Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account Information: Email, display name, store name, industry, and role when you register.
• Conversation Content: Messages exchanged between you and your customers via connected channels.
• Channel Credentials: API keys and tokens for connected channels (e.g., Twilio). These are encrypted at rest using AES-256-GCM.
• Usage Data: Log data such as access times and pages viewed for service improvement.

2. How We Use Your Information

We use your information to:

• Provide and maintain the Service.
• Process subscription payments.
• Send review invitations on your behalf.
• Improve the Service through analytics and usage patterns.
• Communicate important updates about the Service.

3. Information Sharing & Third Parties

We do not sell your personal information. We share data only with service providers necessary to operate the platform (e.g., cloud hosting, payment processing, messaging providers like Twilio). All providers are contractually obligated to protect your data.

4. Data Security

We implement industry-standard security measures:

• Credentials Encryption: Channel credentials (API keys, tokens) are encrypted using AES-256-GCM before storage.
• Database Encryption: All data is stored in PostgreSQL with at-rest encryption provided by our hosting provider.
• Transport Security: All data in transit is encrypted via TLS 1.2+.
• Access Control: Role-based access control (admin/employee) limits data visibility within each store.

While we strive to protect your data, no method of electronic storage is 100% secure. We encourage you to use strong passwords and protect your account credentials.

5. CCPA Rights

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Access: Request a copy of the personal information we hold about you.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out of Sale: We do not sell personal information, so no opt-out is needed.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at the email address listed below. We will respond within 45 days of receiving a verifiable request.

6. STOP Opt-Out

Customers receiving commercial SMS messages through our Service can opt out at any time by replying "STOP" to any message. All outbound SMS messages automatically include an opt-out instruction ("Reply STOP to unsubscribe"). Opt-out preferences are recorded immediately and honored for all future communications.

7. Cookies & Local Storage

We use essential cookies and local storage to maintain your session and preferences. We do not use third-party advertising trackers. See our cookie preferences in your browser settings for more control.

8. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Continued use of the Service constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at privacy@ravelocal.io.