Trust, Security & Privacy
This page is maintained by Wheelie to answer common security and privacy questions about how we operate our walk-in wheelchair, stroller, and pet stroller rental service. It describes the controls currently enabled in our app and our day-to-day practices. It is not a third-party certification or independent audit.
What data we collect
To process a rental, we collect the renter's name, contact number, optional email, a valid ID reference shown at check-in, the equipment booked, rental time window, payment status, and the digital waiver acceptance record. Walk-in browsing does not require an account.
How we use it
Booking data is used to fulfill the rental, contact the customer about their reservation, coordinate returns, and meet basic record-keeping needs for the business. We do not sell customer data. Marketing communications, if any, are only sent when explicitly opted into.
Access controls
Customer records are not publicly readable. Staff and admin areas are protected by PIN-based sign-in that issues a short-lived signed session (8 hours). Sensitive operations require an authenticated staff or admin role, enforced on the server — not in the browser. Role checks are stored separately from user profiles to prevent privilege escalation.
Data protection
The application uses row-level security on customer-facing tables so that booking, reservation, waitlist, and waiver records are not exposed through the public API. Service-role access is restricted to server-side code. Realtime broadcasts of personal data tables are disabled — booking status updates are fetched on demand instead of streamed.
Payments
Payments are processed in-store via the payment methods displayed at the counter. Wheelie does not store full card numbers in this application.
Hosting & subprocessors
The app runs on the Lovable platform with a managed Postgres database and storage backend. These providers process data on our behalf strictly to operate the service. Describing the platform here is factual and is not a claim of independent certification.
Retention & deletion
Booking and waiver records are retained for as long as needed to operate the business and meet reasonable record-keeping needs. To request access, correction, or deletion of your personal data, contact us using the details below and we will respond within a reasonable period.
Security contact
To report a security concern or a suspected vulnerability, please reach out through the contact channels listed on our home page. Include enough detail to reproduce the issue and we will follow up.
Shared responsibility: Lovable provides the underlying platform features described above; Wheelie is responsible for how we configure the app and handle customer data; customers are responsible for keeping their own contact details and ID accurate at check-in.