Privacy Policy

Rubberfit is operated by Arc & Anchor, a Nevada-based software firm. When you use the application at rubberfit.app or any of its subdomains, Arc & Anchor is the controller of the personal data described in this policy. You can reach us at legal@rubberfit.app (privacy questions) or security@rubberfit.app (security questionnaires).

• Account data. Email, name, organization name, and password hash. When you sign in with Google OAuth, we receive your email and name; we do not store the OAuth credential itself.
• Workspace content. The inventory, jobs, customers, cut histories, and PDFs you create inside the application. This is your data — we process it on your behalf.
• Billing data. Subscription plan, billing cycle, seat count, and Stripe customer ID. Card numbers, expiration dates, and ZIP codes never touch our servers; Stripe is the processor of record.
• Usage telemetry. Anonymized request paths, error traces, and aggregate performance metrics. No session replay, no third-party analytics on the dashboard. Marketing pages use Vercel Analytics, which is cookieless.
• Support correspondence. Emails you send to support@rubberfit.app, security@rubberfit.app, or legal@rubberfit.app.

We use this data to deliver and operate the application, send transactional email (magic links, billing receipts, password resets), respond to support and security questions, bill your subscription, prevent abuse, and meet legal obligations. We do not use customer data to train models. We do not sell or rent data to third parties.

All sub-processors publish their own SOC 2 reports. No customer data leaves the U.S.

We use a session cookie and a refresh cookie to keep you logged in. Both are HttpOnly, Secure, and SameSite=Lax. We do not use third-party advertising cookies on the application. Marketing pages may set a cookieless analytics identifier via Vercel Analytics.

When a workspace is deleted, all associated workspace content is removed within 30 days. Audit-log entries that reference a deleted user are anonymized so the audit chain remains intact.

You can request a full data export from Settings → Data → Export inside the application, or by emailing legal@rubberfit.app. You can request hard deletion of your workspace and all associated personal data by the same email; we complete the deletion within 30 days. If you are a California resident, you have the rights granted under the CCPA, including the right to know, the right to delete, and the right to non-discrimination for exercising those rights. We do not sell personal information.

The technical controls behind this policy — Postgres RLS, six-role RBAC, audit log, signed-URL document sharing, encryption at rest — are documented at /security and in the docs site under docs.rubberfit.app/security/posture.

We will update this policy when we change the underlying practices. The “Effective” date at the top reflects the version currently in force. Material changes will be announced by email to workspace owners and noted on the application sign-in page.

legal@rubberfit.app · Arc & Anchor · Las Vegas, NV, USA.