Privacy Policy

Last updated 11 October 2026 · Version 4.6

RENTOUT SOLUTIONS PVT LTD operates Acefolk and is responsible for the personal data described here. This policy covers the Acefolk website, mobile app, and related support services. It explains what we collect, why, who may receive it, and how to contact us.

1. What information we collect

• Account and profile: name, contact details, date of birth for the adult age check, profile photo, role, contact preferences, and information you add to your profile or listing. If you use Google or Apple sign-in, we receive the account details that provider makes available for sign-in, such as a name or email address.
• Ace applications and listings: service descriptions, photos, availability, experience, qualifications, and other details you submit to offer services.
• Booking and payment records: service details, dates, amounts, transaction references, payment and refund status, and payout information needed to manage a booking.
• Verification: identity and eligibility information, including government identifiers (such as a passport, driver’s licence, national ID, or tax ID/SSN if you choose that document type), documents, selfie or liveness images, and verification results requested during Ace checks. Some of this information may be sensitive under applicable law. If Ace verification is offered through Didit, that service processes information needed for the check.
• Location: location or address information you provide for search, a booking, or a service. With device permission, the app can use precise location for nearby services, Ace availability, arrival, and active booking tracking. Ace location may be updated while the Ace is online or in an active session, including when the app is in the background if that permission and feature are enabled.
• Communications and media: in-app messages, photos, files, voice notes, call connection information, reviews, reports, support emails, and information you provide when we investigate a problem. If you use an in-app voice or video call, the call provider processes the live audio or video needed to connect it.
• Technical and usage information: IP address, device and app information, identifiers, app events, install attribution, crash reports, performance data, and basic website request data. Diagnostic reports can include error details, a screenshot or a description of what is on screen. They can also be linked to your account identifier or email address for troubleshooting. We apply filters to some diagnostic fields, but diagnostic reports are not necessarily anonymous.

The app may ask for camera, microphone, photo or file access, and notification permission for features such as verification, listing media, calls, messages, and booking updates. You can change these permissions in device settings; a feature that needs permission may then be unavailable.

If you choose “Add to Calendar” for a booking, the app passes the service title, Ace name, booking reference, date, time, and service address (when available) to your device’s calendar flow. Your device may ask for calendar access. The calendar provider handles an event you save under its own privacy terms.

Some information reaches us from other people or services involved in a feature. For example, another booking participant may provide a report about a session; a payment partner may return a transaction or refund result; a verification partner may return an identity-check result; and a sign-in provider may provide the account details described above. We use that information for the related booking, account, safety, or support purpose.

Voice input, safety features, and information about other people

If you use voice typing, your device’s speech-recognition service processes microphone input to produce text. Depending on your device and settings, this may involve the speech-service provider’s servers. Recognized text is placed into the input field so you can review it. Text you submit as a message or form entry is handled as that message or entry. Voice typing is separate from sending a voice note or making a call.

If you save emergency contacts, we process the names and phone numbers you enter. Safety reports can contain the report, relevant booking details, contacts, location, and evidence you submit. If you choose a booking-for-someone-else feature, we process the recipient and booking information you provide. Give other people this notice and provide their information only when you have authority to do so; include only what the feature needs.

If you choose to share booking or location information through an available sharing feature, the recipient and the service you select may receive that information. The same applies if you export or share a booking record, invoice, or other available report. Share only with people you trust. A recipient may retain or forward information they receive. Using a safety feature does not by itself establish that an emergency contact or emergency service has received an alert.

Details you choose to provide

Depending on the feature, these details can include your name, email address, phone number, service or mailing address, account identifier, contact preferences, Ace biography, qualifications, listing content, booking instructions, support questions, survey answers, and reports. Keep account and booking details accurate so we can contact the right person and perform the requested service. An Ace may also choose to publish links to their own social-media pages; those links do not give Acefolk access to that social account.

Information generated during use

App and website records may include an IP address, device model or manufacturer, operating-system and app version, browser type, mobile carrier or network information, language or region settings, timestamps, pages or features used, searches, booking actions, and error or performance reports. The exact fields depend on the device, feature, permissions, and enabled services. A crash report may contain technical context needed to investigate a failure. A website request can generate ordinary hosting logs even though the site has no advertising or analytics script.

