Yardy Privacy Policy

Effective date: 2026-05-05

Heyquip Inc. (a corporation existing under the laws of Canada, with its head office in the Province of Quebec; "Heyquip", "we", "us", or "our") is the legal entity responsible for the "Yardy" brand, website, and brokerage service (the "Yardy Service" or, where context allows, simply "Yardy"). "Yardy" is a product and brand of Heyquip Inc.; it is not itself a legal entity. Heyquip is committed to protecting your privacy.

This Privacy Policy (the "Policy") explains why and how Heyquip collects, uses, shares, stores, transfers, and protects (collectively, "processes") your Personal Information when you interact with the Yardy Service through SMS, voice, the yardy.io and app.yardy.io websites, or any other Yardy interface (collectively, the "Services").

This Policy applies to Heyquip in its capacity as operator of the Yardy Service. Heyquip operates other products under the Heyquip brand; those products may be governed by separate privacy notices. Every right, obligation, and liability described in this Policy is held by Heyquip Inc. and not by "Yardy" as a notional entity.

1. About This Policy

Yardy is a brokerage platform operated by Heyquip Inc.: through Yardy, Heyquip connects renters of construction and event equipment ("Renters") with independent equipment-rental businesses ("Rental Shops"). To do this, Heyquip collects information from Renters about their equipment needs and routes that information to one or more Rental Shops who may be able to fulfill the request. Once a Renter and a Rental Shop choose to transact, the Rental Shop becomes an independent controller of the Personal Information that is shared with it; Heyquip is not a party to the rental and does not control the Rental Shop's subsequent processing of that information.

This Policy describes:

• the Personal Information we collect and where it comes from;
• why we process it;
• who we share it with (including Rental Shops, AI providers, and other service providers);
• how long we keep it;
• how we secure it;
• your rights, and how to exercise them.

For the purpose of this Policy, "Personal Information" means any information about an identifiable individual.

2. Personal Information We Collect

2.1 Information you provide

• Identity and contact: name, phone number (E.164), email, mailing or jobsite address, employer / business name, role.
• Equipment-rental request details: equipment categories and specifications, quantities, delivery / pickup dates, jobsite location, project description, photos, certificate of insurance ("COI") and other supporting documents you choose to upload.
• Conversation content: the text of your SMS, web-chat, or in-app messages with the Yardy Service and, where you call Yardy, the audio recording and machine-generated transcript of the call. These are received and processed by Heyquip.
• Account credentials, where you create an account on app.yardy.io (managed via our identity provider, currently WorkOS).
• Feedback and support communications, including ratings of Rental Shops, complaints, and correspondence with Heyquip operators.

2.2 Information we collect automatically

• Device and technical data: IP address, browser and device identifiers, operating system, language, time zone, referrer, and similar telemetry.
• Usage data: pages and features accessed, actions taken, timestamps, and approximate location derived from IP address or, with your permission, GPS.
• Cookies and similar technologies: see Section 8.

2.3 Information from third parties

• From Rental Shops: updates on your request (e.g., quoted price, accepted, declined, completed), and any feedback Rental Shops choose to share about an interaction.
• From service providers: for example, Twilio (SMS / voice metadata, carrier information), Mapbox (geocoding of an address you submit), Stripe (where applicable, payment status; Heyquip does not collect or store full card numbers), and our identity provider (authentication events).
• From public sources: publicly available business directory data, where we use it to enrich a Rental Shop record or to verify a Renter's business.

We do not knowingly collect Personal Information from children under 13, and the Services are not directed to children. The Services are intended for users 18 years of age or older.

3. How We Use Personal Information

We process Personal Information for the following purposes:

(a) To provide the Services. Receive, interpret, and respond to your equipment-rental request; route the request to one or more Rental Shops; relay information back to you; create and manage your account.

(b) To operate the AI agent. Heyquip uses third-party large-language-model providers (currently Anthropic) to interpret your messages and to draft responses within the Yardy Service. The content of your conversations and call transcripts is sent to these providers under contracts that prohibit them from using your content to train their general-purpose models.

(c) To communicate with you. Send transactional SMS, voice, and email messages related to your request, including reminders, status updates, and follow-ups. We also use this information to provide customer support.

(d) To improve and secure the Services. Operate the platform, monitor performance, debug, prevent fraud and abuse, enforce our Terms, and train Heyquip's internal models on de-identified or aggregated content. Where we use conversation content for internal model training or quality evaluation, we apply de-identification or pseudonymization before doing so.

(e) To comply with law and protect rights. Comply with legal obligations, respond to lawful requests, and protect the rights, property, or safety of Heyquip, its users, or the public.

