Privacy Policy
- Who we are
- Information we collect
- How we use your information
- AI processing
- Who we share information with
- International transfers
- How long we keep information
- Security
- Your rights
- Cookies and similar technologies
- Marketing
- Children
- Changes to this policy
- Contact us
Your privacy matters to us. This policy explains what personal information RapidRCA collects when you use rapidrca.com and the RapidRCA service, why we collect it, how we use and protect it, and the choices and rights you have. It should be read with our Terms & Conditions.
1. Who we are
RapidRCA ("we", "us") is the controller of the personal information described in this policy. You can contact us at info@rapidrca.com.
2. Information we collect
| Information | Examples | Source |
|---|---|---|
| Account information | Name, email address, company, job title, phone number, country (from your phone code), account type, and your password in encrypted form | You, when you register |
| Content you submit | Descriptions of failures, answers to our questions, photographs of notes or equipment, and your edits, actions and owner names. This may include personal data about other people, such as names or job roles | You |
| Reports | The analyses and reports the service generates from your Content | Generated for you |
| Usage records | Which account generated a report, when, which method was used, and whether a photo was included. We do not record the content of your reports in these records | Generated by the service |
| Acceptance records | The date and time you accepted our Terms and Privacy Policy, the versions accepted, IP address and browser details | Created when you accept |
| Messages | What you send us through the contact form or by email | You |
| Technical information | IP address, device and browser type, pages visited, request times and error logs | Your device |
| Analytics information (only if you accept analytics cookies) | Pages viewed, approximate location, device and browser, how you arrived at the site, and events such as "report generated". It never includes the text or photos you enter | Your device, through Google Analytics |
| Payment information (if paid plans are introduced) | Billing name and address, plan and payment status. Card details are handled by our payment provider, not by us | You and our payment provider |
We do not intend to collect special category data (such as health information). Please do not include it in your Content.
3. How we use your information
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and manage your account and verify your email | Contract |
| Provide the service and generate your reports, including sending your Content to our AI provider | Contract |
| Link usage to the right person and organisation, and understand how the service is used | Legitimate interests |
| Keep a record that you accepted our Terms and Privacy Policy, and defend legal claims | Legitimate interests; legal claims |
| Keep the service secure, prevent fraud and abuse, and apply usage limits | Legitimate interests |
| Send service messages such as verification, password reset and changes to our terms | Contract; legitimate interests |
| Respond to your messages and support requests | Legitimate interests; contract |
| Measure and improve the website using Google Analytics | Your consent, given through the cookie banner |
| Send marketing emails about RapidRCA | Your consent, or the soft opt-in where the law allows |
| Payments, tax and accounting (if paid plans are introduced) | Contract; legal obligation |
4. AI processing
4.1 To generate your report, your Content (text and any photograph) is sent over an encrypted connection to our AI provider, currently Anthropic, which processes it on our behalf.
4.2 We do not use your Content or reports to train or fine-tune AI models, and we use our AI provider under commercial terms that do not permit it to train its models on that Content. The provider may keep Content for a limited period for safety, abuse prevention and legal reasons, as set out in its terms.
4.3 Reports are designed for you to review. We do not use them to make decisions about you that have legal or similarly significant effects.
4.4 Please avoid entering personal data you do not need. Using job roles instead of names is usually enough.
5. Who we share information with
We do not sell personal information. We share it with service providers who help us run the service, under contracts that require them to protect it, and where the law requires.
| Provider | Purpose |
|---|---|
| Anthropic | AI model that generates reports from your Content |
| Vercel | Website hosting and server functions |
| Supabase | Accounts, sign-in and database |
| Website analytics (with your consent) and bot protection (reCAPTCHA) | |
| Email and domain providers | Sending and receiving service emails and messages |
| Payment provider (currently Stripe) | Taking payments, if paid plans are introduced. It acts as an independent controller for the payment data it handles |
| Professional advisers, regulators and courts | Legal, accounting and compliance, where needed or required by law |
If our business is sold or reorganised, personal information may be transferred to the new owner, who must continue to protect it in line with this policy.
6. International transfers
Some of our providers process information outside the UK, including in the United States. Where this happens, we make sure a lawful transfer mechanism is in place, such as a UK adequacy decision (including the UK-US data bridge for certified providers) or standard contractual clauses such as the UK International Data Transfer Agreement or the UK Addendum, together with other safeguards. You can contact us for more information.
7. How long we keep information
| Information | How long |
|---|---|
| Content and reports | Reports are not stored in your account at present. Your Content is processed to produce the report and is not kept by us afterwards; our AI provider may retain it for the limited period described in section 4 |
| Account information | While your account is open and for 12 months after it closes, unless you ask us to delete it sooner |
| Usage records | 24 months |
| Acceptance records | 6 years from the date of acceptance, as evidence for legal claims |
| Messages you send us | 24 months |
| Server and security logs | 30 days |
| Analytics information | 14 months |
| Accounting and payment records | As required by law, normally 6 years |
8. Security
We use measures suited to the risk, including encrypted connections, access controls, keeping secret keys on the server only, and storing passwords in encrypted form with our authentication provider, so we cannot see them. No system is completely secure. If a personal data breach occurs that is likely to put you at risk, we will tell you and the regulator as the law requires.
9. Your rights
Under UK data protection law you have the right to be informed about how we use your information; to access your information; to have it corrected; to have it erased; to restrict or object to our use of it; to receive it in a portable format; to withdraw consent at any time (without affecting earlier use); and not to be subject to decisions based solely on automated processing that have significant effects.
To use these rights, email info@rapidrca.com. We may need to confirm your identity, and we aim to respond within one month. If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
If your Content includes personal data about other people, such as colleagues or customers, you are responsible for having a lawful basis and for informing them. For company accounts we process that data on your behalf, and we will sign a data processing agreement on request.
10. Cookies and similar technologies
We do not use advertising cookies. We use the following:
- Essential storage on your device. We store your sign-in session (
rapidrca_session), a note of which version of our terms you accepted (rapidrca_consent) and your cookie choice (rapidrca_cookies). These are needed for the service to work. - Google Analytics. If you click Accept on our cookie banner, Google Analytics sets cookies such as
_gato count visits and show which pages are useful. If you decline, Google Analytics runs without analytics cookies and receives only limited, non-identifying signals. We do not send what you type or upload. You can change your choice at any time with "Cookie settings" in the footer. - Google reCAPTCHA. We may use reCAPTCHA to protect forms and the service from bots and abuse. Google may collect device and interaction data under its own policies.
Our pages also load fonts from Google Fonts, which means your IP address is sent to Google when a page loads.
11. Marketing
We will only send marketing emails if you agreed to receive them or the law otherwise allows it. Every marketing email includes an unsubscribe link, or you can email us. Service messages, such as verification emails and notices about our terms, are not marketing.
12. Children
The service is for people aged 18 or over. We do not knowingly collect information from children. If you think a child has given us information, email us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. For significant changes we will give notice, and we may ask you to accept the new version. The version number and effective date are shown at the top of this page.
14. Contact us
Questions or requests about your information? Email info@rapidrca.com.