RUBBERMACH / LEGAL
Privacy Policy
How account information and authorized work are handled.
Pre-launch policy draft. Legal operator, effective date, and buyer support details must be confirmed before purchases open.
Account and profile data
The same Supabase cloud identity is used for Rubbermach Web and supported Desktop account access. We process account identifiers, email, authentication/session data, profile display name, and saved preferences to operate your account.
Conversations, files, and context
Cloud conversations, message timestamps, titles, selected attachments, file metadata, and explicitly shared project context are stored in account-backed services. Uploads transfer selected content off your device. Cloud processing is not an all-data-stays-on-device service. Organization context is shared only according to membership and access rules.
Cloud and infrastructure providers
Supabase provides authentication, database, and configured file storage. Hosting and managed AI infrastructure process authorized data to deliver requested capabilities. Paddle acts as Merchant of Record and processes payments and related buyer information under its own privacy terms. Rubbermach receives billing metadata and entitlement state, not full payment-card details. Third-party model providers may process content sent to Rubbermach Cloud.
Purposes and lawful use
We use information to provide requested services, secure accounts, enforce permissions, manage usage and billing, respond to support, and comply with legal obligations. Where applicable, processing relies on contract performance, legal obligations, legitimate security and operational interests, or consent for optional processing.
Diagnostics, device data, and storage
Hosting infrastructure may process IP addresses, request times, browser/device information, errors, and security events. Auth session storage is necessary for restoring your session. Browser storage also holds interface preferences such as the floating control position. Cloud history is not localStorage. Optional diagnostic preferences do not authorize unrelated tracking. No advertising analytics are added by this website.
Security and access
Account data is protected by server authentication and row-level ownership/membership policies. Managed provider secrets remain server-side. No internet service can guarantee absolute security. Only grant access to files and integrations you intend to use. Browser file/folder access requires your explicit selection or authorization.
Retention and deletion
Account content is retained to provide your account and requested work until removed or no longer needed for those purposes. Security records, billing records, backups, and legal obligations can require different retention periods. Remove supported files through the app and contact us for account or content deletion requests. We will explain any legally required retention rather than promise immediate deletion from all backups.
Your choices and rights
Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, withdraw applicable consent, or complain to your supervisory authority. Some records may be retained where law requires it. Clearing browser data does not delete cloud content.
International processing and changes
Cloud infrastructure may process data in locations different from yours. Applicable contractual and legal safeguards must be used where required. Material policy changes will be communicated as required.
Privacy contact
Send privacy and deletion requests to Support contact availability. Do not include passwords, provider keys, or payment-card details in support messages.