Privacy Policy

This privacy notice for Rapidflare, Inc. (“Rapidflare,” “we,” “us,” or “our”) describes how and why we collect, store, use, and share (“process”) your information when you:

• Visit our website at https://www.rapidflare.ai, or any website of ours that links to this notice.
• Use the Rapidflare Dashboard at https://dashboard.rapidflare.ai.
• Interact with a Rapidflare AI agent, whether on our website or deployed on a customer’s website or support channel.
• Engage with us in other related ways, including any sales, marketing, or events.

Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at support@rapidflare.ai.

Summary

• What personal information do we process? Contact details you give us, information collected automatically when you use our Services (including IP address and usage data), and conversation content when you interact with a Rapidflare agent.
• Do we process sensitive personal information? No.
• Do we receive information from third parties? Yes, from analytics and business-intelligence providers, and from our enterprise customers who deploy our agents.
• How do we process your information? To deliver and improve the Services, communicate with you, for security and fraud prevention, and to comply with law.
• Do we use your data to train AI models? No. See “AI and automated processing” below.
• In what situations and with which parties do we share personal information? With service providers under contract, and in the specific situations described below.
• What are your rights? Depending on where you are located, applicable privacy law may give you rights over your personal information.
• How do you exercise your rights? Contact support@rapidflare.ai. We act on requests in accordance with applicable data protection law.

Our two roles

Rapidflare processes personal information in two distinct capacities, and which one applies determines who is responsible for your data.

As a controller. When you visit our website, contact us, attend our events, or use our Dashboard as a Rapidflare account holder, we decide why and how your information is processed. This notice describes that processing, and we are accountable to you for it.

As a processor. Our enterprise customers deploy Rapidflare agents on their own websites and support channels. When you interact with one of those agents, the customer is the controller: they decide what the agent does, what data it collects, and how long it is kept, subject to their contract with us. We process that information only on their documented instructions.

If you interacted with an agent on another company’s website and want to exercise privacy rights over that conversation, contact that company first. If you contact us instead, we will refer your request to them and support them in responding.

What information do we collect?

Personal information you disclose to us

We collect personal information you voluntarily provide when you express interest in our products, participate in activities on the Services, or contact us. This may include:

• Names
• Email addresses
• Phone numbers
• Company name and job title
• Contact or authentication data
• Billing addresses

Sensitive information. We do not collect or process sensitive personal information.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

Some information is collected automatically when you visit or use our Services. It does not reveal your specific identity but may include:

• IP address and approximate location derived from it
• Device and browser type, settings, and language
• Referring URLs, pages viewed, and time spent
• Session identifiers and interaction events, including interactions with an agent widget
• Log and diagnostic data about how the Services perform

We collect this to maintain the security and operation of our Services and for internal analytics and reporting. Where this information is collected through cookies and similar technologies, see “Cookies and tracking technologies” below.

Conversation content

When you interact with a Rapidflare agent, we process the messages you send, the responses generated, and the context retrieved to produce those responses. Please do not enter personal information into an agent conversation unless it is necessary for your inquiry.

Information we receive from third parties

We receive information about you from:

• Analytics and business-intelligence providers, which may identify the organization associated with a visit to our website and provide business contact details for people at that organization.
• Our enterprise customers, when they deploy our agents or supply content and contact data for use in the Services.
• Our service providers, in the course of delivering services to us.

How do we process your information?

We process your personal information for the following purposes:

• To deliver and operate the Services you request, including responding to agent conversations and providing Dashboard access.
• To respond to your inquiries and provide support.
• To send marketing and promotional communications, where you have consented and subject to your right to opt out at any time.
• To measure and improve the quality and accuracy of the Services, including reviewing conversations for quality and building evaluation sets. We do not use this content to train AI models, see below.
• To analyze usage and understand how our Services are used, so we can improve them.
• For security and fraud prevention, including protecting the Services against abuse.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.
• To save or protect an individual’s vital interest, such as to prevent harm.

AI and automated processing

Our Services use generative AI to produce responses. Two commitments govern how we handle your data in that context:

We do not use your content to train our models. Content you provide to, or receive from, the Services is not used to train, fine-tune, or otherwise adjust the weights of any machine learning model, and we do not provide it to model providers for training.

