1. Who We Are
This Privacy Policy is issued by Vesta Hearth Inc., a Delaware corporation, operating through its New York-licensed operating entity Vesta Hearth NYC, doing business as Storage Buddy (“Storage Buddy,” “we,” “us,” or “our”). Storage Buddy is a peer-to-peer storage marketplace that connects verified Hosts with verified Renters.
This Policy explains what personal information we collect about you, why we collect it, how we use and share it, how long we keep it, and what rights you have in relation to it. It applies to all interactions with Storage Buddy including through our website (storagebuddyco.com), our mobile applications, and any related services.
By using the Storage Buddy platform you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use the platform.
Legal entity: Vesta Hearth Inc. (Delaware C-Corp)
Operating entity: Vesta Hearth NYC
Brand name: Storage Buddy
Privacy contact: support@storagebuddyco.com
General contact: support@storagebuddyco.com
Website: www.storagebuddyco.com
2. Information We Collect
The personal information we collect depends on how you interact with our platform. We collect information in three ways: directly from you, automatically through your use of the platform, and in limited cases from third-party sources.
2.1 Information You Provide Directly
Account and Identity Information
- Full name (first and last)
- Email address (including your institutional .edu address used for student verification)
- Date of birth (to verify you are 18 or older)
- Password (stored in hashed, encrypted form — we never store your password in plain text)
- Profile photo (optional, but recommended to build trust with other users)
Student Verification Information
Because Storage Buddy is a verified-member platform, we collect proof of eligibility. Verification is currently performed by matching your email address against a list of recognized institutional email domains maintained by Storage Buddy. This confirms that you hold an active email address at a participating institution; it does not verify current enrollment status. Storage Buddy reserves the right, at its sole discretion, to admit users with non-.edu email addresses where alternative proof of eligibility is established.
NOTE: Verification data is used solely to confirm your eligibility to use the platform. Your email address is not shared with other users, Hosts, or Renters for verification purposes. These records are retained only for as long as necessary to maintain your verified status.
Listing and Booking Information
- Storage Space description, dimensions, location, availability dates, and pricing (Hosts)
- Description of items to be stored and storage requirements (Renters)
- Start Date, booking duration, and access preferences
- Photographs of the Storage Space (Hosts) or Stored Items (Renters, where uploaded for dispute purposes)
Payment and Financial Information
All payment processing is handled by Stripe, Inc. We do not store your full payment card details on our servers. When you make or receive a payment through Storage Buddy, we collect:
- Your name and billing address (as provided to Stripe)
- The last four digits of your payment card and card type (provided back to us by Stripe for display purposes)
- Bank account details (last four digits, bank name, routing number) if you connect a bank account for Host payouts via Stripe
- Transaction history — amounts, dates, booking references, and payment status
Hosts who receive payouts through the platform are onboarded via Stripe Connect, Stripe's platform for marketplace payouts. As part of Stripe Connect onboarding, Stripe collects identity and financial information directly from Hosts — including legal name, date of birth, address, Social Security Number or Tax ID (for US persons), and bank account details — to satisfy Know Your Customer (KYC) and anti-money-laundering (AML) obligations. This information is collected and held by Stripe under Stripe's own Privacy Policy and Terms of Service. Storage Buddy receives only limited confirmation data from Stripe (such as verification status and payout eligibility) and does not store your full identity or tax documentation on its own servers. If you are a Host, you are also a direct customer of Stripe and should review Stripe's Privacy Policy at stripe.com/privacy.
Stripe's collection and use of your payment data is governed by Stripe's own Privacy Policy, available at stripe.com/privacy. We encourage you to read it.
Communications
- Messages exchanged between Hosts and Renters through the in-app messaging system
- Support requests and correspondence with the Storage Buddy team
- Dispute submissions, including written descriptions, photographs, and supporting documents
- Reviews submitted about other users following a completed booking
NOTE: In-app messages between Hosts and Renters may be reviewed by Storage Buddy Admin staff for the purposes of dispute resolution, safety investigations, or platform integrity. Users should be aware that messages are not private from Storage Buddy.
Voluntary Information
- Any additional information you choose to include in your profile or listings
- Feedback and survey responses
2.2 Information Collected Automatically
When you access or use the Storage Buddy platform, we and our service providers automatically collect certain technical information:
Device and Technical Data
- Browser type, version, and language settings
- Operating system type and version
- Device type (phone, tablet, desktop) and screen resolution
- IP address and general location derived from it (city/region level — not precise GPS location unless you grant specific permission)
- Unique device identifiers
Usage Data
- Pages and screens viewed, and time spent on each
- Search terms entered on the platform
- Navigation paths and click patterns
- Links clicked within emails we send you (to measure delivery and open rates)
- Crash logs and diagnostic data
Cookies and Similar Technologies
We use the following technologies to collect usage data and support platform functionality:
- Cookies: Small text files stored on your device that help us keep you logged in, remember your preferences, and understand how you use the platform. You can control cookies through your browser settings, though disabling them may affect platform functionality.
