Privacy Policy

Privacy Policy for RevPilot.Ai

This Privacy Policy describes how RevPilot.Ai LLC ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our AI-powered sales account planning platform, including our web application at www.revpilot.org and our Chrome browser extension (collectively, the "Service").

This Privacy Policy is designed to comply with the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), and other applicable privacy laws. By using our Service, you agree to the collection and use of information in accordance with this policy.

Categories of Personal Information We Collect

Identifiers

• Email address (from Google account)
• Display name (from Google profile)
• Google user ID (unique identifier)
• Firebase user ID (internal identifier)
• Profile photo URL (if provided by Google)

Commercial Information

• Subscription tier (Free, Pro, or Enterprise)
• Account plan creation history
• Number of account plans created
• Company names for account plans
• Stripe customer ID (Pro users only)
• Subscription ID (Pro users only)

Internet or Network Activity

• Browser user agent (for bug reports only)
• Page URLs visited within our Service
• Interaction with Chrome extension
• Google Analytics data (anonymous)
• Session activity timestamps

Professional Information

• Company name (optional)
• Sales account planning data
• Google Sheets metadata (IDs, URLs)

Preferences and Settings

• Theme preference (light/dark mode)
• Recent account plans cache
• Google Sheets integration status
• Chrome extension settings

Security and Fraud Prevention Data

• CSRF tokens for form security
• Browser fingerprints for bot detection
• Form submission timing data
• Spam detection scores
• Rate limiting counters

How We Use Your Information

We use the personal information we collect for the following business purposes:

Service Delivery

• Authenticate your account using Google OAuth 2.0
• Create and manage Google Sheets for your account plans
• Provide AI-powered account planning features
• Display your profile information in the Service
• Sync your data across devices and browser sessions
• Process Pro subscriptions through Stripe

Service Improvement and Analytics

• Analyze usage patterns to improve features
• Track feature adoption and user engagement
• Monitor system performance and errors
• Conduct A/B testing for user experience improvements
• Generate aggregated analytics reports

Security and Fraud Prevention

• Detect and prevent fraudulent activities
• Implement rate limiting to prevent abuse
• Monitor for security incidents and vulnerabilities
• Enforce usage limits and terms of service
• Protect against bot attacks and spam

Customer Support

• Respond to bug reports and support requests
• Provide technical assistance
• Send service-related communications
• Process feedback and feature requests

Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and court orders
• Protect our legal rights and interests
• Enforce our Terms of Service

How We Share Your Information

Service Providers

We share your information with trusted service providers who assist us in operating our Service:

• Google Cloud Services: Firebase Authentication, Cloud Firestore, and Firebase Hosting for infrastructure
• Google Workspace APIs: Google Sheets and Drive APIs for account plan creation (with your explicit consent)
• Google Analytics: Anonymous usage analytics and performance monitoring
• Stripe: Payment processing for Pro subscriptions (they receive payment information directly)
• EmailJS: Bug report email delivery (limited information shared)

Legal Requirements

We may disclose your information when required by law:

• To comply with legal processes, subpoenas, or court orders
• To protect the rights, property, or safety of RevPilot.Ai, our users, or others
• To investigate fraud, security issues, or technical problems
• To enforce our Terms of Service or other agreements

Business Transfers

If RevPilot.Ai is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice within the Service of any change in ownership or uses of your personal information.

With Your Consent

We may share your information for other purposes with your explicit consent.

Data Storage, Security, and Retention

Where Your Data is Stored

• Local Browser Storage: Encrypted preferences, auth tokens, recent plans cache (cleared on sign out)
• Firebase Cloud Firestore: User profiles, account plan metadata, subscription information (US data centers)
• Your Google Drive: Actual spreadsheet content (you maintain full control)
• Chrome Extension Storage: Sync settings and cached plan data

Security Measures

• AES-256 encryption for sensitive data in local storage
• HTTPS/TLS encryption for all data in transit
• Google OAuth 2.0 for secure authentication (no passwords stored)
• Firebase security rules with role-based access control
• Authentication tokens expire after 1 hour
• CSRF protection on all forms
• Rate limiting to prevent abuse
• Regular security audits and updates
• Secure session management with activity timeout
• Bot detection and spam prevention

Data Retention

• Active Accounts: Data retained while account is active
• Inactive Accounts: Deleted after 12 months of inactivity
• Bug Reports: Retained for 90 days for support purposes
• Analytics Data: Aggregated and anonymized after 26 months
• Deleted Accounts: Personal data removed within 30 days of deletion request
• Backups: Included in automated backups for up to 30 days
• Legal Holds: Data may be retained longer if required by law

Your Rights Under California Privacy Laws (CCPA/CPRA)

California residents have specific rights regarding their personal information under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know

You have the right to request that we disclose:

• The categories of personal information we've collected about you
• The sources from which we collected the personal information
• Our business purposes for collecting or sharing personal information
• The categories of third parties with whom we share personal information
• The specific pieces of personal information we've collected about you

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions. We will delete your personal information from our records and direct our service providers to do the same.

