Privacy Policy

Last Updated: 22/09/2026

This Privacy Policy describes how we collect, use, process, store, and protect personal data when you use the Coqudo mobile application (“Coqudo” or “the App”), in accordance with the EU General Data Protection Regulation (GDPR).

Coqudo is owned and operated by Methodia S.r.l.s.

1. Data Controller

Methodia S.r.l.s.
Via Generale Giuseppe Valle, 83, 00148 Rome, Italy
VAT: IT17073671004
Email: support@coqudo.it
Commercial name: Coqudo

Methodia S.r.l.s. does not currently appoint a Data Protection Officer (DPO), as it is not required under Article 37 GDPR.

2. Categories of Personal Data Collected

2.1 Data Provided Directly by the User

Registration data: display name, email address, phone number, country, password (encrypted) and, where required, the invitation code used to join.
Profile data: profile picture, display name, contact details (email address and phone number), country and language preference.
Item-related data: title, description, photos, availability, pickup/return locations.
Rental data: photos and videos documenting the condition of an item at pickup and at return, and any damage reported.
Communications: messages and content exchanged via the in-app chat, and the reviews you write about other users and their items.

2.2 Automatically Collected Data

Device information (model, operating system version).
IP address, usage logs, technical identifiers.
Crash diagnostics and analytics data (e.g., Firebase Analytics, Crashlytics).

2.3 Location Data

Location data is collected only with your explicit consent, through device-level permissions. It is used to provide nearby item search, pickup suggestions, and map-based functionality.

2.4 Identity Verification Data

Verifying your identity is optional. If you choose to do it, the document and the selfie are collected and checked by Stripe Identity: the images never reach Coqudo and we do not store them.

From that check we receive and keep only the outcome — whether the verification succeeded — together with the first and last name printed on the document. We do not receive or keep the document number, its type, its expiry date or your date of birth.

That name is shown to one person only, and only at one moment: the counterparty of a rental of yours, in the handover screens, and only if both of you have verified. Everywhere else on Coqudo you are identified by the display name you chose, which may be a pseudonym.

2.5 Payment Data

Payment data is processed exclusively by our third-party payment provider, Stripe. Coqudo receives only limited transactional metadata (such as transaction ID, amount, status) and does not store full card numbers.

3. Purposes of Processing and Legal Basis (Art. 6 GDPR)

The table below summarizes the purposes of processing, the categories of data involved, and the applicable legal basis:

Purpose	Data Types	Legal Basis
Account creation and management	Registration & profile data	Performance of a contract (Art. 6(1)(b))
Listing and renting items	Profile & item-related data	Performance of a contract (Art. 6(1)(b))
In-app communication between users	Chat messages and related metadata	Performance of a contract (Art. 6(1)(b))
Payment processing	Payment metadata (via Stripe)	Performance of a contract (Art. 6(1)(b))
Identity verification, and showing your verified name to the other party at handover	Verification outcome and the first and last name on the verified document	Performance of a contract (Art. 6(1)(b)) and legitimate interest in the safety of people meeting through the platform (Art. 6(1)(f))
Fraud prevention & security	Logs, device info, technical identifiers	Legitimate interest (Art. 6(1)(f))
Analytics & performance monitoring	Analytics & diagnostic data	Consent (Art. 6(1)(a))
Location-based features	GPS/location data	Consent (Art. 6(1)(a))
Legal and tax compliance	Transaction and billing data	Legal obligation (Art. 6(1)(c))

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Where data no longer needs to identify you, we remove what links it to you and keep the rest in anonymous form; anonymous data is no longer personal data and is not subject to the periods below.