- Email open tracking: Our transactional email provider (Resend) may use standard email tracking to record whether emails we send you are opened and whether links within them are clicked. This helps us confirm delivery of important notifications such as booking confirmations and renewal reminders. No third-party session replay tools, tracking pixels embedded in web pages, or product analytics SDKs are currently in use on the Storage Buddy platform.
2.3 Information from Third-Party Sources
We may receive information about you from third parties in limited circumstances:
- From Stripe, confirmation of payment processing outcomes and payout status
- From our student verification service provider (where applicable), confirmation of enrollment status
- From social media platforms if you choose to link your account or log in via a third-party service
3. How We Use Your Information
We use the personal information we collect for the following purposes. We will only use your information in ways that are consistent with the reason it was collected.
3.1 Providing the Platform and Services
- Creating and managing your Storage Buddy account
- Verifying your eligibility and maintaining your verified status over time
- Matching Renters with suitable Host listings
- Facilitating Bookings, including sharing necessary contact and location information between Hosts and Renters upon booking confirmation
- Processing payments and issuing Host payouts via Stripe
- Sending transactional notifications about your bookings, including booking confirmations, renewal reminders (7 days and 72 hours before each Renewal Date), payment receipts, and cancellation confirmations
- Administering the dispute resolution process, including reviewing evidence submitted by both parties
- Enforcing our Terms of Service and Platform Protocols
3.2 Safety and Platform Integrity
- Verifying the identity and eligibility of all users
- Detecting, investigating, and preventing fraudulent, abusive, or illegal activity on the platform
- Reviewing in-app communications where reasonably necessary to investigate a dispute, safety concern, or alleged violation of our Terms
- Maintaining records necessary to enforce our contractual lien rights and abandoned property process in the event of non-payment
3.3 Improving the Platform
- Analysing usage patterns to understand how the platform is used and where improvements can be made
- Conducting internal research and product development
- Creating aggregated, anonymized or de-identified data sets that cannot be used to identify individual users, which we may use or share for business and research purposes
3.4 Communications
- Sending you service-related communications that are necessary to your use of the platform (these cannot be opted out of while your account is active)
- Sending you optional marketing or promotional communications about Storage Buddy features, updates, or offers — you can opt out of these at any time
- Responding to your support requests and dispute submissions
3.5 Legal and Compliance Purposes
- Complying with applicable laws, regulations, and legal obligations
- Responding to lawful requests from government authorities, courts, or law enforcement
- Protecting our legal rights and those of our users
- Maintaining records required by law (including financial and tax records)
4. How We Share Your Information
We do not sell your personal information. We share your personal information only in the circumstances described below.
4.1 With Other Users (Hosts and Renters)
Sharing information between Hosts and Renters is necessary to operate the platform. We share information as follows:
Before booking confirmed: No personal contact information is shared. Renters see Host listing details (space description, general area, availability, pricing). Hosts see Renter's first name, profile photo, and items to be stored.
When booking is confirmed: Host's full address is shared with Renter. Both parties receive each other's first and last name, profile photo, and in-app contact details.
During active booking: In-app messaging allows direct communication. No additional personal information is shared beyond what was shared at confirmation.
For dispute resolution: Where a dispute arises, relevant communications, evidence (photos, descriptions), and booking details may be shared with the other party and reviewed by Storage Buddy Admin staff.
Public profile / listing: Hosts' first name, first initial of surname, profile photo, listing photos, space description, general neighborhood, and rating are publicly visible to all platform users.
4.2 With Service Providers
We use third-party companies to help us operate the platform. These providers access your information only to perform services on our behalf and are contractually obligated to protect it and use it only for the specified purpose. Our current key service providers include:
Stripe: Payment processing and Host payout disbursement. Stripe's privacy policy: stripe.com/privacy
Cloud hosting provider: Vercel (application hosting) and Supabase (database and authentication). Stores platform data and infrastructure.
Email service provider: Resend. Sends transactional and notification emails. Resend's privacy policy: resend.com/legal/privacy-policy
Analytics provider: Not currently in use. Storage Buddy does not currently employ a third-party product analytics provider. Usage data is collected internally for platform diagnostics only.
