This Privacy Policy explains what personal information BoRo collects, why, who receives it, how long it is kept, and what you can ask BoRo to do with it. It forms part of the BoRo USA Terms of Service.
Notice of Changes in Version 3.1
This Version 3.1 amends and restates Version 3.0. It makes the following substantive changes. This notice is descriptive only.
United States only. Section 2 is replaced. The Services are offered only in the United States. References to the General Data Protection Regulation and the UK General Data Protection Regulation are withdrawn, together with the undertaking to appoint a European or United Kingdom representative.
What other Users see. New Section 8 states, for the first time, what is disclosed to the other party to a booking, what is displayed publicly upon a profile, and what is never shown. Prior versions did not list other Users among the recipients of Personal Data.
Contact details in messages. New Section 6.3 states plainly that BoRo does not display your telephone number, surname, or payment details to another User, and that BoRo cannot prevent you from typing that information into a message yourself.
Retention periods. Section 11 is replaced. A period is now stated for each category of Personal Data, in place of a general statement that data is kept for as long as necessary.
Rights requests. Section 12 is replaced. It now states two ways to make a request, an acknowledgment within ten business days, a substantive response within forty-five days, the use of an authorized agent, when BoRo may decline, and what to do if you are dissatisfied.
Timing of review. New Section 6.11 states that human review and action upon a report occur during Support Hours, being 8:00 a.m. to 10:00 p.m. Eastern Time, seven days a week.
Automated processing. Section 10 now points to the right to respond to a Strike under Section 15.10 of the Terms of Service.
Security. Section 13 now describes the measures in place and states that BoRo will notify you of a breach affecting your Personal Data.
Incentives. Section 15 now states that referral incentives are offered for referring a User and not in exchange for Personal Data.
Cross-references. References to the Terms of Service are updated to the numbering of Terms of Service Version 3.1.
1Scope; Role of the Company
This Privacy Policy (this “Policy”) describes how Aston Ventures Inc., a Delaware corporation doing business as BoRo USA (“BoRo,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, retains, and otherwise processes Personal Data in connection with the BoRo mobile applications, websites, and related services (the “Services”). This Policy forms part of, and is incorporated by reference into, the BoRo USA Terms of Service. Capitalized terms not defined here have the meanings given to them in the Terms of Service.
BoRo acts as a business, and as a data controller where that concept applies, with respect to Personal Data processed in connection with the Services. This Policy does not apply to (a) third-party websites, applications, or services accessible through the Services; (b) independent third-party payment processors, identity verification providers, or analytics providers acting on their own account; or (c) offline activities unrelated to the Services.
2Where the Services Are Offered
The Services are offered only in the United States. They are not directed to, and are not offered to, individuals located in the European Economic Area, the United Kingdom, or Switzerland, and BoRo does not monitor the behaviour of individuals in those territories.
This Policy is intended to address obligations arising under applicable United States federal and State privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). Nothing in this Policy creates rights or obligations beyond those required by applicable law.
BoRo operates within the Launch Area described in the Terms of Service. Where BoRo extends the Services beyond the United States, this Policy will be revised before it does so.
3Age Restriction; Data of Minors
3.1 Eighteen Years or Older
The Services are restricted to individuals aged eighteen (18) years or older, as provided in Section 3.1 of the Terms of Service. The Services are not directed to, designed for, or offered to any person under the age of eighteen (18).
3.2 No Access by Minors; No Consent Mechanism
No person under the age of eighteen (18) may access or use the Services, whether independently, under the supervision of a parent or legal guardian, through an account held by another person, or upon any other footing. BoRo offers no parental or guardian consent mechanism, and no such consent renders a minor eligible.
3.3 No Knowing Collection; Deletion
BoRo does not knowingly collect Personal Data from any person under the age of eighteen (18). Where BoRo becomes aware, by any means including a statement made in Platform communications, that a User is under the age of eighteen (18), BoRo will terminate that account and delete the associated Personal Data, save where retention is required by law or is necessary to establish, exercise, or defend legal claims.
Because the Services are not directed to children and BoRo does not knowingly collect Personal Data from any person under eighteen (18), BoRo does not process Personal Data on the basis of verifiable parental consent under the Children’s Online Privacy Protection Act. Personal Data of any minor identified through the Services is not sold, is not shared, and is not used for targeted advertising at any time.
