Privacy Policy · Ryzoro Agency

1. Who this covers

Our customers are businesses. When a business uses Ryzoro to keep records about its own customers (names, addresses, jobs, invoices), the business decides how that information is used, and we process it for them. Questions about those records are best sent to that business.

This policy covers the people who use the software (owners, office staff and technicians) and the business's customers whose information is stored in it.

When a business turns on its customer portal, its customers can sign in with their email address to see their own records with that business. We record their sign-ins and what they change there, and they see only their own records.

2. Information we collect

Account information: name, email address, password (stored only as a secure hash), role, and two-step sign-in settings.
Company information: business name, phone, logo, settings, and team members.
Records the business adds: customers, properties and addresses, jobs and visits, notes and photos, forms, estimates, invoices and payments, time records, equipment and chemical application records.
Payment information: card and bank details go directly to Stripe. We keep only the type, brand or bank name, the last 4 digits and the expiry date.
Location: addresses are turned into map points to plan routes. The field app never tracks anyone's location live or in the background. It saves where a technician's phone is only at the moment they tap On my way, Start or Complete on a visit, and only if they allow it. If the business turns it on, it also saves where the phone is at the moment someone clocks in or out. A technician placing a bait station on the map uses the phone's position as the station's location. Nothing is saved between those taps. The business chooses how long these locations are kept (section 6).
Text messages: when a business texts its customers, we keep the phone number, the messages and pictures sent and received, their delivery status, and the history of each customer's agreement to texts (when, how, and the words they agreed to) and any STOP.
Texting registration: a business's legal name, tax ID (stored encrypted; only its last 4 digits are shown), address, contact and website, which are sent to register its texting number.
Technical information: sign-in records, device and browser type, and error logs.
Delivery information from our email provider: whether an email to an address bounced or was marked as spam, so we stop sending automated emails to it.

3. How we use information

To provide the service: sign-in, scheduling, routes, sending estimates, invoices and receipts, sending the texts a business sends to its customers, taking payments, and reports.
Customers' mobile numbers and their agreement to texts are used only to send that business's texts. They aren't shared with other businesses or anyone else for their own marketing.
To keep the service secure and working, and to fix problems.
To support you when you ask for help, for example importing your data.
The Ryzoro support view: Ryzoro support can look at a business's account only after its owner turns on Ryzoro support access (Settings → Ryzoro support access), for 1 day, 7 days or until the owner turns it off. It is off until the owner turns it on, and it turns itself off when the chosen time ends. A view is read-only: support can't change, send, charge or download anything, and never signs in as you. Each view lasts up to an hour, is logged with its reason, is listed for the owners in Settings, and the owners get an email when it starts.
To tell you about your account, billing and changes to the service.
We don't use your customers' information for our own marketing, and we don't sell it.

We don't sell personal information. We share it only:

With companies that help us run the service: Supabase (database, sign-in and file storage), Railway (hosting), Stripe (payments, and our own subscription billing), Resend (email delivery), Twilio (text messages and registering a business's texting number with the phone companies), Google Maps Platform (finding addresses on the map, planning routes, and showing maps), Sentry (error reports, with personal details removed first), Anthropic (the AI assistant: the question and the company data needed to answer it are sent to Anthropic's API to produce the answer), and Cloudflare (Turnstile: a spam check on online booking pages, which receives the visitor's internet address and browser details).
With the push service of your phone or browser maker (for example Google, Apple, Mozilla or Microsoft), when you turn on notifications: it delivers an encrypted notice with a short title and text. It never gets phone numbers or message text.
With YouTube or Vimeo, only when you press play on a Help video: the video then loads from that site, which receives your internet address, browser details and our site's address. Nothing loads from them before you press play.
With services and addresses a business chooses to connect, such as GoHighLevel or the webhook addresses it sets up, which receive the records the business chooses to send.
When the law requires it, or as part of a sale or merger of our business.

5. Cookies

We use cookies only to keep you signed in and to make the app work. We don't use advertising or third-party tracking cookies.

6. How long we keep information

We keep a business's records while its account is open.
Uploaded import files are deleted after 30 days.
AI assistant chats are deleted after 90 days.
Text messages and agreement histories are kept with the business's records while its account is open.
Locations saved at On my way, Start and Complete taps and at clock in and out: the business chooses how long they're kept: with its job records (deleted when the business's data is deleted), 90 days or 1 year.
Trials that end without a plan: the account becomes read-only and its data is deleted 90 days after the trial ends.
Closed accounts: the account becomes read-only and its data is deleted 30 days after the account is closed. Until then the business's owners can download all of it.
We keep a business's data past its deletion date only when a lawsuit or a legal order requires us to, only for as long as it requires, and then we delete it.
Map points from Google are refreshed or deleted within 30 days, as Google's terms require.
Our hosting provider's backups may keep deleted data for a short time until they roll over.
Payment records Stripe must keep are held by Stripe under its own policy.

7. Security

Each company's data is kept separate from every other company's. Connections are encrypted, sensitive settings are encrypted when stored, and owners can require two-step sign-in for their team. If a security incident affects your data, we'll tell you without unreasonable delay, by email, with what happened and what we're doing about it.

8. Your choices and rights

You can see and correct your account information in the app, and a business can export or delete its records. Depending on where you live, you may have the right to ask what information we hold about you, to correct it, or to have it deleted. Email hello@ryzoro.com to make a request; we'll confirm it comes from you before acting on it. If your information was added by a business that uses Ryzoro, we may pass your request to that business.

9. Children

The service is for businesses and is not meant for anyone under 18.

10. Changes to this policy

We may update this policy. The version and date are at the top of this page. We'll tell account owners about significant changes by email or in the app before they take effect.

11. Contact

Ryzoro LLC, Laughlin, Nevada · hello@ryzoro.com · call or text (702) 509-6367. We reply within one business day.