Privacy Policy

What we collect

• Account information: your name, work email, and workspace details you provide when you sign up.
• Workspace data: the accounts, locations, kits, campaigns, vendors, quotes, spend, and rep activity you and your team enter into Rekit.
• Uploaded files: photos, artwork, and documents you upload (for example placement photos and production files).
• Usage and device data: basic log and device information (pages visited, timestamps, browser type) used to operate and secure the service. This includes the IP address a request came from, which we also use to rate-limit abuse.

How we use it

We use your data to provide and operate the service, authenticate you, send transactional notifications you have enabled, respond to support requests, and maintain security and reliability. We do not sell your data, and we do not use your workspace data for advertising.

Service providers

Rekit relies on a small set of subprocessors to run. They process data only to provide their service to us:

• Supabase: database, authentication, and file storage.
• Vercel: application hosting and delivery.
• Resend: transactional email delivery.
• Stripe: payment processing, if and when you subscribe to a paid plan.
• Anthropic: AI processing for reading vendor quotes and uploaded files, mapping import columns, extracting details from field photos, and drafting written summaries. Your data is not used to train their models.
• PostHog: product analytics.
• Sentry: error monitoring.
• Expo: push notification delivery to the Rekit Field app. Receives the device token and the notification text, which can include the title of the request it refers to.

Two delivery paths are chosen by you rather than by us. Browser push notifications travel through the push service your own browser vendor operates, and if you subscribe your Rekit calendar feed into an external calendar app, that provider fetches and stores a copy of the feed on its servers.

AI features

Rekit uses AI to read the files you give it so you do not have to retype them. When you drop in a vendor quote, upload an import file, photograph a store, or ask for a written summary, the relevant content is sent to Anthropic for processing and the result comes back into your workspace.

Two commitments about how this works. Your data is not used to train anyone’s models, and prompts are not retained by us. And every number Rekit shows you is computed by Rekit, not written by the AI: AI reads, extracts, and drafts prose, while the figures on your reports come from your own workspace data.

Data ownership, retention, and deletion

Your workspace data is yours. We retain it for as long as your workspace is active. There is no automatic expiry: records you archive inside Rekit are hidden rather than removed, so that your history survives ordinary tidying up.

You can request an export or deletion of your workspace data at any time by contacting us. We will act on verified requests and complete them within 30 days, keeping only what we are required to keep for legal or security reasons. We are direct about the window because this is handled by a person today rather than by a self-serve button.

Deletion and backups. Our database is backed up on a rolling schedule, held in the same region as the live database. Deleting a record removes it from the live system immediately, but a copy remains in any backup already taken until that backup ages out on its own cycle. We do not edit backup media. In practice this means the longest gap between a deletion request and true erasure everywhere is the length of our backup retention window.

Where your data is stored

All Rekit workspace data is stored in the United States, in Oregon. Both the database and the servers that run the application sit in the same region. Requests reach you from whichever edge location is nearest, but your records are read from and written to Oregon.

Some processing necessarily leaves that region, and in every case the destination is also inside the United States: the AI processing, email delivery, push notifications, error monitoring, analytics, and payment providers named above. We do not currently offer data residency outside the United States.

Security

Data is encrypted in transit and at rest. Access to workspace data is scoped per-organization and enforced at the database layer (row-level security) so that one workspace’s data is not visible to another. Uploaded photos and documents are held in private storage and served through links that expire.

No system is perfectly secure, but we work to protect your data and to limit access to what is necessary to operate the service. We hold no third-party security certification today, and we would rather say so than imply one.

Calendar feed

Rekit can give you a personal subscribe URL for your workspace calendar, covering event names and key dates, campaign gates, and retailer booking deadlines. That URL is unauthenticated by design: calendar apps cannot sign in, so the unguessable link in the address is the only thing protecting it. Anyone who has the link can read that schedule without a Rekit account, so treat it like a password.

When you paste the URL into Google Calendar, Outlook, or Apple Calendar, that provider fetches the feed on its own schedule and keeps a copy of the contents on its servers. You can rotate the link at any time in Settings, which immediately stops the old URL from working. Rotating does not remove data a calendar provider has already fetched.

Cookies

We use cookies that are necessary to keep you signed in and to remember your active workspace. We do not use third-party advertising cookies.

Your choices

You can update your account details in-app, control which notifications reach your inbox in your notification preferences, and request access, export, or deletion of your data by email. Rekit is a business tool intended for use by adults; it is not directed to children under 18.

Changes

As Rekit is in early-access pilot, this policy may change as the product develops. We will update the effective date above when we make material changes.