4Categories of Personal Data Processed
Subject to applicable law, BoRo may process the following categories of Personal Data.
| Identifiers and contact information | Name, electronic mail address, telephone number including mobile telephone number, postal or exchange location, and account credentials. |
| Account and profile information | Profile images, preferences, account settings, Founding Member place, and the ratings, reviews, and completion measure published upon a profile. |
| Transactional and commercial information | Listings, pricing, availability, rental lifecycle events, transaction metadata, declared Item Values, and dispute records. |
| Media and evidence | Photographs and video captured for listing, verification, inspection, condition assessment, or dispute resolution. Media captured through the Services is recorded together with the time of capture and the location at which it was captured, and that location is used as described in Section 7. |
| Payment-related metadata | Card type, last four digits, authorization and capture outcomes, payout status, and related records. Full payment card numbers and card verification values are processed by the Payment Providers and are not stored by BoRo. |
| Identity verification information | Government-issued identification images and verification outcomes, processed by BoRo’s third-party verification provider. BoRo receives the outcome of verification and does not retain biometric templates. |
| Geolocation data | Collected on a permission-based basis for safety, verification, evidentiary, and enforcement purposes, including establishing that two Users were present at an agreed exchange location and determining whether photographic evidence was captured there. |
| Device, network, and technical data | Internet protocol address, device identifiers, operating system, application version, logs, and diagnostics. |
| Usage and interaction data | Timestamps, feature usage, audit logs, and engagement metrics. |
| Communications data | In-application messages, SMS and text messages, attachments, timestamps, and delivery indicators. |
BoRo collects this data from you directly, from your device, from the other party to a booking, and from its verification and payment providers.
5Purposes of Processing
BoRo processes Personal Data in order to provide and operate the Services; verify identity and eligibility, including age eligibility; process transactions and authorization holds; establish the presence of Users at an agreed exchange location; establish the condition of an Item at handover and at return; deliver text messages and account communications you have consented to receive; enforce marketplace and rental lifecycle rules; detect, prevent, and investigate fraud or abuse; resolve disputes, claims, and safety incidents; provide customer support; improve, secure, and maintain the Services; and comply with legal and regulatory obligations.
BoRo does not use Personal Data for advertising, marketing profiling, or cross-context behavioural advertising.
6Communications Screening and Content Review
6.1 Communications Subject to Review
BoRo may review communications data transmitted through the Services, including the content of in-application messages between Users, attachments, images, timestamps, delivery indicators, and associated metadata. BoRo does not review the content of communications occurring outside the Services, including telephone calls, personal text messages sent outside the Services, and messages sent through third-party applications.
6.2 Automated Screening
BoRo uses automated systems to screen communications data for indicators of fraud, prohibited conduct, prohibited items, off-platform payment solicitation, ineligibility by age, the disclosure of contact details, and risk to User safety. Automated screening may operate before a message is delivered, at the time of delivery, or after delivery. Where screening operates before delivery, a message may be delayed, withheld, or prevented from being delivered.
6.3 Contact Details in Messages
BoRo does not display your telephone number, your surname, or your payment details to another User. BoRo cannot prevent you from typing such information into a message yourself. Where automated screening identifies contact details or payment details within a message, BoRo may present a warning before that message is sent. Information you choose to place into a message is visible to the recipient.
6.4 Human Review
Authorized BoRo personnel may access and review communications data transmitted through the Services, including communications that have not been flagged by an automated system and have not been reported by a User, where such access is necessary for one or more of the purposes set out in Section 6.6. Access is limited to personnel with a role-based need to conduct it. BoRo does not access the content of communications for any purpose other than those set out in Section 6.6.
6.5 Access Logging
Each access to communications data by BoRo personnel is recorded in the Platform Records, including the identity of the person accessing, the time of access, the communications accessed, and the purpose relied upon.
6.6 Purposes of Communications Review
BoRo reviews communications data only in order to detect, prevent, and investigate fraud, scams, and abuse; enforce the Terms of Service, including the prohibited items and prohibited conduct provisions in Section 8 of those Terms; identify Users who are ineligible by reason of age; protect the safety of Users and Third Parties; investigate disputes, claims, and safety incidents; maintain the security and integrity of the Services; and comply with applicable law and lawful requests.