We do review content for quality. We investigate low-rated responses and build evaluation sets used to measure and improve accuracy. This does not modify any model. Evaluation records derived from a customer’s conversations are deleted on the same schedule as that customer’s other data.

Our agents generate responses automatically, but we do not use automated decision-making that produces legal or similarly significant effects concerning you. If you are in the EEA or UK, you have the right not to be subject to such decision-making, described under “What are your privacy rights?” below.

What legal bases do we rely on?

We only process your personal information when we have a valid legal reason to do so.

If you are located in the EU or UK

The GDPR and UK GDPR require us to explain the legal bases we rely on:

• Consent. Where you have given us permission to use your information for a specific purpose, such as marketing communications or non-essential cookies. You can withdraw your consent at any time.
• Performance of a contract. Where processing is necessary to provide Services you have requested or to perform our contract with you or your organization.
• Legitimate interests. Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights, for example, to secure our Services, to understand how they are used, and to measure and improve their quality and accuracy.
• Legal obligations. Where processing is necessary for compliance with our legal obligations.
• Vital interests. Where processing is necessary to protect your vital interests or those of a third party.

If you are located in Canada

We may process your information if you have given us express consent, or where consent can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, applicable law may permit processing without your consent, including:

• Collection that is clearly in the interests of an individual and consent cannot be obtained in a timely way.
• Investigations and fraud detection or prevention.
• Business transactions, provided certain conditions are met.
• Witness statements where collection is necessary to assess, process, or settle an insurance claim.
• Identifying injured, ill, or deceased persons and communicating with next of kin.
• Reasonable grounds to believe an individual is, was, or may be a victim of financial abuse.
• Compromising the availability or accuracy of information if consent were sought, and the collection is reasonable for investigating a breach of agreement or contravention of law.
• Compliance with a subpoena, warrant, court order, or production rules.
• Information produced by an individual in the course of their employment, business, or profession, where collection is consistent with the purposes for which it was produced.
• Collection solely for journalistic, artistic, or literary purposes.
• Publicly available information specified by the regulations.

Cookies and tracking technologies

We use cookies and similar technologies on our website for analytics, to understand which organizations visit us, and to measure advertising performance.

Non-essential cookies and tracking scripts do not load until you accept them. When you first visit our website you are presented with a consent banner. Analytics and advertising technologies, including Google Analytics, the LinkedIn Insight Tag, Apollo, and Mixpanel, are loaded only after you click Accept. Strictly necessary technologies required to operate the site may be set without consent.

You can withdraw your consent at any time by clearing the consent cookie in your browser, and you can control cookies through your browser settings. Blocking some cookies may affect how the website functions.

When and with whom do we share your personal information?

We share personal information in the following situations:

• Service providers and sub-processors. With vendors who perform services for us, hosting, analytics, observability, customer relationship management, and support tooling, under written contracts that restrict them to processing on our instructions.
• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition.
• Affiliates. With our affiliates, whom we require to honor this notice.
• Business partners. With our business partners to offer you certain products, services, or promotions.
• Legal and safety. Where required to comply with applicable law, a court order, subpoena, or other lawful request, or where necessary to protect the rights, property, or safety of Rapidflare, our customers, or others.

We do not sell your personal information. Because our analytics and advertising technologies load only after you accept the consent banner, no information is shared with those providers unless you have consented.

Our sub-processors

We engage the following categories of sub-processor. All are bound by written data processing agreements.

• Cloud infrastructure and hosting: Google Cloud Platform, Vercel
• AI model providers: the providers of the underlying language models used to generate responses
• Observability and quality monitoring: LangSmith
• Website analytics and marketing: Google Analytics, LinkedIn, Apollo, Mixpanel
• Customer relationship management: HubSpot
• Support and issue tracking: Linear

We do not transmit EU or UK personal data to any third party or vendor until an appropriate data processing agreement has been executed.

International transfers

Our Services are hosted in the United States, and we and our sub-processors may process your information there and in other countries. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in a country whose data protection laws differ from those in your jurisdiction. Where we transfer personal data out of the EEA or UK, we do so under appropriate safeguards, including standard contractual clauses.

How long do we keep your information?

We keep your information only as long as necessary for the purposes described in this notice, unless a longer retention period is required or permitted by law.

