Privacy Policy

1. Scope

This policy describes how Rightrow Technologies (“Rightrow”, “we”) handles personal data when you use the web application, the API, and the Google Sheets extension. It does not cover third-party sites we link to.

2. What we collect

• Account data: name, email address, and authentication identifiers provided by Clerk when you sign in. We do not receive your password.
• Dataset content: the CSV or spreadsheet range you upload or send from the extension, plus derived files (cleaned CSV, profile, data-lost report).
• Usage and operational data: request timestamps, file names, row/column counts, error messages, and API-key identifiers. We use these to operate the service, enforce limits, and debug failures.
• Billing data: handled by our payment provider. Card details are submitted directly to the provider and are not stored on Rightrow servers.

3. How datasets are processed and retained

• Uploaded files and derived clean files are temporary and are deleted within 60 minutes by default. The window can be configured by the operator.
• If the deployment uses object storage, dataset files may persist there under the operator's retention settings. The operator is responsible for those settings.
• We do not use customer datasets to train, fine-tune, or evaluate machine-learning models, and we do not sell them.
• When an optional model-assisted step is used for an ambiguous schema or entity mapping, only a small sample with sensitive fields redacted is sent to the provider. The deterministic path does not call a model.
• Operational logs are retained for a limited period for security, abuse prevention, and debugging.

4. Subprocessors

We share data only with providers needed to run the service:

• Clerk — authentication and session management.
• Cloud hosting provider — compute and temporary file storage.
• Paddle (Paddle.com Market Ltd) — Merchant of Record for subscription billing and global tax/VAT handling. Card data and billing details are submitted directly to Paddle.
• Exchange-rate API — publicly published currency ratios only; no spreadsheet rows are sent.

5. Security

Traffic between your browser, the extension, and the backend uses HTTPS. Authentication tokens are verified against Clerk's public keys. API keys are stored as records in our database and can be revoked. No system is perfectly secure; do not upload data you are not authorized to process.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or object to the processing of your personal data. You can delete your account through the account menu; residual temporary files expire on the schedule above. To exercise a right, contact privacy@getrightrow.com.

If you are in the EEA or UK, our legal basis is performance of a contract (providing the service) and legitimate interests (security and abuse prevention). Where data is transferred outside your region, we rely on the provider's standard contractual clauses.