Terms · Privacy and cookies · Security
1. Scope and responsibilities
Solvetix LLC, a Missouri limited liability company, operates RRP Central. This notice covers information processed through our website, app, portal, and related communications. We determine the purposes for account administration, billing, support, and security. For job records entered by a renovation firm, the firm generally determines the purpose and we process information to provide the Service on its instructions, subject to applicable law.
Workers, owners, occupants, and recipients should contact the firm responsible for their job about its records. You may also contact contact@rrpcentral.com; we will route or assist with requests as appropriate. The firm's independent practices and providers' independent practices are outside this notice.
2. Information and sources
- Accounts and organizations: name, email, password hash and salt, identifiers, firm and trade names, business address and phone, primary contact, territories, onboarding answers, plan selection, invitations, membership, and roles. Sources include you, your organization, and inviters. Passwords are not stored in plaintext.
- Google sign-in: optional name, email, and email-verification status from Google using identity/profile permissions. The current flow does not request Gmail messages, contacts, or Drive files, and we do not receive your Google password.
- Job records: address and unit, customer and tenant names and emails, building and occupancy facts, scope and dates, assignments, lead-test and cleaning information, notices, training, signatures, notes, certificates, photos, reports, and other submitted content. Records can reveal children's occupancy, disability-related housing, or a lead-related emergency. These facts come from firms and authorized users; avoid unnecessary names, medical details, or sensitive information.
- Workers and credentials: names, emails, phones, employee identifiers, employment status, roles, training providers, course dates, certificate numbers and dates, jurisdictions, and uploaded originals, including through CSV imports.
- Portal activity: designated recipient and role, email if supplied, document version, link creation and expiration, recorded opening of owner/tenant links, typed signer name, acknowledgment time, statement, and selected statement language. The current flow does not independently verify signer identity.
- Billing: Stripe customer/subscription identifiers, plan, status, and period end. Stripe collects payment details in its hosted pages; our app does not receive full card numbers or card security codes through this integration.
- Technical and audit data: IP-based rate-limit keys and counters, session/reset records, user and organization identifiers, actions, timestamps, device/context labels, changed values, filenames and types, upload metadata, and file hashes. Hosting and email providers may process request, security, error, and delivery logs. Device labels are not necessarily independently verified hardware identities.
- Communications: support information you send to us and messages or attachments sent through the Service on a firm's instructions.
Supported PDF text is read in the browser to suggest job or certificate values for user review. This extraction flow does not send files to an external AI or OCR service. Originals or confirmed values may subsequently be uploaded through ordinary record workflows.
3. Uses
We process information to authenticate users; manage accounts, workspaces, and billing; store and synchronize records and originals; calculate guidance and dates; generate exports; send links, receipts, and packets; operate configured reminders and automatic sending; provide support; diagnose problems and misuse; secure accounts and data; meet legal obligations; and handle disputes and lawful requests. We do not use Customer Data to train general-purpose AI models.
We do not sell personal information or share it for cross-context behavioral advertising. The current app contains no advertising pixels or third-party analytics integration. We send only service emails and free-trial reminders, and you can stop trial reminders at any time. We use no third-party analytics. Support is handled by email through Google's Gmail.
4. Cookies and browser storage
The current app uses these first-party cookies for account operation and security:
rrp_session: server authentication; HttpOnly, SameSite=Lax, Secure on HTTPS; maximum browser lifetime 30 days, subject to earlier server expiration or invalidation.rrp_os_session: remembers cloud/preview mode for navigation; maximum lifetime 30 days. Accessible to app JavaScript; it is not the authentication credential.rrp_oauth_state: protects optional Google sign-in; HttpOnly, SameSite=Lax, Secure on HTTPS; maximum lifetime 10 minutes, cleared by the callback.