If you allow notifications, Acefolk may use a device notification token and your message preferences to deliver booking, account, or optional marketing updates. You can change notification permission in device settings and available marketing choices in the app.

Payment and sensitive information

When you pay through Acefolk, payment partners handle payment credentials through their payment flows. Acefolk keeps transaction records needed for bookings, refunds, support, and accounting. Do not send full card numbers, passwords, or government ID documents to our ordinary support email. If verification is needed, use the secure process provided in the app.

Information used for Ace checks may include a government identifier, identity document, selfie or liveness result. Booking and payout records may include financial details. Precise location can also be sensitive under some laws. We ask for these details when the relevant feature needs them; the information requested depends on your role, location, and the service available to you.

If you use email and password sign-in, authentication services process the credentials needed to sign you in. Do not send a password to support. We also receive information you choose to provide when you contact support or report another user.

Payment card numbers and security codes are entered through the payment partner’s flow when that payment method is offered. See the partners’ notices for their separate processing: Razorpay and Cashfree. Acefolk keeps the transaction reference, amount, status, and related booking or refund record needed to operate the service.

Application review and content checks

We process the documents and information you submit to apply as an Ace, including government ID, address evidence, qualifications or portfolio evidence, and the selfie requested in the application. An address document or image may contain personal details beyond the field you enter in the form. Submit only the evidence requested, using the secure upload flow.

Where AI-assisted application review is offered and you choose it, selected application details and document images are sent to Google’s Vertex AI service. These include your name, service category, experience, city/country, biography, document types, and the eligible ID, address and skill-evidence images. Information printed inside an image can be processed even when the same information is excluded from a separate text field. This review is separate from Didit identity verification and from the optional bio writer. Section 2 explains the checks and review choices.

We also process listings, Ace photos, reports and relevant communications to detect prohibited content and investigate misuse. Automated photo checks may use Google Cloud Vision, and authorized reviewers may inspect flagged content and associated records.

App storage and security information

The app stores preferences, sign-in state, cached content, and some unfinished work on your device to support account access and recovery. This is separate from records stored on Acefolk’s systems or by service providers. Clearing app data or uninstalling the app does not by itself delete the account or those remote records.

Security and configuration services may process technical request information, app-integrity results, and security tokens to help protect access and provide the appropriate app configuration. These services include Firebase App Check, Google reCAPTCHA where configured, and ConfigCat for feature configuration. This processing is separate from optional campaign attribution.

2. How we use information

We use this information to create accounts; show listings; connect customers and Aces; arrange and manage bookings; process payments, refunds, and payouts; verify identity and reduce fraud; send service messages; handle support and disputes; maintain security; measure app use and campaign attribution; improve the app and website; and meet legal, tax, and accounting obligations.

The discovery feed may use your bookings, saved items, and likes to estimate which service categories to show you. Category scores are calculated for a feed request rather than stored as a separate interest profile. If you use the optional Ace bio writer and cloud generation is configured, details you enter for that bio are sent to the model provider to generate text. Otherwise, the feature uses an on-device template.

Where applicable law requires a legal basis, we rely on the basis appropriate to the purpose: providing the service you request, complying with law, protecting users and our service from fraud or abuse, or your consent where required. You can withdraw an optional consent through the available app controls or by contacting us. A device permission can also be changed in device settings; doing so may limit a feature that needs it.

In an urgent safety situation, we may use or disclose information needed to protect a person’s vital interests where applicable law permits it.

Service messages about an account, booking, payment, security issue, or policy change are separate from optional marketing messages. Turning off marketing messages may not stop messages needed to operate a booking or protect an account.

Examples include confirming a booking, delivering account and security notices, answering a support request, investigating fraud or a safety report, managing a refund, and meeting tax or accounting duties. Optional marketing and analytics choices are described in section 5. A choice to stop marketing does not remove information required to finish a booking or comply with law.

• Accounts and authentication: create an account, verify a sign-in, maintain the profile, and help recover access.
• Marketplace service: show services and Aces, arrange bookings, connect participants, manage availability, and provide requested communications.
• Money and records: process charges, payouts, refunds, and support questions, and keep records needed for tax, accounting, and disputes.
• Trust and safety: review identity information, investigate reports, detect abuse, secure accounts, and respond to urgent harm.
• Service notices and improvement: send booking or policy information, diagnose crashes, measure performance, and improve the app. Optional analytics and marketing follow the choices described below.

