Powered by Incedym UniversalResourceGrid, operated by Incedym Universal. Last updated September 13, 2026 (draft).
Account information you provide at signup (name, contact details, and role-specific fields — see each product's registration model). For providers, renters, and NGOs, identity or business/nonprofit verification documents (government ID, registration certificates, authorized-signatory ID) — see Why we ask for verification. We also collect booking, messaging, and payment-transaction records needed to operate the marketplace, and standard technical data (device, browser, IP address) for security and to keep the service working.
To create and secure your account; to run the verification pipeline described in How verification works; to operate bookings, messaging, and payments; to detect and prevent fraud; to provide support when you contact us; and to meet legal and regulatory obligations that apply to us. We do not use your verification documents for any purpose beyond confirming your identity or registration.
Confirmed platform commitment: your personal and verification data is stored within your own country's region (or the legal region that country's law defines, e.g. EU-wide for GDPR purposes), matching the data protection law that applies to you. As ResourceGrid operates in more countries, each gets its own regional storage rather than one global database.
Confirmed pattern: verification data is retained while your account is active, plus a reasonable window after closure for dispute resolution, then deleted automatically. The exact length of that window is still being finalized per country with legal input — this policy will be updated with real figures once confirmed, not before.
We share data only where necessary to run the marketplace: with the licensed payment processor that handles split payments (ResourceGrid itself never custodies funds — see the Terms of Service), with the relevant public registry when checking a business or NGO's registration, and with law enforcement or regulators where we're legally required to. We do not sell personal data, and we do not share verification documents with other users — a provider or renter sees only that the other party is verified, never the underlying documents.
Verification documents and account credentials are encrypted at rest and in transit. Access to verification documents is limited to what the automated pipeline and, where a case needs one, a human reviewer actually require — not open to the rest of the organization by default.
Depending on where you're located, you generally have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion (subject to our retention obligations above), and object to or restrict certain processing. The specific right names and how to exercise them vary by country — see the regional section below for yours, and contact us to make a request.
We may update this policy as the platform evolves or as country-specific legal review is completed. We'll post the updated version here with a new "last updated" date, and for material changes we'll make a reasonable effort to notify active users directly.
Questions about this policy, or a request to exercise your rights, can be sent via Contact support.
Which law applies to you depends on where you're located. Where possible, we detect this automatically from your connection using Cloudflare's edge geolocation, based on your network's location — not your browser's language setting, and not always exactly where you live (a VPN or a trip abroad can throw it off). Select your country below if it's wrong, or if nothing was detected.
Depending on your state of residence, applicable law may include the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable comprehensive privacy laws in states such as Virginia, Colorado, Connecticut, and Utah.
California residents specifically have the right to know what personal information is collected, to request its deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information (we do not sell personal information), and to non-discrimination for exercising these rights.
Governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) federally, and applicable provincial privacy legislation. You have the right to access your personal information, request correction of inaccuracies, and withdraw consent for further collection or use, subject to legal or contractual restrictions.
Complaints can be directed to the Office of the Privacy Commissioner of Canada.
Governed by the Digital Personal Data Protection Act (DPDP Act). You have the right to access a summary of your personal data and how it's being processed, request correction and erasure, and nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
Complaints can be directed to the Data Protection Board of India.
Governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the right to access personal information we hold about you and request correction of inaccurate information.
Complaints can be made to us directly, or to the Office of the Australian Information Commissioner (OAIC) if you believe we've mishandled your information.
As an EU member state, governed by the General Data Protection Regulation (GDPR). You have the right to access, rectify, and erase your personal data, restrict or object to processing, and request data portability.
Complaints can be directed to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or your own EU member state's supervisory authority.
Governed by the Personal Data Protection Act (PDPA). You have the right to access and request correction of your personal data, and to withdraw consent for its collection, use, or disclosure, subject to legal and contractual restrictions.
Complaints can be directed to the Personal Data Protection Commission (PDPC).
Governed by the UK GDPR and the Data Protection Act 2018. You have the right to access, rectify, and erase your personal data, restrict or object to processing, and request data portability.
Complaints can be directed to the Information Commissioner's Office (ICO).
As an EU member state, governed by the General Data Protection Regulation (GDPR) — rights are the same as described for the Netherlands above: access, rectification, erasure, restriction, objection, and data portability.
Complaints can be directed to the Data Protection Commission (DPC).
Governed by the Privacy Act 2020. You have the right to access personal information we hold about you and request its correction, under the Act's Information Privacy Principles.
Complaints can be directed to the Office of the Privacy Commissioner.
Governed by the Protection of Personal Information Act (POPIA). You have the right to access, and request correction or deletion of, your personal information, and to object to processing.
Complaints can be directed to the Information Regulator of South Africa.