Student verification: Internal. Student eligibility is verified by matching institutional email domains against a curated list of participating universities. No third-party verification service is used. Verification confirms domain ownership only, not current enrollment status.
Customer support tool: Not currently in use. Support requests are handled via a contact form and email. No third-party ticketing or live chat tool is currently deployed.
Mapbox: Interactive maps on the browse and listing pages. Receives approximate location data for map rendering. Mapbox's privacy policy: mapbox.com/legal/privacy
Google Maps API: Geocoding fallback service used to convert addresses into map coordinates. Google's privacy policy: policies.google.com/privacy
4.3 With Professional Advisors
We may share your information with our lawyers, accountants, auditors, and insurers where necessary in the course of the professional services they provide to us.
4.4 For Legal and Safety Reasons
We may disclose your personal information to law enforcement, government authorities, courts, or other third parties where we believe in good faith that disclosure is necessary to: (i) comply with a legal obligation or lawful request; (ii) protect the safety of any person; (iii) protect our rights or property or those of our users; or (iv) investigate fraud, abuse, or illegal activity on the platform.
4.5 In Connection with a Business Transfer
If Vesta Hearth Inc. is involved in a merger, acquisition, sale of assets, financing, or other business transaction, your personal information may be transferred to the successor entity as part of that transaction. We will notify you of any such transfer and any choices you may have in relation to your information by updating this Privacy Policy.
4.6 Aggregated or De-Identified Data
We may share aggregated or de-identified data — data that cannot reasonably be used to identify you — with partners, researchers, or for promotional purposes. For example, we may publish that “Storage Buddy facilitated over 500 student storage matches at Columbia last summer.”
5. Data Retention
We retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention guidelines apply:
Account data: Retained while your account is active. Upon a verified deletion request, your account will be deactivated within 30 days. Personal data will be permanently deleted at the end of the applicable retention period, subject to the exceptions below.
Booking and payment records: Retained for a minimum of 7 years from the date of the transaction to comply with financial and tax record-keeping requirements.
Dispute records: Retained for a minimum of 3 years from the date of resolution, to support any subsequent legal claims or arbitration proceedings.
Abandoned property records: Retained for a minimum of 3 years from the date of disposal, as required by applicable state law.
Student verification docs: Retained while your account is active and for 1 year following account closure. Deleted upon expiry unless legal hold applies.
Communications / messages: Retained for the duration of the relevant booking plus 1 year, or for the duration of any open dispute plus 1 year after resolution.
Usage and analytics data: Retained in aggregated or anonymized form indefinitely. Individual-level usage data retained for up to 2 years.
Legal hold: Where data is subject to a legal hold (e.g. pending litigation or regulatory inquiry), it will be retained until the hold is lifted regardless of the above schedules.
6. Data Security
We implement technical, organizational, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, loss, or destruction. These measures include:
- Encryption of data in transit using TLS/HTTPS
- Encryption of stored passwords using industry-standard hashing
- Access controls limiting which Storage Buddy staff can access personal data, on a need-to-know basis
- Periodic security reviews of our infrastructure and third-party service providers
- Secure payment processing through Stripe — full payment card details are never stored on Storage Buddy servers
- A designated internal coordinator responsible for overseeing Storage Buddy's data security program and serving as the point of contact for security incidents and regulatory notifications
- Employee and contractor training on data security practices and procedures, conducted at onboarding and periodically thereafter
- Executed Data Processing Agreements with all third-party service providers who receive personal data, requiring them to maintain appropriate security safeguards and restricting their use of personal data to the purposes for which it was shared
- Timely and secure disposal of personal data that is no longer needed for legitimate business purposes
However, no method of transmission over the internet or electronic storage is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of your information. In the event of a data breach that is likely to affect your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.
Data Breach Response Procedure
In the event of a confirmed or suspected breach of personal information, Storage Buddy will follow the steps below. This procedure is designed to meet the requirements of the New York SHIELD Act, the California Consumer Privacy Act (CCPA/CPRA), and applicable state breach notification laws.
Step 1 — Contain (0–24 hours). Upon discovery of a suspected breach, the responsible team member will immediately notify Storage Buddy's designated incident lead. Access to affected systems will be suspended or restricted as technically feasible. Evidence will be preserved without alteration. An internal incident log will be opened and timestamped.
Step 2 — Assess (24–72 hours). The incident lead will determine: (i) whether a breach has occurred or is reasonably likely; (ii) what categories of personal information were affected and how many individuals are impacted; (iii) whether the information was encrypted or otherwise rendered unreadable; and (iv) the likely cause and scope of the incident. Legal counsel will be engaged at this stage.