Section 8 explains how long information is kept for these purposes. A purpose ends at a different time for an active account, a completed booking, an unresolved dispute, and a record that law requires us to retain.

AI tools, automated checks, and human review

Bio writing: the bio writer can create a suggested biography using a template on your device. That template does not send the bio details to Google for generation. If cloud generation is enabled in the app and you use it, the service category, experience, languages, skills, city, tone, keywords and other highlights you enter are sent to Google Gemini to generate the suggestion. Do not include confidential information or another person’s personal data in that request. You can review and edit the result before using it. A template can also be used if a cloud request fails. In that case, a request may already have been sent; seeing a template result does not prove that no information left the device.

Ace application review: AI-assisted review checks whether eligible evidence is readable, names and address details are consistent, dated documents appear current, skill evidence is relevant, and the application is internally consistent. When the feature is enabled, eligible categories and countries can receive automatic approval if the required checks pass and no issue is returned. Other cases go to a person for review. These checks do not establish document authenticity, face identity, professional licensing, or guaranteed eligibility. They can be wrong.

You can choose human application review instead of AI-assisted review. While an application is pending, the available human-review action withdraws the AI-review choice for further processing; it does not undo a request that has already been processed. Contact support if the action is unavailable or you want a decision reviewed. Some service categories require a person’s review regardless of the AI choice.

Content and safety checks: automated rules and image analysis help identify prohibited content and determine whether a listing can be published, needs review, or whether an image should be removed. We keep relevant flags, reasons and review records. Contact support if you believe a content or access decision is wrong. Choosing human application review does not switch off separate identity, fraud, or content-safety checks needed for the service.

If an automated decision has a legal or similarly significant effect and applicable law gives you additional rights, you may request information about the decision, express your view, challenge it, and request human intervention. The legal conditions for using such a decision still apply; describing it in this notice does not by itself authorize it.

3. Legal reasons for processing

The legal reason depends on the information, the purpose, and the law that applies to you. Where a legal basis must be stated, Acefolk may rely on:

• Providing a requested service: creating an account, arranging a booking, connecting the parties, processing a payment, or handling a refund.
• Legal obligations: records and disclosures required for tax, accounting, lawful requests, and other applicable duties.
• Legitimate interests where allowed: keeping the service secure, preventing fraud, resolving disputes, and improving reliability, after considering users’ rights.
• Consent where required: optional processing for which Acefolk asks permission. You can withdraw that consent through the available controls or contact us; earlier lawful processing is not undone by withdrawal.
• Vital interests where allowed: responding to an urgent threat to a person’s safety.

If you ask which basis applies to a particular use of your information, contact us using section 15. Some features need information to work even when an optional permission is withdrawn.

People in the European Economic Area or United Kingdom may ask how these bases apply to a particular purpose and may object where the law gives that right. Where Canadian privacy law applies, consent and the legal exceptions to consent depend on the province and circumstance; examples can include fraud prevention, an emergency, a lawful investigation, or compliance with a court order. We do not treat one legal basis as applying to every use of information worldwide.

Purpose and legal basis where EEA or UK law applies

• Accounts and requested marketplace services: account, contact, profile, booking, and necessary transaction information are used to take steps at your request or perform the contract for the service you request.
• Payments, accounting, and legal requests: payment processing is part of providing the transaction; retention or disclosure specifically required by law relies on the relevant legal obligation.
• Security, fraud prevention, complaints, and reliability: necessary account, transaction, report, and diagnostic information may be processed for legitimate interests in protecting users, resolving claims, and operating a reliable service, subject to a balancing of those interests against your rights. A specific legal duty may instead apply to part of that processing.
• Optional analytics, marketing, or other consent-based features: where consent is required, that processing relies on your affirmative choice and you may withdraw it. A device permission does not automatically provide every legal consent needed for a separate purpose.
• Urgent threats to life or safety: necessary information may be processed to protect vital interests where the legal conditions for that basis are met.

Some information is necessary to create an account or provide the feature you request. If you do not provide it, we may be unable to provide that account or feature; the relevant request explains what is needed. Optional information is not made necessary merely by being mentioned in this notice.

