Privacy Policy

This Privacy Policy describes how RCOB ("we," "us," or "our") collects, uses, and protects information about you when you use the RCOB Customer Success Platform ("Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

We collect the following categories of information:

Account Information: Name, email address, password (hashed), and organizational details provided at registration or invite acceptance.

Customer Data: All data you input into the Service, including customer records, notes, health scores, tasks, support cases, sales pipeline data, and any other content you upload ("Customer Data"). You own this data.

Usage Data: Information about how you interact with the Service, including pages visited, features used, timestamps, and browser/device information collected automatically.

Communications: Any messages you send us directly, including support requests.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage your subscription
• Authenticate users and enforce security controls
• Send service-related communications (account notices, security alerts)
• Respond to support requests and inquiries
• Generate AI-powered insights from your Customer Data using the Gemini API
• Monitor for abuse, security incidents, and compliance with our Terms of Service
• Comply with legal obligations

We do not sell your personal information or Customer Data to third parties.

3. AI Processing of Your Data

The Service uses Google Gemini AI to generate health scores, portfolio insights, email drafts, and cross-sell recommendations from your Customer Data. This processing occurs server-side through Firebase Cloud Functions — your data is never sent to AI models directly from your browser.

AI-generated outputs are based solely on data you provide. We do not use your Customer Data to train AI models. However, use of the Gemini API is subject to Google's applicable terms and privacy policies, which we encourage you to review. We are not responsible for how Google processes data transmitted through the Gemini API.

4. Data Sharing and Disclosure

We do not share your information with third parties except in the following circumstances:

• Service Providers: We use Google Firebase (authentication, database, hosting) and Google Cloud (Cloud Functions, Secret Manager) to operate the Service. These providers process data on our behalf and are bound by their own privacy commitments.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of RCOB, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction with prior notice to you.
• With Your Consent: We will share information with third parties when you have given us explicit permission to do so.

5. Data Retention

We retain your account information and Customer Data for as long as your subscription is active. Upon termination of your account, we retain your data for 30 days to allow for recovery, after which it is permanently deleted from our systems. Some data may be retained longer where required by applicable law or for legitimate business purposes such as fraud prevention.

6. Data Security

We implement commercially reasonable technical and organizational security measures to protect your information, including encryption in transit (TLS), encryption at rest (managed by Google Firebase), role-based access controls, and server-side AI processing to protect sensitive keys.

HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT GUARANTEE ABSOLUTE SECURITY OF YOUR DATA. In the event of a data breach that affects your personal information, we will notify you as required by applicable law. We expressly disclaim liability for breaches caused by factors outside our reasonable control, including cyberattacks by third parties, vulnerabilities in third-party infrastructure, or your own failure to maintain secure credentials.

7. Third-Party Services

The Service relies on the following third-party platforms:

• Google Firebase — Authentication, Firestore database, and hosting
• Google Cloud — Cloud Functions, Secret Manager
• Google Gemini AI — AI processing of Customer Data

Each of these services has its own privacy policy and data practices. We are not responsible for the privacy practices of these third parties. By using the Service, you acknowledge that your data may be processed by these providers in accordance with their own terms.

8. Multi-Tenant Data Isolation

The Service is built on a multi-tenant architecture. Each customer organization ("tenant") has its own isolated data partition. Your data is logically separated from all other tenants through Firestore security rules and role-based access controls. No user from one tenant can access data belonging to another tenant.

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal obligations)
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your personal data

To exercise any of these rights, contact us at support@rcobsoftware.com. We will respond within 30 days. Note that some requests may be limited by our legal obligations or legitimate business interests.

10. Cookies and Tracking

The Service uses Firebase Authentication, which may store authentication tokens in your browser's local storage or IndexedDB to keep you signed in. We do not use advertising cookies or third-party tracking pixels. Usage data is collected to operate and improve the Service only.

11. Children's Privacy

The Service is not directed at children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us immediately and we will delete it.

12. Healthcare Data (HIPAA)

The Service is not currently HIPAA-compliant and is not intended for the storage or processing of Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act. Do not enter patient data, medical records, or any PHI into the Service unless a separate Business Associate Agreement (BAA) has been executed with RCOB. Use of the Service for PHI storage without a BAA is a violation of these Terms and applicable law.

13. International Data Transfers

The Service is hosted on Google Firebase infrastructure in the United States (us-central1). If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We make no representation that the Service is appropriate or available in locations outside the United States.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

RCOB Customer Success Platform
Email: support@rcobsoftware.com