6.7 Actions BoRo May Take
Following automated or human review, BoRo may flag a communication, present a warning or notice to a User, delay or withhold delivery, block or remove a communication, restrict a feature, and take Enforcement Action under the Terms of Service. BoRo has no obligation to review any communication, and the exercise or non-exercise of the rights described in this Section creates no duty of care to any User or Third Party.
6.8 Purposes for Which Communications Are Not Used
BoRo does not use the content of communications for advertising, marketing, or promotional targeting; does not sell the content of communications; does not share the content of communications with third parties or affiliates for their own marketing purposes; and does not use the content of communications to build advertising profiles or to engage in cross-context behavioural advertising.
6.9 Sensitive Personal Information; Right to Limit
Under the CCPA, the contents of a consumer’s messages may constitute Sensitive Personal Information where the business is not the intended recipient. BoRo processes the content of in-application communications solely for the purposes set out in Section 6.6, each of which is a purpose for which the right to limit the use of Sensitive Personal Information does not apply, including detecting security incidents, resisting malicious, deceptive, fraudulent, or illegal actions, and ensuring the physical safety of natural persons. BoRo does not use or disclose the content of communications to infer characteristics about any consumer.
6.10 Indications of Ineligibility by Age
Screening includes the identification of indications that a User is under the age of eighteen (18). Where such an indication is identified, BoRo may review the account, may require re-verification under Section 3.4 of the Terms of Service, and may terminate the account and delete the associated Personal Data in accordance with Section 3.3 of this Policy.
6.11 Timing of Review
Automated screening operates continuously. Human review, and any action arising from a report made by a User, is carried out during Support Hours as defined in the Terms of Service, being 8:00 a.m. to 10:00 p.m. Eastern Time, seven days a week.
6.12 Relationship to the Terms of Service
This Section supplies the description referred to in Section 14 of the Terms of Service. This Policy governs the description of BoRo’s data practices; the Terms of Service govern the contractual rights of the parties.
7Location Data in Condition Evidence
Photographs and video captured through the Services in connection with an exchange are recorded together with the time and the location of capture. That location is compared against the exchange location agreed between the Users, and determines whether the evidence may be relied upon in a condition assessment.
Evidence as to the appearance of an Item is admissible only where it was captured at the agreed exchange location while both Users were present, which the Services establish by comparing the location recorded with the photograph against the Exchange Point, and by confirming that the other party’s device is also recorded within the Exchange Point at the time the report is submitted. Evidence of a functional failure is admissible irrespective of the location of capture.
The effect of this rule is that a User cannot make a claim as to the appearance of an Item after the parties have separated, and the location record is the means by which that is determined.
Location data collected for this purpose is used for the evidentiary and enforcement purposes described in Section 5, is not used for advertising or profiling, and is not sold or shared. Location permission is requested at registration and may be withdrawn at any time through device settings. The transactional functions of the Services cannot operate without it, as described in Section 3.7 of the Terms of Service.
8What Other Users See
The Services connect you with another person in order to complete an exchange. Some of your Personal Data is therefore disclosed to that person, and some is displayed publicly upon your profile.
8.1 Disclosed to the Other Party to a Booking
| Shown | Your first name; your profile photograph; your ratings, reviews, and completion measure; your Platform communications with that person; the photographs you capture in connection with the exchange; and confirmation that you are within the Exchange Point at the relevant time. |
| Shown only if you choose it | The address of an exchange location you propose or accept. Where you propose your own home as the exchange location, that address is disclosed to the other party, and the Services display a notice to that effect before the address is shared. |
| Not shown | Your telephone number, your surname, your exact home address unless you have proposed it as an exchange location, your payment details, your identification documents, and the outcome details of your identity verification. |
8.2 Displayed Publicly Upon Your Profile
Your first name, your profile photograph, your ratings and the reviews written about you, your reply to any review, your completion measure, and any Founding Member badge are displayed upon your public profile and are visible to any User of the Services.
