Privacy Policy

1. Scope

This policy covers the Rift application and its public pages, and describes what we collect, why, where it is stored, who can see it, and your choices.

2. What We Collect

• Account data: your Google account name, email address, and profile photo, provided during sign-in; plus onboarding details you enter (name, phone if given, country, niche).
• Business data you enter: brand deals and contacts, receipt details, content plans and manually-entered metrics, notes, and per-creator settings.
• Waitlist applications: the details you submit on the waitlist form.
• Operational records: report/email send logs (recipient, status), admin payment bookkeeping entries, and background-job logs.
• Files: avatars and receipt PDFs you generate.

We do not install advertising trackers or third-party analytics scripts, and we do not collect data from your social media accounts.

3. Why We Use It

Solely to run the product: authenticating you, storing and displaying your business data, computing analytics and health scores from it, sending the emails you trigger (receipts, reports), operating the invite/waitlist process, and administering subscriptions.

4. Where It Lives

Data is stored in a Supabase (PostgreSQL) database; files in Supabase Storage. Emails are delivered through Resend. The application is hosted on Vercel. Each of these processors handles data under its own security and privacy commitments. Receipt PDFs are stored at unguessable links; treat a receipt link like the document itself when forwarding.

5. Who Can See Your Data

• You.
• A manager linked to your creator profile — full access to that profile's business data, until either side ends the link.
• The platform operator (admin) — for support, invite administration, and subscription bookkeeping.
• Recipients of emails you send (a receipt or report goes to the address you specify).

We do not sell personal data and do not share it with advertisers.

6. Retention & Deletion

Data is kept while your account exists. Deleting your account (Settings → Danger Zone) permanently removes your profile and business data. Waitlist entries are deleted on request. Operational logs may persist briefly in infrastructure backups before rotating out.

7. Your Choices & Rights

You can view and edit your data in the app, remove a linked manager, and delete your account entirely, at any time. Depending on your jurisdiction you may have additional rights (access, correction, erasure, portability); contact the support address below to exercise them.

8. Security

Access is gated by Google sign-in and invite codes; server-side ownership checks isolate each creator's data; the database applies row-level security as a backstop; traffic is encrypted in transit. No system is perfectly secure — report suspected issues to the support address below.

9. Children

The service is not directed at anyone under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy; the date above reflects the current version. Material changes will be reasonably communicated to active users.