Privacy Policy

RummDesk is operated by Rummlabs LLC(“Rummlabs”, “we”, “us”), a New York limited liability company. This policy explains how we handle personal information when we decide why and how it is used: for staff accounts, for people who contact us, and for the security of the Service.

Businesses use RummDesk to run client portals. Information about a business’s clients (their project details, documents, signatures, invoices and messages) belongs to that business, which decides how it is used. We process it on the business’s behalf under our Data Processing Agreement. If you are a client, the privacy notice inside your portal explains how that business uses your information, and questions about it should go to that business first.

• Account information: your name, email address, password (stored only in hashed form by our authentication provider), the business you belong to and your role.
• Security and activity records: sign-ins, password resets, changes to roles and access, and other actions in the staff workspace, with the time, your IP address, your browser and an approximate location worked out from the IP address.
• Connected apps: when you connect an AI assistant, a record of the connection, the access it was given and when it was last used.
• Messages you send us, for example to support, and the details you include.
• Billing details, if your business pays us: the business name, billing contact and payment records.

• To provide the Service, sign you in and show you the right workspace.
• To keep the Service and its users secure: to detect and stop misuse, and to investigate incidents.
• To send messages about your account and the Service, such as invitations, password resets and notices of changes.
• To answer your questions and provide support.
• To bill for the Service and keep financial records.
• To meet legal obligations and to protect our rights.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to train AI models.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you or your business; our legitimate interests in running a secure and reliable service; and complying with the law.

RummDesk sets only the cookies needed to keep you signed in. It also keeps a few things in your browser’s storage for convenience, such as an onboarding form you have not finished (never its password) or a tip you have dismissed. We do not use advertising or analytics cookies, and we do not track you across other sites. Because nothing we store is used for tracking, we do not show a cookie banner.

We share personal information only with:

• The business you work for, whose owners and admins can see their team’s accounts and activity records.
• Service providers that run parts of RummDesk for us, under contracts that limit their use of the data: Supabase (database, sign-in and file storage), Netlify (website hosting), Render (our document creation service), Resend (email delivery), Stripe (payments) and ipapi.co (approximate location from an IP address, for security records).
• Authorities or other parties when the law requires it, or when it is needed to protect someone’s safety or our rights.
• A buyer or successor, if Rummlabs or the Service is sold or reorganized. They would have to honor this policy.

If you connect an AI assistant, it receives what you ask it to read, under your own account with its provider and that provider’s terms.

• Account information: while the account is open. When an account is closed, we delete or anonymize it, generally within 90 days, unless part of it must be kept for security, legal or accounting reasons.
• Security and activity records: for as long as the business’s account is active, because they are the record of who did what. We keep them longer only where the law or an open investigation needs them.
• Billing records: for as long as tax and accounting law requires, usually seven years.
• Support messages: for as long as needed to resolve the matter and follow up.

Data is encrypted in transit and at rest. Access is checked on every request, in the application and again in the database, so each business and each client sees only its own records. Files are served through links that expire within minutes. Passwords that businesses share with their clients are encrypted separately with a key that is never stored in the database. No system is perfectly secure, but if a breach affects your information we will tell you, and the authorities, as the law requires.

RummDesk is hosted in the United States. Our database is in Ohio and our document service in Oregon, and the website is served through a global network. If you are outside the United States, your information is transferred there. Where the law requires a transfer mechanism, such as for the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the equivalent UK and Swiss terms.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to object to or restrict some uses of it, and to receive it in a portable format. You will not be treated differently for using these rights.

To make a request, email support@rummdesk.com from the address on your account. We may need to confirm your identity first. Someone you authorize can make a request for you if they can show they have your permission. We answer within the time the law sets, usually 30 days for European and UK requests and 45 days for US state requests. If we decline, you can ask us to reconsider by replying to our answer.

If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

If you are a client of a business that uses RummDesk, send requests about your project information to that business. You can also ask for your portal account to be deleted from the Privacy page in your portal. We will help the business answer.

RummDesk is for adults using it for work. It is not meant for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

We will post any change here with a new date. If a change is significant, we will also tell account holders by email or in the Service before it takes effect.

Questions or requests about privacy go to Rummlabs LLC at support@rummdesk.com.