Data processed on behalf of our customers. Where we act as a processor, customer data, including conversation transcripts, session and interaction telemetry, contact details captured through the Services, ingested content, derived artifacts such as embeddings and vector indices, observability traces, feedback records, and evaluation sets, is deleted within sixty (60) days of the end of that customer’s contract, unless legal or regulatory requirements dictate otherwise.

Aggregated and business records. Aggregated usage metrics that contain no message content and identify no individual, and ordinary business records such as billing records, support tickets, and sales records, are retained beyond that period as records of our business relationship.

Personal information generally. Personally identifiable information is deleted or de-identified as soon as it no longer has a business use, and in response to a verified request where we have no legitimate business interest or legal obligation to retain it.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it, or, if that is not possible because the information is stored in backup archives, we will securely store it and isolate it from further processing until deletion is possible.

How do we keep your information safe?

We implement appropriate technical and organizational measures to protect your personal information, including encryption of personal data at rest and in transit, access restricted on a need-to-know basis, and vendor security assessment before we share data with third parties. No system is entirely secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach affecting your information, we will notify affected parties and, where we act as a processor, the relevant customer, in accordance with applicable law and our incident response procedures.

Do we collect information from minors?

We do not knowingly collect data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to that minor’s use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from children under 18, contact support@rapidflare.ai.

What are your privacy rights?

In some regions, including the EEA, UK, Switzerland, and Canada, you have rights under applicable data protection law. These may include the right to:

1. Request access to and obtain a copy of your personal information.
2. Request rectification or erasure.
3. Restrict the processing of your personal information.
4. Data portability, where applicable. Where we receive a portability request, we will export the data in a commonly used industry-standard format and make it available for download by you.
5. Not be subject to automated decision-making, including profiling.

In certain circumstances you may also object to processing. To make a request, contact us using the details under “How can you contact us about this notice?” below.

We will acknowledge your request within three (3) business days and respond within twenty-five (25) days. Where a request is complex or numerous, we may extend that period as permitted by applicable law and will tell you if we do.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK Information Commissioner’s Office. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Our EU and UK representative

Rapidflare has appointed a representative under Article 27 of the GDPR and UK GDPR as a contact point for data subjects and supervisory authorities:

Andreas Lambauer andreas@rapidflare.ai Germany

Withdrawing your consent

Where we rely on your consent, which may be express or implied depending on applicable law, you have the right to withdraw it at any time. Withdrawal will not affect the lawfulness of processing before its withdrawal, nor processing conducted on other lawful grounds where permitted.

To opt out of marketing communications, use the unsubscribe link in any message or email support@rapidflare.ai. You may still receive service-related communications necessary for administration and use of your account.

Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature you can activate to signal your preference not to have data about your online browsing activities monitored and collected. No uniform DNT standard has been finalized, so we do not currently respond to DNT signals. Our consent banner gives you direct control over non-essential tracking on our website. If a DNT standard is adopted that we must follow, we will update this notice.

Compelled disclosure

We may receive legal demands for information, such as court orders, search warrants, subpoenas, and government investigations. On receipt, we notify our legal counsel and investigate the demand. Where we determine a demand is valid, we disclose only the information specifically demanded that we are reasonably able to locate. We do not act on overly broad or vague demands. Where we are permitted to do so, we will notify the affected customer before disclosing their information, though in some cases we may be legally prohibited from giving notice.

Do United States residents have specific privacy rights?

If you are a resident of California, Colorado, Connecticut, Utah, or Virginia, you have specific rights regarding your personal information.

Categories we disclose to service providers

We disclose the following categories of personal information to service providers for business purposes, under written contract: identifiers (such as name, email address, and IP address), commercial information, internet and network activity information, and the contents of communications you direct to us or to an agent.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising except where you have consented through our cookie banner. You can withdraw that consent at any time.

We may use your personal information for our own business purposes, such as internal research for technological development and demonstration. This is not considered “selling” of personal information.

California residents

California Civil Code Section 1798.83, the “Shine The Light” law, permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes, and the names and addresses of all third parties with which we shared personal information in the preceding calendar year.

If you are under 18 years of age, reside in California, and have a registered account with the Services, you have the right to request removal of unwanted data that you publicly post. Contact us using the information below and include the email address associated with your account and a statement that you reside in California. Note that data may not be completely removed from all our systems, such as backups.

