Privacy Policy

Rizzl ("we", "our", "us") operates the rizzl.io website and Rizzl platform. This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

1.1 Account Data

When you register, we collect your name, email address, and authentication credentials. If you use SSO (Google, Okta, Azure AD, or SAML), we receive your identity token from the provider.

1.2 Workspace Data

We store your studio name, team members, client records, and workspace configuration. This includes plan selection, notification preferences, and integration settings.

1.3 Content You Upload

Assets (AEP, MOGRT, MP4, MOV, images, etc.), portal content, comments, and task data are stored in your workspace. Files are stored in Cloudflare R2 (or your own storage if using BYOS).

1.4 Usage Data

We automatically collect: pages visited, features used, browser type, device type, IP address, and timestamps. We use this to improve the product and diagnose issues.

1.5 Payment Data

Payment processing is handled by Stripe. We do not store your full credit card number. Stripe's privacy policy governs payment data handling.

• Provide, operate, and maintain the Rizzl platform
• Process transactions and send billing-related communications
• Send transactional emails (invites, portal notifications, approval alerts)
• Respond to support requests via our AI support agent or email
• Monitor usage to enforce plan limits and prevent abuse
• Improve the product based on aggregate usage patterns
• Comply with legal obligations

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Your data is stored on:

• Supabase — PostgreSQL database (EU/US regions), encrypted at rest
• Cloudflare R2 — Object storage for uploaded files, encrypted at rest
• Your own storage (BYOS) — If configured, files are stored in your S3/R2/GCS bucket and never touch our servers

All data is transmitted over TLS 1.3. Database backups are encrypted and retained for 30 days. We use role-based access control internally — only authorized personnel can access production data for support purposes.

We share data only with the following service providers who are necessary to operate Rizzl:

• Supabase — Database hosting and authentication
• Cloudflare — CDN, DNS, and R2 object storage
• Stripe — Payment processing
• Your configured integrations — Slack webhooks, custom webhooks, SSO providers (only data you explicitly choose to share)

We do not share data with advertising networks, data brokers, or any other third parties.

When your clients access review portals, we collect their IP address, browser user agent, and any comments or approvals they submit. This data belongs to your workspace and is visible only to workspace members with appropriate permissions.

IP Vault restrictions, when enabled, add an additional security layer by limiting portal access to specific IP ranges.

• Active accounts — Data is retained as long as your account is active
• Deleted content — Trash items are permanently deleted after 30 days, or immediately when you empty trash
• Closed accounts — Account data is retained for 30 days after closure, then permanently deleted. You may request an export before closure.
• Audit logs — Retained for 90 days (Agency+) or 1 year (Enterprise)

Under GDPR, CCPA, and other applicable privacy laws, you have the right to:

• Access — Request a copy of all personal data we hold about you
• Rectification — Request correction of inaccurate data
• Deletion — Request permanent deletion of your account and all associated data
• Portability — Request your data in a machine-readable format (JSON/CSV)
• Objection — Object to processing of your data for specific purposes
• Restriction — Request limitation of processing while disputes are resolved

To exercise any of these rights, email support@rizzl.io. We respond within 30 days.

Rizzl uses localStorage to maintain your session (authentication token, workspace ID, user preferences). We do not use third-party tracking cookies, advertising pixels, or analytics scripts.

Rizzlis not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

If you access Rizzl from outside the United States, your data may be transferred to and processed in the US or EU, where our servers are located. We ensure appropriate safeguards are in place for international transfers in compliance with GDPR Standard Contractual Clauses.

We may update this policy periodically. Material changes will be communicated via email to account holders and/or via an in-app notification at least 30 days before taking effect. Continued use of Rizzl after changes constitutes acceptance.

For privacy-related questions or requests:

Email: support@rizzl.io
Data Protection Officer: Rizzl Privacy Team
Response time: Within 30 days of receipt