Account data: retained for as long as your account exists. When you delete your account your identity is removed: name, email address, phone number and profile picture are erased, your listings are withdrawn from search, and your email address becomes available for registration again.
Transaction and invoicing data: retained for 10 years, as required by accounting and tax law. Invoices and accounting records must carry your name by law, and therefore remain identifiable for that period.
Messages: conversations are not deleted when you delete your account, because they belong to the person you exchanged them with as much as to you. Your messages stay in their inbox, shown as sent by a deleted user.
Reviews: reviews you wrote about other users remain, shown as written by a deleted user, because they are part of someone else's reputation. Reviews written about you are removed.
Reported accounts: if a report concerning you has been reviewed and upheld at the time you ask for deletion, we keep the information linking you to that report for 5 years, or until any legal proceedings are concluded. If a report concerning you has only been received and not yet reviewed, we keep that information for 30 days — the time needed to review it — after which it is removed unless the report is upheld. This is used only to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR). If a report is dismissed, the information is removed.
Banned accounts: where an account is banned following an upheld report, we keep a cryptographic hash of the email address for 5 years, for the sole purpose of preventing the banned account from being created again.
Location data: retained only for the time necessary to provide the corresponding location-based features, and where possible in aggregated or anonymized form.
Identity verification: the outcome and the verified name are retained for as long as your account exists, and are erased when you delete it. The badge is not removed while the account lives — not when the document expires, and not if the account is banned — because what was verified stays verified.
Notifications: the notifications sent to you are kept for 90 days, so that you can find them again on a new device or after reinstalling the app.
Analytics and log data: application logs are retained for 90 days. Database backups are retained for 30 days.

5. International Data Transfers (Art. 44–49 GDPR)

Some of the third-party services used by Coqudo (including Google Maps, Stripe, Resend, Firebase) may transfer and process data outside the European Union (EU) or European Economic Area (EEA).

In such cases, data transfers are carried out in compliance with GDPR requirements, including:

Standard Contractual Clauses (SCCs) approved by the European Commission;
Adequacy decisions where applicable;
Other appropriate technical and organizational safeguards.

6. User Rights (Art. 15–22 GDPR)

As a data subject, you have the following rights regarding your personal data:

Right of access: to obtain confirmation as to whether your personal data is being processed and to receive a copy of such data.
Right to rectification: to request the correction of inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): to request deletion of your personal data in the cases provided for by law.
Right to restriction of processing: to request that processing be limited in certain circumstances.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object: to object at any time to processing based on legitimate interest.
Right to withdraw consent: where processing is based on consent (e.g., location, analytics), you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you may contact us at: support@coqudo.it.

7. Processing of Minors' Data

Coqudo is intended for users aged 18 or older, and we do not knowingly collect personal data from anyone under that age.

If you believe that a minor has created an account, please write to us at the address in section 12 and we will close it and delete the associated data.

8. Automated Decision-Making

Coqudo does not use automated decision-making processes, including profiling, that produce legal effects or similarly significantly affect users within the meaning of Article 22 GDPR.

9. Third-Party Services

Coqudo integrates external services, including but not limited to:

Google Maps APIs for location and map-related features;
Stripe for payment processing and payouts to people who rent out their items;
Stripe Identity for verifying identity documents, where you choose to verify. Stripe collects and checks the document and the selfie; Coqudo receives the outcome and the name, and never the images;
Resend for sending emails, such as account activation, password reset and invitations;
Firebase services for push notifications, analytics and crash reporting.

These third parties may act as independent data controllers or data processors under their own privacy policies. We recommend reviewing their respective privacy policies for more information on how they process personal data.

Deleting your Coqudo account does not reach these services: each of them keeps what it holds for the period set by its own policy. In particular, Stripe keeps the identity and payment records of anyone who has received money through the platform, because it is required to by payment and anti-money-laundering rules, and it keeps them independently of us.

10. Withdrawal of Consent

When processing is based on your consent (for example, location services or certain analytics), you may withdraw your consent at any time by changing the relevant permissions in your device’s operating system (iOS or Android).

Please note that revoking certain permissions may limit or prevent access to specific features of the App.

11. Changes to This Policy

Methodia may update this Privacy Policy from time to time. Updated versions will be made available within the App and identified by the “Last Updated” date at the top of this page.

Continued use of Coqudo after any changes have been implemented will constitute your acceptance of the updated Policy.

12. Contact

If you have any questions regarding this Privacy Policy or wish to exercise your rights, please contact us at:
support@coqudo.it