Step 3 — Notify regulators. Where required by applicable law, Storage Buddy will notify the relevant state attorney general or regulatory authority within the legally mandated timeframe. Under the New York SHIELD Act (as amended December 2024), Storage Buddy must: (i) notify affected New York residents within 30 days of discovery of the breach; (ii) notify the New York Attorney General, the New York Department of State, the New York State Police, and the New York State Department of Financial Services, providing the timing, content, and distribution of notices and the approximate number of affected persons. Under the CCPA, notification to the California Attorney General may be required for breaches affecting 500 or more California residents. Notifications will be made as promptly as possible and in no event later than applicable legal deadlines.
Step 4 — Notify affected users. Storage Buddy will notify affected users in the most expedient time possible and without unreasonable delay, and in any event within the timeframe required by applicable law. Notice will be provided by email to the address on file and will include: a description of what happened; the categories of personal information involved; steps Storage Buddy has taken to address the breach; steps users can take to protect themselves; and contact information for further inquiries. Where law enforcement determines that notification would impede a criminal investigation, notification may be delayed accordingly.
Step 5 — Remediate and review. Following containment and notification, Storage Buddy will conduct a post-incident review to identify root cause, implement technical and organizational controls to prevent recurrence, and update internal security documentation accordingly. A written record of the incident, response actions, and outcomes will be retained for a minimum of 3 years.
7. Your Rights and Choices
Depending on where you are located, you may have certain rights in relation to your personal information. We are committed to honoring these rights. To exercise any of the rights described below, please contact us at support@storagebuddyco.com.
7.1 Rights Available to All Users
Access: You can request a copy of the personal information we hold about you. To submit an access request, email support@storagebuddyco.com with the subject line “Data Access Request.” We will compile and provide your information manually within 30 days (45 days for California residents).
Correction: You can ask us to correct inaccurate or incomplete information. You can also update most account information directly in your account settings.
Deletion: You can ask us to delete your personal information. Upon receiving a verified request, we will deactivate your account within 30 days and permanently delete your personal data at the end of the applicable retention period set out in Section 5. To submit a deletion request, email support@storagebuddyco.com with the subject line “Account Deletion Request.” California residents: we will respond within 45 days as required by the CCPA.
Portability: You can request a copy of your personal information in a structured, readable format. To do so, email support@storagebuddyco.com with the subject line “Data Portability Request.” We will compile and send your information within 30 days.
Objection: You can object to certain uses of your information, including marketing communications.
Opt-out: You can opt out of marketing emails at any time using the unsubscribe link in any marketing email, or by contacting us. You will continue to receive transactional and service-related notifications.
7.2 Account Deletion
To request deletion of your Storage Buddy account and associated personal data, email support@storagebuddyco.com with the subject line “Account Deletion Request.” We will acknowledge your request within 10 business days and deactivate your account within 30 days of verification. Your personal data will then be permanently deleted at the end of the applicable retention period set out in Section 5. Please note:
- We cannot delete your account while you have an active Booking. You must cancel all active Bookings before requesting deletion.
- Financial and transaction records related to completed Bookings will be retained as described in Section 5, even after account deletion.
- Dispute and legal records will be retained as described in Section 5.
7.3 Marketing Communications
We may send you optional marketing emails about Storage Buddy features, promotions, and updates. You can opt out of these at any time by clicking the “Unsubscribe” link in any marketing email or by contacting us at support@storagebuddyco.com. Opting out of marketing does not affect your receipt of transactional emails (booking confirmations, payment receipts, renewal reminders, dispute notifications, etc.) which are necessary to your use of the platform.
7.4 Cookies
You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the platform, including keeping you logged in. For more information about cookies, visit www.allaboutcookies.org.
8. State Privacy Rights
The following additional rights apply to residents of specific U.S. states under applicable state privacy laws. If you are a resident of one of the states listed below, the rights described here apply to you in addition to the rights in Section 7.
8.1 California Residents — CCPA / CPRA
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the following additional rights:
- Right to Know: You can request information about the categories of personal information we have collected about you, the sources from which we collected it, the business purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of personal information we hold about you.
- Right to Delete: You can request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to Correct: You can ask us to correct inaccurate personal information.
- Right to Opt-Out: You can opt out of the “sale” or “sharing” of your personal information. Storage Buddy does not sell personal information. We do not currently share personal information for cross-context behavioral advertising, but if we introduce such practices in future we will update this Policy and provide an opt-out mechanism.