9Disclosure of Personal Data
BoRo discloses Personal Data only as necessary and proportionate, and only to the following categories of recipient.
| Other Users | As described in Section 8. |
| Payment providers | Stripe, Inc. and associated financial institutions, in order to process authorizations, captures, and payouts. Stripe holds any balance owed to you and processes your payout details. Stripe’s handling of your data is governed by Stripe’s own privacy policy. |
| Identity verification providers | In order to verify your identity and confirm your age. |
| Cloud infrastructure and hosting providers | In order to operate and secure the Services. |
| Analytics and messaging providers | Including BoRo’s application-to-person text-messaging vendor. |
| Insurance, claims, and risk partners | In connection with the assessment of claims and risk. |
| Professional advisers and support vendors | Including legal, accounting, and customer support providers. |
All such disclosures are subject to contractual confidentiality and data protection obligations.
BoRo may also disclose Personal Data, including communications data, (a) to comply with applicable law, legal process, subpoena, court order, or a lawful request by a governmental or regulatory authority; (b) to law enforcement, where BoRo reasonably believes disclosure is necessary to investigate, prevent, or take action regarding suspected fraud, a suspected crime, or a violation of the Terms of Service; (c) where BoRo reasonably believes disclosure is necessary to prevent or address an emergency involving a risk of death or serious physical injury to any person; and (d) to establish, exercise, or defend legal claims. Where permitted by law and consistent with the safety of any person, BoRo will make reasonable efforts to notify the affected individual.
BORO DOES NOT SELL PERSONAL DATA AND DOES NOT SHARE PERSONAL DATA FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING. BORO DOES NOT SELL, RENT, OR SHARE MOBILE TELEPHONE NUMBERS OR SMS CONSENT WITH THIRD PARTIES OR AFFILIATES FOR THEIR OWN MARKETING OR PROMOTIONAL PURPOSES.
10Automated Processing
BoRo uses automated systems, including algorithms, in connection with search ranking, recommendations, pricing guidance, communications screening, risk scoring, and trust and safety assessments, as described in Section 15 of the Terms of Service. Where an automated system contributes to an Enforcement Action, a person may review that action upon request made through the Platform, and Section 15.10 of the Terms of Service provides a right to respond to a Strike.
11Data Retention
BoRo retains Personal Data only for so long as reasonably necessary for the purposes described in this Policy. The periods below state how long each category is ordinarily retained. Where a longer period is required by law, or is necessary to establish, exercise, or defend a legal claim, the longer period applies.
| Account and profile information | For the life of the account, and for twenty-four (24) months following closure. |
| Identity verification outcomes | For the life of the account, and for five (5) years following closure, in order to prevent a terminated User from re-registering. |
| Transaction records and payment metadata | Seven (7) years, in order to meet accounting and tax obligations. |
| Condition evidence, and the location and timestamp records associated with it | Three (3) years from the conclusion of the Rental Transaction. |
| Communications data | Twenty-four (24) months, save that communications flagged, reported, reviewed, blocked, or relied upon in an Enforcement Action, and the access logs kept under Section 6.5, are retained for five (5) years. |
| Geolocation records | Twenty-four (24) months. |
| Device, network, and technical data | Twelve (12) months. |
| Ratings and reviews | For so long as the profile they concern remains active, and are removed upon account closure. |
| Records of disposal under Section 10A of the Terms of Service | Three (3) years, as required by that Section. |
12Your Rights and How to Exercise Them
12.1 Your Rights
Subject to applicable law and to verification of your identity, you may request access to the Personal Data BoRo holds about you; correction of Personal Data that is inaccurate; deletion of your Personal Data; a portable copy of the Personal Data you provided; and information about the categories of Personal Data
collected, the purposes for which it is used, and the categories of recipient to whom it is disclosed. You may also opt out of promotional messages at any time.
BoRo does not sell Personal Data and does not share it for cross-context behavioural advertising, so no opt-out of sale or sharing is required. As described in Section 6.9, the right to limit the use of Sensitive Personal Information does not apply to the purposes for which BoRo processes message content.
12.2 How to Make a Request
Submit a request by electronic mail to [email protected], or through the account settings feature within the BoRo application. Either method is sufficient. State the right you wish to exercise and the electronic mail address associated with your account.
12.3 How BoRo Responds
BoRo will acknowledge your request within ten (10) business days and will respond substantively within forty-five (45) calendar days. Where the request is complex, BoRo may extend that period by a further forty-five (45) calendar days and will tell you before doing so, and why.
