links: expire after use or within a day. Share links for a packing list: 30 days.
Contact messages: deleted once they're no longer needed.

Your choices

Ask us any time to see, correct, or delete your information and we'll do it, unless we're legally required to keep it. That includes asking Stripe to delete an identity check early once your rental is closed and nothing is in dispute. You can delete your own packing list photos from any tote page, and stop any share link from your account. Email support@roctoteandgo.com or call or text (585) 204-2749.

Children

Our service is for adults. We don't knowingly collect information from anyone under 18. A parent can book for a student and put the student's phone as the on-site contact.

Changes

If this policy changes, we'll post the new version here with a new date.