Sensitive information can require additional legal conditions beyond the bases above. In particular, identity images processed to identify a person through biometric analysis may need a separate disclosure and explicit consent or another applicable legal condition. A general acceptance of this policy is not a substitute for a required biometric or other sensitive-data consent.

4. When and with whom we share information

We share relevant booking and profile information with the other party to a booking so they can provide or receive the service. Profiles, listings, and reviews you make public may be visible to other users. Depending on which features are available and used, service providers may process information for cloud hosting and authentication, payments, identity checks, maps, messaging and calls, diagnostics, attribution, and support. These providers include Firebase/Google, Cashfree, Razorpay, Didit, Agora, AppsFlyer, Sentry, and ConfigCat where their corresponding services are used. If the optional cloud bio writer is configured and used, Google processes the bio details you submit for that feature. What each provider receives depends on the feature and configuration in use. We may disclose information when required by law, to respond to a serious safety or fraud issue, or as part of a business transfer subject to applicable law.

When you search for a place, choose a booking address, or request directions, Google Maps services may receive the place, address, or location needed for that request. If you sign in with Google or Apple, that provider handles your sign-in under its own privacy terms as well as sending the account details needed by Acefolk. You can review the relevant provider’s privacy notice for its separate use of information.

We do not sell or rent personal information or purchase marketing or contact lists. We do not supply customer information to advertising partners for their independent advertising. An Ace may process information you share directly with them when delivering a service; ask that Ace how they handle information outside Acefolk.

The information shared depends on the feature. An Ace may receive the booking details needed to perform a service; a payment partner receives information needed to process a charge or refund; an identity provider receives information needed for a check; and map or call services receive information needed for the request you make. Public profile and listing information can be seen by users outside a particular booking.

• Cloud and authentication: Firebase and Google services may host account, app, message, notification, and related service data.
• Payments and verification: Cashfree or Razorpay may process a payment; Didit may process an Ace identity check when that flow is offered.
• Maps and communication: Google Maps may process a place or route request; Agora may carry a live call when you use that feature.
• Email and country detection: Amazon Web Services (Simple Email Service) delivers sign-in codes, receipts and refund notices to the email address on your account. To suggest a currency and a country, the app may send your network (IP) address to the ipapi.co and Cloudflare services, which return an approximate country. Static map previews are requested from Google Maps with the place or coordinates being shown.
• Diagnostics and attribution: Sentry, Firebase Crashlytics, Firebase Performance Monitoring, Firebase Analytics when enabled, and AppsFlyer when configured and permitted by the applicable choice may receive data for their stated functions.
• Optional AI: Google Gemini processes cloud bio requests when used, and Google Vertex AI processes eligible application evidence when you choose the offered AI-assisted review. Google Cloud Vision processes relevant photos for content-safety checks. These have different purposes and controls.

A public post or profile can be copied by someone who sees it. Information shared directly with an Ace outside Acefolk may be handled under that Ace’s own practices. Acefolk may also disclose information for a lawful request, a serious safety matter, or a business transfer as described above.

Security, configuration, and voice input: Firebase App Check and Google reCAPTCHA support app or request checks; ConfigCat supplies feature configuration; the device’s speech-recognition provider processes voice input when you choose voice typing. Firebase Crashlytics receives error reports through the app’s error-reporting path. Technical requests to these services can reveal network and device information needed to process the request.

Some recipients process information on our behalf, while others also determine their own processing for a payment, identity check, sign-in, or other service. Their role depends on the service and applicable agreement. Our description of a recipient as a provider does not remove Acefolk’s own responsibilities for the information we disclose.

Identity-verification and AI service terms

Acefolk uses Didit for identity verification. Our saved Didit setting retains routine verification-session data, including submitted documents and selfie or liveness information, for two years under Didit’s configured retention process. Biometric templates are configured to be deleted with the verification session; we do not select separate retention of a template after session deletion. This routine period does not require you to wait two years to make a valid deletion request. We include relevant Didit-held information when handling an account or verification-data deletion request, subject to any applicable legal exception. Contact support@acefolk.com for help. Didit’s own notice describes processing it independently controls.

Acefolk has opted out of Didit’s optional use of its verification data for future model training, fine-tuning, evaluation, validation and dataset curation. According to Didit, this covers historical and newly collected verification data for future model work; it does not reverse training completed before the opt-out. The opt-out does not itself delete verification records or stop necessary verification and permitted security or legal processing.