(f) For business operations. Accounting, invoicing of Rental Shops, financial planning, audits, corporate transactions.

(g) For marketing, only where you have consented or where a soft opt-in applies under applicable law. You may opt out of marketing communications at any time (see Section 9).

We do not sell your Personal Information for monetary consideration. We do not engage in cross-context behavioral advertising other than as described in Section 8.

4. Legal Bases (Where Applicable)

Where Quebec Law 25, Canadian PIPEDA, the EU/UK GDPR, the CCPA/CPRA, or another similar law applies to a given processing activity, our legal basis will be one or more of: (a) your consent; (b) the necessity of the processing to perform a contract with you (including these Services); (c) compliance with a legal obligation; (d) our legitimate interests (e.g., service improvement, security, fraud prevention) where those interests are not overridden by your rights; or (e) the protection of vital interests.

5. Who We Share Personal Information With

5.1 Rental Shops

When you submit a request through the Yardy Service, you authorize Heyquip to share with the Rental Shops we route your request to: your name, your contact information, your jobsite or delivery address, your equipment-need details, your COI (if provided), and any other information necessary for the Rental Shop to assess and respond to your request. Once shared, the Rental Shop is an independent controller of that information and is responsible for processing it under its own privacy policy and applicable law. Heyquip is not responsible for the Rental Shop's subsequent processing. We encourage you to review the privacy policy of any Rental Shop with whom you choose to enter a Rental Agreement.

5.2 Service providers (processors)

We use trusted service providers to operate the Services. They process Personal Information only on our instructions and under contractual obligations to maintain confidentiality and security. Categories include:

• Cloud and hosting: Vercel, Supabase, Amazon Web Services.
• Telephony / messaging: Twilio.
• AI model providers: Anthropic (and, for narrowly scoped tasks, other LLM or speech-to-text providers we may add). Provider contracts prohibit the use of your content to train their general-purpose models.
• Maps / geocoding: Mapbox.
• Identity / authentication: WorkOS.
• Analytics, error monitoring, and product telemetry: for example, our error-monitoring and product-analytics providers.
• Customer support, email delivery, and CRM tools.
• Professional advisors: legal, accounting, audit.

A current sub-processor list is available on request to privacy@heyquip.com.

5.3 Legal and safety

We may disclose Personal Information when we believe in good faith that disclosure is required to: (a) comply with a law or legal process; (b) respond to a lawful request from a public authority; (c) enforce our Terms; (d) detect, prevent, or investigate fraud, abuse, or security incidents; or (e) protect the rights, property, or safety of Heyquip, our users, or the public.

5.4 Corporate transactions

If Heyquip is involved in a merger, acquisition, financing, or sale of all or part of its assets, your Personal Information may be transferred as part of that transaction. We will notify you (e.g., by email or by notice on the Services) before your Personal Information becomes subject to a different privacy policy.

5.5 With your consent

We may share Personal Information for additional purposes with your consent.

6. International Data Transfers

Heyquip is headquartered in Quebec, Canada. Your Personal Information may be processed in Canada, the United States, or other jurisdictions where our service providers operate. Privacy laws in those jurisdictions may differ from those in your jurisdiction. Where we transfer Personal Information out of your jurisdiction, we use contractual and technical safeguards (for example, standard contractual clauses where required) to maintain a comparable level of protection.

7. How Long We Keep Personal Information

We retain Personal Information for as long as necessary to provide the Services, to fulfill the purposes described in this Policy, to comply with legal obligations, and to resolve disputes and enforce our agreements. Indicative retention periods:

After the applicable retention period, Personal Information is deleted or de-identified. De-identified or aggregated data may be retained indefinitely for analytics, research, and model improvement.

8. Cookies and Similar Technologies

yardy.io and app.yardy.io use cookies and similar technologies. We use:

• Strictly necessary cookies to operate the websites (e.g., session cookies, authentication cookies, CSRF tokens). These cannot be disabled.
• Functional cookies to remember preferences such as language.
• Analytics cookies and product-telemetry tools to understand how the Services are used. Where required by law, we ask for your consent before placing them.

You can manage cookies through your browser settings and, where applicable, through the cookie banner shown on first visit. Refusing non-essential cookies may degrade some features of the Services. We do not currently respond to "Do Not Track" browser signals because there is no industry standard for them.

9. SMS, Voice, and Marketing Communications

By messaging the Yardy phone number or providing your phone number to Heyquip through the Yardy Service, you consent to receive transactional and AI-generated SMS, MMS, RCS, and voice communications from Heyquip and from Rental Shops to whom your request is routed, related to your equipment-rental request. Message frequency varies; message and data rates may apply.