Before acting upon a request, BoRo will take reasonable steps to verify that the request comes from you. Where BoRo cannot verify your identity, it will tell you and will not act upon the request.
12.4 An Authorized Agent
You may use an authorized agent to make a request on your behalf. BoRo may require written proof of the agent’s authority and may require you to verify your own identity directly.
12.5 Where BoRo May Decline
BoRo may decline or limit a request where permitted by law, including where retention is necessary to complete a transaction, to detect or prevent fraud, to comply with a legal obligation, or to establish, exercise, or defend a legal claim. Where BoRo declines, it will tell you why.
12.6 If You Are Not Satisfied
If you are not satisfied with BoRo’s response, you may write to [email protected] stating why, and BoRo will review the matter. You retain any right you may have to complain to a State regulator.
12.7 No Discrimination
BoRo will not deny you the Services, charge you a different price, or provide you a different level of service because you have exercised a privacy right.
13Security
BoRo maintains administrative, technical, and organizational measures designed to protect Personal Data, including encryption in transit, access controls limiting staff access to a role-based need, and logging of access to communications data. No system can be guaranteed to be completely secure, and BoRo disclaims any such guarantee to the maximum extent permitted by law.
Where a breach of security affecting your Personal Data occurs, BoRo will notify you and any regulator to the extent and within the time required by applicable law.
14Cookies and Tracking Technologies
BoRo and its service providers use cookies, software development kits, pixels, and similar technologies to operate, secure, and analyze the Services. BoRo does not use these technologies for cross-context
behavioural advertising. You may control certain tracking technologies through your browser or device settings. Where required by applicable law, BoRo will obtain consent before deploying non-essential tracking technologies.
15Incentives
BoRo may offer referral credits or promotional incentives, including through the BoRo Eko referral program described in Section 12 of the Terms of Service. Participation is voluntary. These incentives are offered in exchange for referring another User and are not offered in exchange for Personal Data, and no financial incentive is offered for the collection, sale, or retention of Personal Data.
16SMS and Text Messaging Privacy
16.1 Collection and Use
If you provide your mobile telephone number and consent to receive text messages, BoRo collects and processes your mobile number and messaging consent solely to operate its application-to-person text messaging program, which may include one-time verification codes, account and transaction notifications, rental confirmations and reminders, referral program updates, customer-care communications, and periodic promotional messages.
16.2 No Sale or Sharing for Third-Party Marketing
BoRo does not sell, rent, or share mobile telephone numbers, text-messaging opt-in data, or SMS consent with third parties or affiliates for their own marketing or promotional purposes. No mobile information obtained through the SMS opt-in process is shared with third parties or affiliates for marketing purposes. Mobile information is shared only with BoRo’s messaging service providers strictly as necessary to transmit messages you have consented to receive, and as otherwise required to comply with applicable law.
16.3 Frequency, Rates, and Opt-Out
Message frequency varies and depends upon your activity. Message and data rates may apply in accordance with the rate plan you maintain with your wireless carrier, and you are solely responsible for those charges. You may opt out at any time by replying STOP, after which BoRo will cease sending promotional and non-essential messages to that number. You may request assistance by replying HELP or by contacting [email protected]. BoRo may continue to send transactional, security, or account-related messages to the extent necessary to complete pending Rental Transactions, protect account security, or comply with applicable law. Your use of the messaging program is also governed by Section 14A of the Terms of Service.
17Changes to This Policy
BoRo may modify this Policy from time to time. Every published version bears a version number and an effective date. Where a change is material, BoRo will provide notice by posting the updated Policy upon the Platform, by electronic mail to your registered address, or by in-application notification, at least thirty (30) days before the change takes effect. Your continued use of the Services following the effective date constitutes acceptance of the revised Policy.
18Contact Information
Privacy inquiries and rights requests: [email protected].
Security issues: [email protected].
General support: [email protected], available 8:00 a.m. to 10:00 p.m. Eastern Time, seven days a week.
Postal address: Aston Ventures Inc., a Delaware corporation, d/b/a BoRo USA, 8 The Green, Ste. 23301, Dover, DE 19901, Attn: Privacy.