Didit’s privacy notice explains its processing on customers’ behalf and processing it independently controls, including security and legal purposes. Our selected retention and model-training settings are described above. Contact us about an earlier valid deletion request or information Didit retains under an applicable exception.

Google’s data use depends on the AI service and applicable terms. The Gemini API terms distinguish paid and unpaid services, including model-improvement and human-review uses. The application-evidence review uses Google’s enterprise Vertex AI service, not the bio writer’s API connection. You can contact us about which service handles a particular AI request and its data-use terms. Separate AI disclosures and choices apply where required; a general acceptance of this policy does not replace a required affirmative choice.

5. Cookies, analytics, and tracking

The app has choices for optional Firebase Analytics and marketing messages. The app offers a choice for optional Firebase Analytics, which measures how features are used. You can accept or decline optional analytics using the app’s privacy choices. Other services have different controls: AppsFlyer install attribution, when enabled and permitted by the marketing choice, measures how people reach and use Acefolk. Depending on device permissions and the enabled settings, attribution can involve installation or advertising identifiers, IP address, device information, referral information and app events; Sentry, Firebase Crashlytics, and Firebase Performance Monitoring process errors or performance information through their configured diagnostic paths. Turning off optional Firebase Analytics does not by itself stop those separate diagnostic services. Optional analytics, marketing preferences, service notifications, and device permissions have different purposes and controls. Where Apple’s tracking rules apply, the device tracking permission is a separate requirement; a marketing or analytics choice does not replace it. Attribution does not by itself mean Acefolk displays third-party advertisements.

The current public website is a static site and does not include a website analytics or advertising script. Its hosting provider may still process ordinary request data, such as IP address and browser details, to serve and secure the site. If we add non-essential website tracking, we will update this notice and request consent where required.

Browser “Do Not Track” settings do not change the app’s analytics or attribution choices. Use the app controls and device permissions described above. Because the public website currently has no optional analytics or advertising script, it does not offer a separate website tracking opt-out control.

The website’s request data is different from optional in-app analytics. A choice made in an app does not automatically change processing by a separate browser or by an external service you visit.

The app records privacy choices and related timestamps so it can apply them and keep a record of the choice. Where an in-app choice is available, use it to change that preference. You may also contact support@acefolk.com to withdraw consent or ask for help. Withdrawal does not undo processing that was lawful before withdrawal. Some necessary service, security, or legally required processing may continue on another applicable basis.

6. Google and Apple sign-in

If you choose Google or Apple sign-in, that provider authenticates you and makes certain account details available to Acefolk, such as a name or email address, according to your choices and that provider’s rules. Acefolk uses the details to create or access your account. The provider also handles information for its own sign-in service under its privacy notice; review its controls if you want to change what it shares.

Links to an Ace’s social-media page in an Acefolk profile are separate from account sign-in. Adding a social link does not connect that social account to Acefolk.

7. International processing

Acefolk operates from India and uses cloud infrastructure in India and the United States. Service providers and their authorized support teams may process information in other countries. The country and any transfer protection depend on the provider, feature, and law that applies to the information. Contact us if you want information about a transfer involving your data.

Cross-border processing does not remove privacy rights that apply to you. Where applicable law restricts an international transfer, it requires a valid transfer basis and any necessary supplementary protection. Depending on the destination and law, this may involve an adequacy decision, approved contractual terms, or another permitted mechanism. Contact us for the destinations and safeguards applicable to your information, or a copy of relevant safeguards where the law provides that right.

A service’s processing location is not necessarily the location of every database, backup or support team. Those locations can differ by service and feature. We can provide available information about a transfer relevant to your account if you contact us.

8. How long we keep information

After a deletion request, we normally complete account and eligible associated-data deletion within 30 calendar days, as explained in section 16. We do not impose a general one-year or three-year waiting period after account deletion. Different justified legal or transaction records may have separate retention requirements.

We keep information while your account is active and as needed to provide the service. After an account deletion request, we remove or de-identify information that is no longer needed, subject to active bookings, disputes, fraud prevention, and legal or tax recordkeeping duties. Some transaction, payment, and compliance records may therefore remain after the account is closed. Retention periods depend on the record and applicable law; we do not promise one fixed period for all data.