CCPA privacy notice

This section applies only to California residents. Under the California Consumer Privacy Act (CCPA), you have the rights listed below.

The California Code of Regulations defines a “resident” as:

1. Every individual who is in the State of California for other than a temporary or transitory purpose, and
2. Every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose.

All other individuals are defined as “non-residents.”

Your rights with respect to your personal data

Right to request deletion of the data: Request to delete. You can ask for the deletion of your personal information. We will respect your request and delete it, subject to certain exceptions provided by law.

Right to be informed: Request to know. Depending on the circumstances, you have a right to know:

• Whether we collect and use your personal information.
• The categories of personal information that we collect.
• The purposes for which the collected personal information is used.
• Whether we sell or share personal information with third parties.
• The categories of personal information that we sold, shared, or disclosed for a business purpose.
• The categories of third parties to whom personal information was sold, shared, or disclosed for a business purpose.
• The business or commercial purpose for collecting, selling, or sharing personal information.
• The specific pieces of personal information we collected about you.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified, or to re-identify individual data to verify a consumer request.

Right to non-discrimination for the exercise of a consumer’s privacy rights. We will not discriminate against you if you exercise your privacy rights.

Right to limit use and disclosure of sensitive personal information. We do not process consumer sensitive personal information.

Verification process

Upon receiving your request, we will verify your identity to determine that you are the same person about whom we have information in our system. These efforts may require us to ask you to provide information we can match against information you previously provided. We may also contact you through a communication method you previously provided.

We will only use personal information provided in your request to verify your identity or authority to make the request, and we will delete any additionally provided information as soon as we finish verifying you.

Other privacy rights

• You may object to the processing of your personal information.
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict processing.
• You can designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof of authorization.
• You may request to opt out from future selling or sharing of your personal information to third parties. Upon receiving an opt-out request, we will act on it as soon as feasibly possible, but no later than fifteen (15) days from the date of the request.

To exercise these rights, contact us at support@rapidflare.ai.

Colorado residents

This section applies only to Colorado residents. Under the Colorado Privacy Act (CPA), you have the rights listed below. These rights are not absolute, and in certain cases we may decline your request as permitted by law.

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling.

To exercise these rights, email support@rapidflare.ai. If we decline to take action and you wish to appeal, email us at the same address. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, with a written explanation.

Connecticut residents

This section applies only to Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you have the rights listed below. These rights are not absolute.

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling.

To exercise these rights, email support@rapidflare.ai. If we decline and you wish to appeal, email us at the same address. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, with a written explanation.

Utah residents

This section applies only to Utah residents. Under the Utah Consumer Privacy Act (UCPA), you have the rights listed below. These rights are not absolute.

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising or the sale of personal data.

To exercise these rights, email support@rapidflare.ai.

Virginia residents

Under the Virginia Consumer Data Protection Act (VCDPA):

• “Consumer” means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.
• “Personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person. It does not include de-identified data or publicly available information.
• “Sale of personal data” means the exchange of personal data for monetary consideration.

Your rights with respect to your personal data

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling.

Exercising your rights

Email us at support@rapidflare.ai. If you are using an authorized agent, we may deny a request that does not include proof of authorization.

Verification process

We may request additional information reasonably necessary to verify you and your consumer’s request. If the request is submitted through an authorized agent, we may need additional information to verify your identity.

We will respond without undue delay, but within forty-five (45) days of receipt. The response period may be extended once by forty-five (45) additional days when reasonably necessary. We will inform you of any such extension within the initial period.

Right to appeal

If we decline to take action, we will inform you of our decision and reasoning. To appeal, email support@rapidflare.ai. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, with a written explanation. If your appeal is denied, you may contact the Attorney General to submit a complaint.

Do we make updates to this notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated “Last revised” date and will be effective as soon as it is accessible. If we make material changes, we may notify you either by prominently posting a notice or by directly sending you a notification. We encourage you to review this notice frequently.

How can you contact us about this notice?

If you have questions or comments about this notice, email us at support@rapidflare.ai or contact us by post at:

Rapidflare, Inc. 325 S 1st St #120 San Jose, CA 95113 United States

Data subjects in the EEA or UK may also contact our Article 27 representative, whose details appear under “What are your privacy rights?” above.

How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect, change it, or delete it. To request to review, update, or delete your personal information, email support@rapidflare.ai.