Privacy Policy

Gemach Hub ("we", "us") provides software that lets community lending libraries ("gemachim") publish a mini-site, manage inventory, and track loans. This policy explains what personal information we collect, how we use it, how long we keep it, and the choices you have.

Information we collect

• Account information (required): your name, email address, and mobile phone number. Both an email address and a mobile phone number are required to create an account so that gemach owners can reach borrowers about items in their care.
• Consent records: whether you opted in to text messages, and the date and time of that opt-in or opt-out.
• Gemach and inventory content: item names, descriptions, categories, photos, and availability that owners upload.
• Loan and request records: borrow requests, wait-list entries, item donation offers, loan dates, quantities, fees, and donations.
• Technical and audit logs: event type, page path, browser user agent, and timestamps, used for security and troubleshooting.

How we use information

• To operate accounts, mini-sites, inventory, and loan tracking.
• To let a gemach owner contact a borrower (and vice versa) about a specific request, loan, pickup, or return.
• To send transactional notifications you have asked for, including in-app notifications, email, and — only if you opt in — SMS.
• To keep the service secure, prevent abuse, and meet legal obligations.

Text messages (SMS)

SMS is strictly optional and strictly transactional. We do not send marketing or promotional texts, and we never sell or share mobile numbers or SMS consent with third parties or affiliates for their own marketing purposes. See our SMS Terms for full details, opt-out instructions, and message-rate disclosures.

How we share information

• With the gemach you interact with. When you submit a borrow request, join a wait list, or offer a donation, the owner of that gemach sees your name and the contact details you provided.
• With service providers. Hosting, database, email, and (where enabled) SMS delivery providers process data on our behalf under contract.
• When required by law or to protect the rights and safety of users.

We do not sell personal information.

Data retention

• Account profile: kept while your account is active, and deleted within 30 days of an account-deletion request.
• Loan, request, wait-list, and donation records: kept for up to 3 years after the loan is closed or the request is resolved, so owners can resolve disputes about borrowed property.
• SMS consent and opt-out records: kept for at least 4 years after the consent or opt-out event, as required for messaging-compliance recordkeeping — even if the rest of your account is deleted.
• Audit and security logs: kept for 12 months.
• Photos and uploaded files: deleted when the related item or gemach is deleted.

Backups may retain deleted content for up to 35 additional days before being overwritten.

Your choices and rights

• View and update your name, email, and mobile number at any time from your account settings.
• Turn SMS notifications on or off at any time in settings, or by replying STOP to any message.
• Request a copy of your data, or request deletion of your account, by contacting us.

Security

Data is stored on managed infrastructure with encryption in transit and at rest, row-level access controls that limit each record to its owner or the relevant gemach, and private storage for uploaded photos served through short-lived signed links.

Children

Gemach Hub is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We will post any changes on this page and update the date above. Material changes affecting SMS will be communicated before they take effect.

Contact

Questions or requests: privacy@gemach.thefrumdirectory.com