Privacy Policy

Last updated: November 2026

Lendilo.app is a service for keeping track of equipment that is lent out. It is operated by SimplyPulse AB. This policy explains what personal data is processed, why, how long it is kept and what rights you have.

In short: we only collect what the service needs, everything is stored in the EU, we never sell personal data and we don’t use it for marketing.

1. Who is responsible

SimplyPulse AB
Registration number: 559513-3561
Göteborgsvägen 46, 431 37 Mölndal, Sweden
Email: hello@lendilo.app

• We are the controller for accounts of admins, for visitors to our website and for our contact with customers.
• The organization you borrow from is the controller for your data as a borrower. It decides what is registered and how long it is kept, and we process the data on its behalf under our Data Processing Agreement.

2. If you are an admin

• Your account – name, email address and language. We use the address to send login codes, invitations and the notifications you have chosen.
• The organization – name, country, time zone, logo, contact email and phone number.
• Logged-in devices – a short description such as “Firefox on Windows”, and when the device logged in and was last active. You can see these and log them out under My account.
• A log of important events – such as logins, invitations, exports and deletions, with who did it and a short device description. It contains no borrower data.
• What you enter – equipment, photos, categories and notes. Location data is removed from photos when they are uploaded.
• Non-profit applications – what you write in the application.

There are no passwords. Login codes are stored only as one-way hashes and stop working after 10 minutes.

3. If you borrow something

You don’t need an account. The organization registers, or you enter yourself through its catalog or a QR code:

• Your name, and if given, your email address and phone number.
• What you have borrowed or booked, with dates, and any messages and notes connected to it.

With an email address you get receipts, reminders and a personal link to “My loans”. The emails come from Lendilo on the organization’s behalf, and replies go to the organization. The link works for 30 days, and only a one-way hash of it is stored. Only the organization’s admins see your data; the public catalog never shows who has borrowed what.

If you have questions about your data as a borrower, or want it changed or removed, contact the organization you borrowed from. If you contact us, we will pass your request on to them.

4. Payments

Payment is handled by Paddle.com Market Ltd (“Paddle”), which is the seller and merchant of record. Paddle collects your payment details and is an independent controller of them, and it may transfer payment data outside the EU. See Paddle’s privacy policy. We never see your card details. We only store Paddle’s customer and subscription references, your plan and the dates of the paid period.

5. Cookies

Lendilo.app only uses cookies that the service needs in order to work, which is why we don’t ask for consent. There are no analytics, advertising or tracking cookies.

When you pay, Paddle’s checkout opens on our subscription page. Paddle may set its own cookies for the payment.

6. Technical information and statistics

To protect the service against abuse we limit how many attempts can be made from the same IP address. We don’t store the IP address for this – only a one-way hash whose key changes every day. It can’t be traced back to an address or linked across days, and it is deleted after two days.

As with any web service, our hosting provider keeps technical logs that may include IP addresses. They are used to run and secure the service. Our own error logs are deleted after 30 days.

On our public website – the start page, features, pricing, support and these policies – we use Umami Analytics to count visits. Umami sets no cookies, stores nothing in your browser, does not keep IP addresses in its statistics and does not follow visitors across other websites. It is not used in the app, the catalogs, the QR pages or on borrowers’ pages.

7. Why we process the data

• To provide the service to the organization and its admins. Legal basis: contract (Article 6(1)(b) GDPR).
• To protect the service – limit abuse, keep it secure and log important events. Legal basis: legitimate interest (Article 6(1)(f)).
• To improve the service – anonymous visitor statistics. Legal basis: legitimate interest (Article 6(1)(f)).
• To fulfil legal obligations, such as bookkeeping. Legal basis: legal obligation (Article 6(1)(c)).

For borrowers, the organization decides the purposes and has its own legal basis, usually legitimate interest in keeping track of what it has lent out. Service emails about your account or loans are not marketing.

8. How long we keep the data

• Accounts – until you delete your account under My account, which takes effect at once.
• Organizations – until the owner deletes the organization. It can be restored for 30 days and is then deleted for good, with its equipment, borrowers, loans, images and event log.
• Borrowers – removed when the organization chooses, and automatically after a period of inactivity that it sets (24 months unless changed). The loan history is kept without the name.
• Sessions and login codes – deleted once they have expired.
• Unconfirmed bookings and records of sent emails – deleted after 90 and 30 days.

Deleted data is removed from the database at the time stated. Our hosting provider’s backups may still contain it for a short while, until they are overwritten. We keep information about payments for as long as bookkeeping rules require.

9. Who has access to the data

We never sell personal data. The data is stored with our hosting provider in Sweden, which also delivers our emails. It processes the data on our behalf under a data processing agreement, and it is named in the Data Processing Agreement. We may have to disclose data to public authorities where the law requires it.

10. Where the data is stored

Accounts, equipment, borrowers and loans are stored on servers in Sweden, within the EU, and are not transferred outside the EU/EEA.

The visitor statistics (section 6) are processed by Umami Software, Inc., a US company, under a data processing agreement. Its service may process this data in the United States as well as in the EU. The statistics contain no names, email addresses or data about loans. Paddle’s processing is described in section 4.

11. Security

All traffic is encrypted with TLS (https). There are no passwords that could leak, and login codes and secret links are only stored as one-way hashes. Each organization’s data is kept separate, forms are protected against forged requests, and the number of attempts is limited.

12. Your rights

Under the GDPR you have the right to:

• access the data held about you,
• have inaccurate data corrected,
• have data erased,
• receive your data in a machine-readable format,
• object to processing based on legitimate interest,
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.

Admins can do much of this themselves under My account and Settings → Data. Borrowers should contact the organization they borrowed from (see section 3). For anything else, email hello@lendilo.app. We reply as soon as we can, and within one month at the latest.

13. Children

Admin accounts are for adults. Borrowers may be children, for example in a sports club or at a school. In that case the organization is responsible for having a legal basis and for informing them and, where needed, their guardians, and should keep to what the loan requires.

14. Changes to this policy

We may update this policy. The date of the latest change is always shown at the top. For significant changes we will give notice here on the website, and tell admins by email.