Privacy Policy

RidgeSync runs ridgesync.co and the RidgeSync application. For data you put into the CRM about your own customers, you are the controller and we are the processor — you decide what to collect, we hold it for you.

Contact: ridgesyncrm@gmail.com.

Account data: your name, email address, company name, phone number and business details you enter during signup or onboarding.

Business data you create: leads, contacts, jobs, measurements, estimates, proposals, invoices, expenses, crew records, files and photos you upload.

Billing data: your subscription status, plan and billing history. Card details go straight to Stripe — they never reach our servers.

Technical data: pages visited, approximate location from your IP address, browser and device type, and how you got to the site.

Support data: anything you send us in the contact form or by email, and questions you ask the assistant.

If you turn on phone notifications we store a push subscription for that device. If you record a voice note we process the audio to write the note, then keep the resulting text.

To provide the service you signed up for — that is our contract with you.

To take payment and meet our tax and accounting obligations — that is a legal duty.

To keep the service secure, fix faults, and understand how the site is used so we can improve it — that is our legitimate interest, balanced against your privacy.

For advertising and analytics cookies, where consent is required — that is your consent, which you can withdraw at any time.

Supabase — database, authentication and file storage. This is where your account and business data lives.

Vercel — hosting and content delivery for the application and the websites it generates.

Stripe — subscription payments. Stripe holds your card details under its own privacy policy; we hold only a customer reference and your subscription status.

Google — Google Analytics and Google Ads on ridgesync.co for traffic measurement and advertising, and Google's AI models for the product's AI features.

Web3Forms — delivers the contact form on ridgesync.co to our support inbox.

We do not sell or rent personal data to anyone, and we do not share it with advertisers beyond the analytics and advertising tags described here.

Your data is sent to an AI model only when you use an AI feature — reading a report, drafting a message, captioning a photo, asking about your books.

It is used to answer that request and is not used to train the model.

The public "Ask RidgeSync" chat on the marketing site has no access to any account, customer or billing data. It only knows about the product.

The application uses cookies that are strictly necessary to keep you signed in and to remember your display preferences. These are always on, because the app does not work without them.

The marketing site also loads Google Analytics and Google Ads tags, which set cookies used to measure traffic and attribute signups to advertising. These load only on ridgesync.co — never on a subscriber's own website.

Where consent is required, these tags are held back until you give it, and you can change your choice at any time from the cookie settings link in the footer.

Account and business data: for as long as your account is open, then 30 days after you close it, then deleted.

Billing records: seven years, because tax law requires it.

Support email: three years.

Analytics data: as configured in Google Analytics, up to 14 months.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to hand it to another provider. Email ridgesyncrm@gmail.com and we will answer within 30 days, free of charge.

If you are in California, you have the right to know what we collect, to have it deleted, and to opt out of sharing for cross-context behavioural advertising. We do not sell personal information for money. Use the cookie settings link in the footer to opt out of advertising cookies.

If you are in the UK or EU, you can complain to your data protection authority. We would rather you told us first so we can fix it.

Data is encrypted in transit and at rest by our hosting providers. Every company's data is isolated at the database level, so one account cannot read another's.

Access to production data is limited to those who need it to run the service.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator without undue delay.

RidgeSync is a business tool and is not intended for anyone under 16. We do not knowingly collect their data.

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always shows the current version.