You can opt out of SMS at any time by replying STOP to any Yardy SMS, opt back in by replying START, and receive help by replying HELP. Opt-outs are processed at the carrier and platform level before Heyquip's AI agent runs. You can manage email and phone marketing preferences by contacting privacy@heyquip.com.

Voice calls between you and the Yardy Service may be recorded and transcribed by Heyquip for service operation, quality, training, and safety. The opening of a Yardy call discloses this. Continuing the call after the disclosure constitutes consent. You can ask, on the call, that the recording be stopped; in that case the call may be terminated.

10. Automated Decision-Making and AI

Heyquip uses AI within the Yardy Service to triage messages, classify equipment categories, draft responses to you, and rank Rental Shop matches. These outputs are reviewed and edited by Heyquip operators in many cases. Heyquip does not use AI to make decisions that produce legal or similarly significant effects on you without human involvement. If you would like a human review of an automated output that affects you, contact support@heyquip.com.

Heyquip does not provide your Personal Information to any AI provider for the purpose of training the provider's general-purpose models. Heyquip may use de-identified or aggregated content drawn from your interactions to evaluate and improve its own internal models and prompts.

Any equipment, accessory, configuration, safety, or sequencing suggestion that the Yardy Service may surface during your conversation is informational only and must be independently verified by the Rental Shop providing the equipment before being acted on. Heyquip is not the source of professional advice on the suitability or safety of equipment for your job. See the Yardy Terms and Conditions for the full allocation of responsibility.

11. Security

We use administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, role-based access control, audit logging, security reviews of our codebase and configuration, and incident-response procedures. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

If a security incident affects your Personal Information in a way that triggers a notification obligation under applicable law, we will notify you and the relevant regulators as required.

12. Your Rights

Depending on where you reside and which laws apply, you may have the right to:

• access the Personal Information we hold about you;
• rectify inaccurate or incomplete information;
• delete your Personal Information, subject to legal exceptions;
• withdraw consent where we rely on consent;
• object to or restrict certain processing;
• portability: receive your Personal Information in a structured, commonly used, machine-readable format;
• not be subject to automated decisions that produce legal or similarly significant effects on you (see Section 10);
• lodge a complaint with a supervisory authority (in Quebec: the Commission d'accès à l'information du Québec; for federal Canadian matters: the Office of the Privacy Commissioner of Canada; in your U.S. state, the relevant attorney general or privacy agency).

To exercise any right, contact privacy@heyquip.com. We will respond within the timelines required by applicable law (generally, 30 days under PIPEDA / Quebec Law 25, with a possible extension we will notify you of). We may need to verify your identity before fulfilling a request.

If a Rental Shop has received your information through Yardy, your rights against the Rental Shop must be exercised against the Rental Shop directly; we will provide reasonable assistance to direct your request appropriately.

13. U.S. State-Specific Disclosures

For California, Colorado, Connecticut, Utah, Virginia, Texas, and other U.S. residents covered by comprehensive state privacy laws:

• Categories of Personal Information collected are described in Section 2.
• Purposes of processing are described in Section 3.
• Categories of recipients are described in Section 5.
• Sale or sharing. We do not sell your Personal Information for monetary consideration. We do not "share" Personal Information for cross-context behavioral advertising as those terms are defined under California law.
• Sensitive Personal Information. We do not use sensitive Personal Information for purposes that require an opt-out under applicable U.S. state law.
• Right to appeal. Where applicable law provides a right to appeal a decision on your privacy request, you may submit an appeal by replying to our written response or by contacting privacy@heyquip.com with the subject line "Privacy Appeal."

14. Quebec-Specific Disclosures

Heyquip is headquartered in Quebec. The person responsible for the protection of Personal Information at Heyquip (the Privacy Officer) can be reached at privacy@heyquip.com. Quebec residents have the rights described in Section 12 under the Act respecting the protection of personal information in the private sector (as amended by Law 25), including the right to be informed of any automated decision based exclusively on automated processing and to request that the decision be reviewed.

15. Children

The Services are not directed to children under 13, and we do not knowingly collect Personal Information from children under 13. The Services are intended for users 18 years of age or older. If you believe a child under 13 has provided us with Personal Information, contact privacy@heyquip.com and we will take steps to delete it.

16. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you (for example, by email, by SMS, or by posting a notice on the Services). The "Effective date" at the top of the Policy reflects the most recent revision.

17. How to Contact Us

Heyquip Inc., operator of Yardy Privacy Officer Address: 66 avenue Strathyre, Montreal, H8R 3P9, Quebec, Canada Email: privacy@heyquip.com Legal: info@heyquip.com

If you are unable to resolve a privacy concern with us directly, you may contact the supervisory authority in your jurisdiction (see Section 12).