Privacy policy
RimeGuard reads your HubSpot setup to find broken and at-risk workflows. We collect only what that requires, we never sell personal information, and we never use your data to train AI models.
Who we are
RimeGuard ("RimeGuard," "we," "us") is based in Virginia, USA. You can contact us about privacy at privacy@rimeguard.com.
We play two roles. For your contact and account details, we decide how they're used, so we're the controller. For the data inside your HubSpot account, your company decides, and we process it on your behalf as a processor, under our agreement with you.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact information | Name, work email, company, and messages you send us | You |
| Connection data | Your HubSpot account ID, and access tokens HubSpot issues when you connect (stored encrypted) | HubSpot, when you approve the connection |
| HubSpot configuration | Workflow definitions, including the code inside custom code steps; property names and options; pipelines and stages; your HubSpot users' names, emails and IDs | Your HubSpot account, read-only |
| Record activity | Counts, such as how many new contacts lack an owner, and the date of the most recent update | Your HubSpot account, read-only |
| Hosted scripts (only if you use hosting) | Script code, output and error logs, which may include data your script prints, such as contact emails | You and your scripts |
| Technical data | IP address, browser type, pages requested and timestamps in server logs; two essential cookies in our app (see Cookies) | Your browser |
We don't currently use analytics or advertising trackers. If we add analytics, we'll update this policy first and ask for consent where the law requires it. If we start taking payments, we'll add our payment processor to this policy before we do.
Why we collect it and how we use it
The right-hand column lists the legal basis under the EU and UK GDPR.
| Purpose | Data used | Legal basis (EU/UK) |
|---|---|---|
| Run health checks and monitoring | Connection data, HubSpot configuration, record activity, hosted script data | Performing our contract with you |
| Draft suggested fixes | The affected code and error details, with detected credentials removed | Performing our contract with you |
| Keep RimeGuard secure and prevent abuse | Technical data, logs | Our legitimate interest in protecting the service |
| Support and service messages | Contact information | Performing our contract; legitimate interest |
| Improve the product | Aggregated usage data that doesn't identify you | Legitimate interest |
| Meet legal requirements | Whatever the requirement covers | Legal obligation |
Who we share it with
We share data only with the service providers below, only for the purpose listed, and under contracts that require them to protect it.
| Provider | What they do for us | Data involved |
|---|---|---|
| Render | Hosts the RimeGuard app and stores encrypted tokens and saved data | All app data |
| Anthropic | AI model that drafts suggested fixes; under its commercial terms, it doesn't train models on this data | Code and error details, with detected credentials removed |
| Cloudflare | Hosts our website | Technical data |
| Google Workspace | Our email | Contact information and messages |
| Google Fonts | Delivers the fonts on our website and reports | IP address and browser details |
We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply. HubSpot isn't on this list because we don't send it your data; we read from your HubSpot account with the permissions you approve.
How long we keep it
| Data | How long |
|---|---|
| Access tokens | Until you disconnect; deleted immediately at disconnection |
| HubSpot configuration, including workflow code | Used during each scan, not stored afterward, apart from the lines quoted in your report |
| Reports | Until you disconnect or 30 days, whichever comes first |
| Monitoring history | The last 30 daily readings; deleted when you disconnect |
| Hosted script output and logs | 30 days |
| Server logs | 30 days |
| Contact records | For the length of our relationship, then as long as legal rules require |
Data sent to Anthropic is kept by Anthropic only for a limited period under its commercial terms.
How we protect it
- Read-only access. We ask HubSpot for read permissions, and RimeGuard only ever reads. See our security page for the one permission HubSpot doesn't offer in a read-only form.
- Encryption. Data travels over HTTPS. Access tokens are encrypted at rest with AES-256.
- Isolation. Hosted scripts run in locked-down containers, with no access to other customers' data or to our own credentials.
- Credentials removed before AI analysis. We remove passwords, tokens and keys we detect before code is sent for a suggested fix.
- Human approval. No fix is applied until you approve it.
- Limited access. Only the founder can access production systems, using two-factor authentication.
No system is perfectly secure. If a breach affects your data, we'll notify you without undue delay and as the law requires.
Your rights
Everyone: you can ask us to show, correct or delete your data, and you can disconnect RimeGuard at any time, in RimeGuard or in HubSpot's settings. Email privacy@rimeguard.com. We'll respond within 30 days.
EU and UK residents: you also have the right to restrict or object to our processing, to receive your data in a portable format, and to withdraw consent where we rely on it. You can complain to your local data protection authority, such as the UK Information Commissioner's Office.
US residents: depending on your state, such as California or Virginia, you may have similar rights to access, correct and delete your data. We don't sell personal information or use it for targeted advertising. We won't treat you differently for exercising your rights.
People whose details are in a customer's HubSpot account: that company controls your data. Please contact them; we'll help them respond.
International transfers
We store and process data in the United States. When we receive personal data from the EU or UK, we use the safeguards the law requires, such as the European Commission's Standard Contractual Clauses and the UK Addendum.
Cookies
This website sets no cookies. The RimeGuard app uses only two cookies, both essential. We use no advertising cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
rg_session | Keeps you signed in to your report | 7 days |
rg_state | Protects the HubSpot connection step from forged links | 10 minutes |
Children
RimeGuard is a business service and isn't directed at anyone under 18.
Changes to this policy
We'll post changes here with a new effective date, and email customers before material changes take effect.
Contact
RimeGuard, Virginia, USA · privacy@rimeguard.com