Right to Correct

You have the right to request correction of inaccurate personal information that we maintain about you.

Right to Opt-Out of Sale or Sharing

We do not sell or share your personal information. However, you have the right to opt-out if we ever change this practice. We do not knowingly sell or share the personal information of minors under 16 years of age.

Right to Limit Use of Sensitive Personal Information

We do not collect sensitive personal information as defined by CPRA.

Right to Non-Discrimination

You have the right not to be discriminated against for exercising any of your CCPA/CPRA rights. We will not:

• Deny you goods or services
• Charge you different prices or rates
• Provide you a different level or quality of service
• Suggest that you may receive different pricing or service quality

How to Exercise Your Privacy Rights

To exercise any of your privacy rights, you may:

• Email us at revpilothelp@gmail.com
• Call us at +1 (510) 603-5181
• Submit a request through your account settings
• Mail us at: RevPilot.Ai LLC, 131 Continental Drive Suite 305, Newark, DE 19713

Verification Process

To protect your privacy, we will verify your identity before processing your request. We may ask you to:

• Provide your email address associated with your account
• Confirm recent account activity
• Verify through your Google account authentication

Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide:

• Written permission signed by you
• Verification of their identity
• Direct confirmation from you that they are authorized

Response Timeline

We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need more time (up to 90 days total), we will inform you of the reason and extension period in writing.

Do Not Sell My Personal Information

Cookie Policy and Tracking Technologies

RevPilot.Ai uses minimal tracking technologies to ensure the best user experience:

Technologies We Use

• Local Storage: To store preferences and encrypted authentication tokens
• Session Storage: For temporary data during your session
• Google Analytics: Anonymous usage statistics (you can opt-out)
• Firebase Performance Monitoring: To ensure service reliability

We Do NOT Use

• Third-party advertising cookies
• Cross-site tracking cookies
• Social media tracking pixels
• Behavioral advertising technologies

Your Choices

• You can clear local storage by signing out
• Use browser settings to block or delete local storage
• Install the Google Analytics Opt-out Browser Add-on
• Use "Do Not Track" browser settings (we honor DNT signals)

Limited Use Disclosure

RevPilot.Ai's use of information received from Google APIs adheres to Google's Limited Use Requirements, including the Chrome Web Store User Data Policy. This means:

• We only access Google Sheets and Drive data that you explicitly authorize
• We use this data solely to provide our account planning features
• We do not transfer this data to others except as necessary to provide our Service
• We do not use this data for advertising purposes
• We do not allow humans to read this data unless you explicitly request support

International Data Transfers

RevPilot.Ai is based in the United States, and your information is primarily processed and stored in the United States. By using our Service, you consent to the transfer of your information to the United States and other countries where we or our service providers operate.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy when transferred internationally.

Children's Privacy (COPPA Compliance)

RevPilot.Ai is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use our Service or provide any personal information to us.

We do not knowingly sell or share the personal information of minors under 16 years of age. If we learn that we have collected personal information from a child under 13, we will take steps to delete such information as soon as possible.

Parents or guardians who believe their child has provided personal information to us may contact us at revpilothelp@gmail.com to request deletion.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. We will notify you of material changes by:

• Updating the "Last Updated" date at the top of this policy
• Sending email notifications to registered users
• Displaying prominent notices within the Service
• Including update notes in Chrome extension updates
• Requiring your consent for material changes that affect your rights

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Third-Party Links and Services

Our Service may contain links to third-party websites, services, or integrations. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access through our Service, including:

• Google Workspace (Sheets, Drive)
• Stripe payment processing
• LinkedIn (when using Chrome extension features)
• Any websites linked from our Service

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Response Commitment

We strive to respond to all privacy-related inquiries within 48-72 hours. For CCPA/CPRA requests, we follow the statutory timelines outlined above.

Privacy Shield

While Privacy Shield is no longer a valid mechanism for EU-US data transfers, we continue to honor our Privacy Shield commitments for personal data previously received under the framework.

Accessibility

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you need this policy in an alternative format, please contact us at revpilothelp@gmail.com.