- Right to Limit Use: You can request that we limit our use of sensitive personal information to purposes necessary to provide the platform.
- Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
- Authorized Agent: You may designate an authorized agent to submit requests on your behalf. We will require verification of the agent's authority.
To submit a CCPA request, contact us at support@storagebuddyco.com with the subject line “California Privacy Request.” We will respond within 45 days. We may need to verify your identity before processing your request.
Categories of Personal Information Collected (CCPA Summary)
Identifiers: Name, email, IP address, device IDs, institutional ID / UNI (where applicable). Shared with: Stripe (payment), Vercel and Supabase (hosting/infrastructure), other users (name/photo only).
Customer Records: Name, email, payment card last four digits, bank account details (for Host payouts). Shared with: Stripe.
Commercial Information: Booking history, payment history, transaction records. Shared with: Stripe, internal use only.
Internet / Network Activity: Usage data, pages viewed, device data, IP address. Shared with: Vercel and Supabase (hosting/infrastructure). No third-party analytics provider currently in use.
Geolocation (general): City/region derived from IP address. Not precise GPS. Shared with: Vercel and Supabase (hosting/infrastructure), Mapbox and Google Maps API (for mapping and geocoding features).
Communications Content: In-app messages, support correspondence, dispute submissions. Shared with: internal Admin only, and with counterpart user where relevant to a dispute.
Sensitive: Credentials: Account password (hashed). Shared with: no third parties.
Sensitive: Institutional ID / UNI: For eligibility verification purposes only (email domain matching against participating university list). Handled internally — not shared with any third-party verification provider.
Sensitive: Payment Card Data: Processed and held by Stripe only. Not stored by Storage Buddy.
8.2 Virginia, Colorado, Connecticut, and Utah Residents
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have the following rights under their respective state privacy laws:
- Right to access personal data we hold about you
- Right to correct inaccurate personal data
- Right to delete personal data
- Right to data portability
- Right to opt out of targeted advertising, sale of personal data, and profiling for decisions with significant effects
Storage Buddy does not sell personal data or engage in profiling for decisions with significant legal or similarly significant effects. To exercise these rights, contact us at support@storagebuddyco.com.
8.3 Nevada Residents
Nevada residents may opt out of the sale of certain personal information under Nevada's privacy law. Storage Buddy does not sell personal information. If you have questions, contact us at support@storagebuddyco.com.
8.4 New York Residents — SHIELD Act
New York's SHIELD Act requires businesses that collect private information of New York residents to implement reasonable administrative, technical, and physical data security measures. Storage Buddy's security practices are described in Section 6. Under the December 2024 amendments to the SHIELD Act (effective March 21, 2025), in the event of a breach of private information of New York residents, Storage Buddy must notify affected residents within 30 days of discovery and must report to the New York Attorney General, the New York Department of State, the New York State Police, and the New York State Department of Financial Services. Our full breach response procedure is set out in Section 6.
9. Children's Privacy
The Storage Buddy platform is not intended for use by anyone under 18 years of age. All users must be at least 18 years old and meet Storage Buddy's membership eligibility requirements. We do not knowingly collect personal information from minors under 18.
If we become aware that we have collected personal information from a user under 18 without appropriate verification, we will take prompt steps to delete that information and close the account. If you are a parent or guardian and believe we may have collected information from a minor, please contact us at support@storagebuddyco.com.
10. Third-Party Links and Services
The Storage Buddy platform may contain links to third-party websites, mobile applications, or services. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third parties and encourage you to read their privacy policies before providing them with any personal information.
If you connect a third-party account (such as a social media profile) to your Storage Buddy account, that third party's privacy policy governs the information they collect and share with us. You can disconnect third-party accounts at any time through your account settings.
11. International Data Transfers
Storage Buddy is operated in the United States. If you are accessing the platform from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the “Last Updated” date at the top of this Policy
- Post the updated Policy on our website at storagebuddyco.com/privacy
- Notify registered users by email where the changes are material and likely to affect their rights
Your continued use of the Storage Buddy platform after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with any changes, you should stop using the platform and request deletion of your account as described in Section 7.2.
13. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
General support: support@storagebuddyco.com
Mailing address: Vesta Hearth Inc. (d/b/a Storage Buddy), c/o Vesta Hearth NYC, 155 Claremont Avenue, APT 910, New York, NY 10027
Response time: We aim to acknowledge all privacy requests within 10 business days. Deletion and access requests will be processed within 30 days of verification (45 days for CCPA requests). Data portability requests will be fulfilled within 30 days.