• Account and profile details: generally while the account is active, then only as needed to close the account, address unresolved matters, prevent abuse, or meet a legal duty.
• Bookings, payments, and refunds: through fulfilment and any related support or dispute, then for applicable accounting, tax, fraud prevention, and legal recordkeeping.
• Messages, reports, and support records: while needed for the conversation, booking, safety issue, or dispute, subject to any continuing legal duty.
• Verification and location information: while needed for identity checks, location features, bookings, safety, or disputes, subject to fraud prevention and legal requirements.
• Diagnostics and attribution: for the period needed to investigate problems, measure the relevant feature or campaign, and meet any applicable legal requirement.

Request deletion in the app’s account settings or email support@acefolk.com from the address linked to your account. We may need to verify your identity before acting on a request.

The criteria above differ by record: an account may close while payment, tax, fraud, safety, or dispute records still need to be kept. We do not promise that every copy disappears immediately from an active system or backup. Information whose justified retention period has ended must be deleted or irreversibly anonymized. Removing a name or replacing an account identifier alone does not necessarily make a record anonymous.

Ace experience or qualification details generally follow the Ace profile and any related verification or booking issue. A feed category score is calculated for a request and is not kept as a separate long-term interest profile; the bookings, saves, and likes used to calculate it follow their own retention rules. If a record must remain for a legal duty or dispute, its continued retention must be limited to that justified purpose. This policy does not authorize indefinite retention of unrelated personal information.

Closing an account, deleting a device copy, and expiry of a backup are different events. We do not represent backup removal as immediate or promise a fixed backup-deletion deadline in this notice. Retained verification, shared booking or chat evidence, and financial records require their own justified retention and deletion handling. Didit’s configured two-year routine retention and deletion of biometric templates with the session are described in section 4. Routine retention is not a reason to postpone a valid erasure request. We include relevant processor-held verification information in the deletion process, subject to justified legal exceptions. A complete privacy request must address all information within its scope, including processor-held information. You may ask what data remains after your request and the reason or retention criteria that apply.

9. How we protect information

We use access controls, encrypted connections, and other measures designed to protect information. No system can guarantee absolute security. International processing and transfers are described in section 7.

We use measures designed to limit unauthorized access and protect information in transit. Access is tied to service roles and the information needed for a task. Security measures reduce risk but cannot prevent every breach, misuse, or transmission failure. If you think your account or information has been exposed, contact support@acefolk.com so we can investigate.

10. Children

Acefolk accounts are for people aged 18 or older. If you believe someone under 18 has provided personal data, contact support@acefolk.com so we can investigate and take appropriate action.

A parent’s consent does not create an exception to the 18+ account rule. If we learn that a child has created an account, we will take steps to close it and remove information that is not required for a lawful safeguarding or other obligation. Adults must not use another-person booking or upload feature to bypass the account rule or provide unnecessary information about children.

11. Your privacy rights

Depending on applicable law, you may ask whether we process your information; request access, a copy, correction, or deletion; withdraw consent where processing relies on it; object to or restrict certain uses; or request data portability. Some laws also provide rights concerning sensitive information, targeted advertising, and significant automated decisions. These rights have legal limits. The discovery feed's category scores do not by themselves make decisions with legal or similarly significant effects.

Where your local law provides them, you may also request information about categories of data and recipients, limit certain uses of sensitive information, opt out of a sale or sharing of personal information or targeted advertising, and appeal a refusal to act on a privacy request. We will not deny the service merely because you exercised a privacy right, although a feature may need information or permission to work. These rights do not mean Acefolk currently carries out every activity for which an opt-out right exists.

You can change location and notification permissions in your device settings. Withdrawal of a permission may limit a feature that needs it. To make a privacy request, use available account controls, visit our contact page, or email support@acefolk.com. We may verify your identity or an authorized representative's authority. We will respond as required by applicable law and explain any legal reason we cannot fulfil a request in full. You may also complain to a privacy authority or appeal our response where local law gives you that right.

Rights vary by location and may include knowing what information is processed, obtaining access or a copy, correcting an error, deleting eligible data, restricting or objecting to certain uses, portability, and withdrawing consent. Some laws provide a right to challenge a decision made only by automated processing that has a legal or similarly significant effect. The discovery feed’s category scores are distinct from the application, verification and moderation checks described in section 2.

