Privacy Policy

Scope and privacy roles

This Policy applies to Rabtafy websites, apps, business accounts, public Touchpoints and related services. It explains how Rabtafy handles personal information in connection with those services.

For account administration, billing, security, support, service analytics and Rabtafy's own operations, Rabtafy generally determines why and how the relevant information is processed. For customer information that a business collects or manages through Rabtafy, the business generally determines the purpose of processing and Rabtafy processes that information on the business's behalf, subject to the service agreement and any applicable Data Processing Addendum.

Information we collect and process

Rabtafy may process account identity and contact details, authentication records, business and branch information, roles and permissions, settings, uploaded media, subscription and billing metadata, physical-asset records, device and session information, support communications, security events and service usage data.

Depending on the features a business enables, Rabtafy may also process customer contact details, feedback, survey responses, loyalty and referral activity, orders, interaction events, review-related activity, public-session identifiers and other information submitted through customer experiences.

When you connect an integration, Rabtafy may process provider account identifiers, authorization tokens, configuration details and data returned by that provider as needed to operate the enabled integration.

How we use information

We use information to authenticate users; create and administer tenant workspaces; provide Touchpoints and customer-facing experiences; operate subscriptions; process authorized requests; provide analytics and AI-assisted features; deliver notifications; maintain integrations; detect fraud and abuse; secure, troubleshoot and improve the service; provide support; and comply with contractual or legal obligations.

Where applicable law requires a legal basis, processing may rely on performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, consent where specifically requested, or another lawful basis available under applicable law.

Business customer data

Businesses using Rabtafy decide what customer information they collect through their experiences and are responsible for their own privacy notices, permissions, lawful bases, communications and retention choices. Rabtafy processes that information to provide the service and does not sell a business customer's customer list.

If a customer asks Rabtafy to exercise rights regarding information controlled by a Rabtafy business customer, Rabtafy may direct the request to that business or assist the business where required by applicable law or contract.

AI-assisted features

When an AI-assisted feature is used, Rabtafy may send the minimum information reasonably needed for that operation to the configured AI provider. Depending on the feature, this may include business profile data, selected content, summarized performance metrics or text supplied by the user.

Rabtafy uses feature-specific controls intended to reduce unnecessary disclosure. Users should not intentionally submit passwords, payment credentials, government identifiers or other unnecessary sensitive information to AI features. The applicable AI provider may process submitted information under its own service terms and data-processing commitments.

How information is shared

Rabtafy may share information with service providers that support hosting, authentication, communications, analytics, billing, security, customer support, AI processing and other functions needed to operate the service. We may also share information when a user enables an integration or instructs Rabtafy to send data to another service.

Information may also be disclosed where reasonably necessary to comply with law, court orders or lawful government requests; protect rights, safety and security; investigate fraud or abuse; enforce agreements; or support a merger, acquisition, financing or sale of all or part of the business, subject to appropriate safeguards.

Sale, targeted advertising and marketing

Rabtafy does not sell tenant customer lists as a data-broker product. If Rabtafy introduces advertising or data-sharing practices that are treated as a sale, sharing or targeted advertising under applicable privacy law, this Policy and any required preference controls will be updated accordingly.

Marketing communications from Rabtafy, where offered, are separate from essential service communications. Where required, recipients can use the unsubscribe or preference mechanism provided with the communication.

Cookies and similar technologies

Rabtafy uses authentication, session, CSRF and related browser storage required to sign users in, protect account actions, remember interface preferences and operate public interaction sessions. Additional details are described in the Cookie Information page.

Third-party authentication or integration providers may use their own cookies, SDKs or browser storage when their services are used.

Security

Rabtafy uses technical and organizational safeguards designed for the nature of the service, including access controls, tenant isolation, protected secrets, security logging, rate limiting and transport security where applicable. No internet service can guarantee absolute security.

Users are responsible for protecting their credentials, limiting account access to authorized personnel and promptly reporting suspected unauthorized access through Rabtafy's support channel.

Retention and deletion

Rabtafy retains information for as long as reasonably necessary to provide the service, maintain security and audit records, comply with contractual or legal obligations, resolve disputes and enforce agreements. Retention periods may vary by data type, account status and enabled feature.

When information is deleted from active systems, copies may remain for a limited period in backups, security records or legally required archives before being overwritten or deleted under normal retention processes.

International data transfers

Rabtafy and its service providers may process information in countries other than the country where a user or customer is located. Where applicable law requires safeguards for international transfers, Rabtafy or the relevant provider may use contractual, organizational or other legally recognized transfer mechanisms.

Privacy rights and choices

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability or objection regarding certain personal information, or to withdraw consent where processing is based on consent. Some rights are subject to legal exceptions and verification requirements.

Account holders can update certain account and business information through Rabtafy. Other privacy or deletion requests may be submitted through the support/contact channel made available by Rabtafy. Rabtafy may need to verify identity and authority before acting on a request.

Children

Rabtafy is a business service and is not directed to children. Rabtafy does not knowingly invite children to create business administrator accounts. Businesses using public customer experiences are responsible for configuring their use of Rabtafy appropriately for their audience and applicable age-related requirements.

Third-party links and services

Rabtafy may contain links to or integrations with third-party services. Their privacy practices are governed by their own policies, and Rabtafy is not responsible for how an independent third party handles information after it receives it.

Changes to this Policy

Rabtafy may update this Policy from time to time. Material changes may be published under a new version and effective date and, where appropriate, may require renewed acknowledgement before normal application access continues.