Privacy Policy

Rappline (“we”, “us”) builds and hosts branded customer support websites for businesses. This policy explains what personal data we collect through this website and our client portals, why we collect it, and the rights you have over it.

For the purposes of applicable data protection law, the data controller is [Your Legal Company Name], [Registered Address]. You can reach us at any time at [privacy@rappline.com].

• Intake form submissions. When you ask us to build a portal, we collect your name and role, business contact details (email, phone), company name, industry, website, logo URL, brand colours, support department details, your chosen package, and any notes you provide.
• Contact messages. When you use the contact form we collect your name, email address and message.
• Billing data. Payments are processed by Polar (our merchant of record). We never see or store your full card details; we receive your email address and payment status.
• End-user messages. Messages submitted by visitors through a support portal we operate for a client are processed on behalf of that client, who is the controller of that content.
• Technical data. Standard server logs (IP address, user agent, timestamps) kept for security and abuse prevention.

We process your data to:

• Contact you about your request and deliver the service you purchased;
• Send invoices, receipts and service notifications;
• Operate, secure and improve our website and client portals;
• Comply with legal obligations and enforce our agreements.

Our legal bases are performance of a contract, legitimate interests in operating and securing our business, and consent where required (for example, optional marketing emails).

We do not sell your personal data. We share it only with the providers needed to run the service:

• Polar — payments, invoicing and tax (merchant of record);
• Supabase — application database and authentication;
• Vercel / Cloudflare — hosting and delivery of this site;
• Resend — transactional email delivery;
• GitHub — source control and publishing of client sites.

A current list of sub-processors is available on request. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.

We keep intake submissions, project records and billing correspondence for as long as you are an active client and for [3 years] afterwards to meet legal, accounting and dispute-resolution needs. Contact messages are kept for [12 months]. Server logs are kept for [30 days].

Depending on where you live, you may have the right to access, correct, delete or export your personal data, object to or restrict certain processing, and lodge a complaint with your local supervisory authority. Email us at [privacy@rappline.com] and we will respond within 30 days.

We encrypt credentials at rest, scope administrative access to named individuals, isolate each client’s data with row-level security, and keep secrets out of all generated artifacts. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority without undue delay.

Our services are intended for businesses and are not directed at children under 16. We do not knowingly collect their data.

We will post any changes to this policy on this page and update the date above. Material changes affecting active clients will also be announced by email.