You can ask an authorized representative to act for you where law allows it. We may request proof of authority and verify identity before releasing or changing information. If we cannot fulfil a request in full, we will explain the applicable reason and any appeal path required by law.

In the EEA, UK, Switzerland, or Canada, local law may provide additional access, correction, deletion, objection, restriction, portability, consent-withdrawal, or complaint rights. You can complain to the supervisory authority that applies to you where the law permits. UK residents can find the Information Commissioner’s Office at ico.org.uk. We will consider a request under the law that applies to it rather than assume every right operates in the same way in every country.

India and other countries

Where Indian data-protection law applies and the relevant provisions are in force, rights may include information about processing, correction, completion or updating, erasure, grievance redressal, withdrawal of consent, and nomination of another person to exercise rights in the circumstances provided by law. Contact us using section 15 to exercise an applicable right or raise a grievance. The available regulatory route and any required steps depend on the law in force when the request is made.

People elsewhere may have additional rights under local law, including access, correction, deletion, objection, consent withdrawal, and complaints to a competent authority. We assess requests under the law that applies to the person and processing. These descriptions do not limit mandatory local rights or imply that every right is identical in every country.

In Australia, where the Privacy Act applies, you can ask for access or correction and complain to us about how your information has been handled. We will explain our response and the available escalation route, including the Office of the Australian Information Commissioner where applicable. International disclosure is addressed in section 7. Other countries may impose different procedures or deadlines, which take precedence over a general description here.

12. Browser Do Not Track signals

Some browsers send a Do Not Track preference. The current Acefolk website has no optional advertising or analytics script for that browser signal to control, and it does not offer a separate website tracking opt-out. A browser setting does not change the app’s separate analytics, attribution, marketing, or device-permission choices. Use those app and device controls for the related processing.

Do Not Track is different from legally recognized opt-out preference signals, such as Global Privacy Control in jurisdictions where it applies. This explanation does not waive any duty to honor such a signal. The relevant technology, processing, and local law determine what an opt-out signal controls; browser preferences do not automatically change the app’s separate settings.

13. Rights for United States residents

Depending on your state and the law that applies, you may ask whether Acefolk processes your personal information; request the categories or specific pieces of information held about you; ask for its sources, purposes, and recipient categories; obtain a copy; correct inaccuracies; or request deletion. Some laws also allow you to limit certain sensitive-information uses, opt out of a sale or sharing of personal information or targeted advertising, or object to profiling that has a legal or similarly significant effect.

These rights have exceptions and are not all available in every state. You may use an authorized agent where allowed. We may verify the request and the agent’s authority. We will not refuse a service merely because you exercised a privacy right, although a feature may need specific information to work. If local law permits an appeal of our response, contact us again and state that you are appealing; you may also contact the relevant regulator where permitted.

A right to opt out does not mean Acefolk currently carries out every activity covered by that right. The website currently has no advertising or analytics script. We do not sell or rent personal information or purchase marketing or contact lists. We do not supply customer information to advertising partners for their independent advertising. Ask us if you need information about a particular disclosure of your data.

Categories relevant to current features

Depending on how you use Acefolk, records may fall into these broad US privacy-law categories: identifiers and contact information; account and transaction details; age and other information used for eligibility checks; booking and payment history; device, network and app activity; precise or approximate location; photos, voice notes and other communications; Ace work history or qualifications; and limited inferences such as the category score used for a discovery request. Verification documents and precise location may be treated as sensitive information under a law that applies to you. Application-review check results, moderation flags and other derived assessments can also be personal information. These are examples of information associated with current features; the exact categories depend on the features you use. We can address a request for the applicable collection and disclosure period from our records.

Some state laws allow a person to request information about the categories of third parties or, in certain circumstances, specific recipients of personal information. You can make that request through section 15. Where the California Consumer Privacy Act applies, eligible requests to know, delete or correct generally require a response within 45 calendar days, with a permitted extension and notice where the law allows. Other request types, including sale/sharing opt-outs, have their own requirements; they do not all use the same deadline. California’s “Shine the Light” law may also allow a California resident to ask about any disclosure of personal information to third parties for those parties’ direct marketing in the preceding calendar year. We will answer an applicable request from our records, including when there was no such disclosure.

14. Changes to this policy

We may change this policy when the service, a provider, or legal duties change. The date near the top shows when the website text was last updated. For a material change, we will give additional notice or ask for a new choice where applicable law requires it. An updated page alone does not replace a required consent.

15. How to contact us

For privacy questions, data requests, or grievances about how Acefolk handles personal information, email support@acefolk.com. This is the privacy and grievance contact for RENTOUT SOLUTIONS PVT LTD, which operates Acefolk. Include a short description of your concern and enough information to identify the relevant account.

You may also use our contact page or write to RENTOUT SOLUTIONS PVT LTD at S-61/14, Nehru Nagar (South Delhi), New Delhi, Delhi 110065, India.

Do not include a password, full card number, or identity document in ordinary email. Use your registered email address where possible. If you cannot access it, explain that in your message so we can arrange appropriate verification. Section 16 explains deletion requests and requests to review a response.

16. Review, correct, or delete your data

You may review or update information available in your account settings. For information you cannot change there, contact us and describe the information and change requested.

Request account and associated-data deletion

1. In the app: open account settings and choose the account-deletion option. Follow the confirmation and identity-verification steps.
2. Without the app: email support@acefolk.com with the subject “Acefolk account and data deletion request.” Identify the account using the email address or phone number associated with it. You do not need to reinstall the app to send a request.
3. If you cannot access your registered email or phone: contact the same support address and explain the access problem. Do not send a password, full card number, or identity document in ordinary email. We may ask for proportionate verification through a suitable secure process.

Before self-service deletion can finish, you may need to complete or cancel active bookings, resolve balances, pending earnings, paid leads, refunds, withdrawals or disputes, and cancel an active automatic-renewal arrangement. If you cannot complete a step or the app blocks the request, contact support using the email route above. We must assess any need to retain information separately from removing information that is no longer needed; an unresolved matter is not a blanket reason to keep every record.

Uninstalling the app does not delete the account, withdraw all consents, or cancel a subscription. Requesting deletion does not itself guarantee that a separate billing arrangement has been cancelled. Check the renewal status shown for that arrangement or ask support for help.

Account deletion is intended to remove the account and associated personal data that no longer has a justified retention basis. It is not simply a temporary freeze. Certain payment, tax, fraud, verification, safety, dispute, or shared transaction records may remain only for applicable justified purposes, as described in section 8. We will explain any applicable exception and handle requests within the time required by the law that applies. Where an extension or refusal is permitted, we will give the required notice and reason. Requests are free unless applicable law permits a charge in the particular circumstances.

How quickly we handle requests

We acknowledge privacy and account-deletion requests within two working days and normally complete account and eligible associated-data deletion within 30 calendar days of receiving the request. This process includes requesting deletion of relevant information held by our service providers, including Didit. We may need proportionate identity verification. If applicable law requires a shorter deadline, that deadline takes precedence. If a lawful extension or an unresolved booking, payment or dispute affects completion, we explain the reason, what information remains, and the expected next step; we do not postpone deletion of unrelated information merely because another record must be retained.

The 30-day period is our normal deletion-processing time, not a blanket retention period for every record or a guarantee of immediate removal from every backup. Payment, tax, security, fraud-prevention or dispute records may remain only where a specific applicable duty or justified purpose requires it. We explain the applicable reason and retention period or criteria, limit access and use to that purpose, and delete or irreversibly anonymize the information when that basis ends.

Verification, representatives, and complaints

For an access, correction, or deletion request, tell us what account and information the request concerns. You may also request deletion of particular information without closing the whole account, subject to what the service needs and any applicable retention duty. We may compare details already held with those supplied, then ask for additional proportionate proof where needed to prevent disclosure to the wrong person. We will not require identity verification for an opt-out request where the applicable law does not permit it. Where law allows a representative to act, we may require proof of authority. Information supplied only to verify a request is used for verification and related security or legal recordkeeping.

If we cannot fulfil a request in full, we will explain the applicable reason and any review or appeal route required by law. To request review, email support@acefolk.com with the earlier request reference and explain the issue. Where applicable law permits, you may also complain to the relevant privacy authority or other regulator. Contact details are in section 15.