Local storage holds account/setup details, workspace mode, preview records, and credential-upload information. Session storage may hold a password-reset email. IndexedDB holds evidence files, a local encryption key where supported, and pending record changes in an outbox. A service worker caches the app shell and selected static assets, not API records. Local data is not necessarily removed after syncing. Sign-out clears selected account data and evidence; pending outbox changes can remain for later synchronization.
Browser settings control cookies and site storage. Blocking required storage can prevent login or offline work. Synchronize and export before clearing data: clearing storage, losing a device, switching accounts, or confirming sign-out with unsent files can destroy the only copy. Use care on shared devices. Camera/file capture is initiated by you through device controls. The current app does not request browser geolocation; its configured permissions policy disables geolocation and microphone access. Uploaded files may nevertheless contain location or other metadata.
Google and Stripe pages may use their own cookies. Cloudflare may set short-lived security cookies to block bots and attacks; we do not use them for tracking. No optional advertising-cookie consent system is implemented. If tracking is introduced, this notice and legally required choices must be updated before use.
5. Disclosures and providers
- Organization and chosen recipients: authorized workspace users, portal recipients, and people receiving exports or emails. The automatic-sending setting can email eligible packets to recorded owner and tenant addresses. A portal link is an access credential; anyone possessing it may access information that link exposes. Recipients can retain or forward downloaded or emailed copies.
- Cloudflare: hosting, network delivery, D1 database, R2 original-file storage when configured, and operational/security logging.
- Resend: email delivery when configured, including recipient addresses, content, portal links, and record-PDF attachments.
- Stripe: checkout, recurring billing, and billing portal. The app transmits the email or customer identifier, organization reference, plan, and checkout details, and receives subscription-related events and status.
- Google: optional identity authentication and information Google receives when you use its sign-in pages.
- Support and advisers: authorized personnel and advisers as reasonably needed for support, security, legal, accounting, and disputes. Our current providers are Cloudflare (hosting, database, file storage, and logs), Resend (email delivery), Stripe (payments), and Google (optional sign-in and support email).
- Legal and corporate recipients: parties where required by law or reasonably necessary to protect rights and safety; prospective or actual successors in a merger, financing, reorganization, or business sale, subject to applicable confidentiality and legal requirements.
Provider policies: Cloudflare, Resend, Stripe, Google. Contractual roles depend on the activity; not every provider acts solely as our processor.
6. Retention, corrections, and deletion
Retention serves account operation, the firm's record needs, security, billing, disputes, and applicable legal duties. The federal three-year RRP duty belongs to the firm and may be extended by other requirements; it is not a universal Solvetix deletion deadline. See 40 CFR 745.86.
The app stores retention preferences and a legal-hold flag and calculates schedules. It has no general automatic customer-record purge, post-closure deletion countdown, or self-service account erasure. Database triggers protect audit history against ordinary updates and deletes, so correcting an active record can leave earlier values in history. Expired portal links stop working but their underlying records are not automatically erased. Subscription cancellation does not itself delete records.
The daily worker attempts to remove expired session and password-reset rows, idempotency rows older than 30 days, and rate-limit windows older than one day. Cleanup depends on successful scheduled execution; expiration does not assure immediate deletion. Provider logs, support mail, billing records, backups, and downloaded copies follow their applicable processes.
We keep account and customer records while the account exists, including after a paid plan ends. After a written closure request, you have 30 days to export; we then delete the data from our live systems within 30 days. Audit history is kept with the account and deleted with it; while a legal hold is set or the law requires it, we do not delete the data. Server logs expire within 30 days. Our hosting provider keeps restore points for 30 days, and we make periodic backup copies that each expire within 90 days. We keep support emails for up to three years and billing and tax records for seven years; Stripe keeps its own payment records. Email contact@rrpcentral.com for access, correction, preservation, or deletion requests; we assess applicable rights, firm instructions, and lawful exceptions rather than promise automatic erasure of every copy.
7. Security and incidents
We use organization-scoped access checks, salted password hashing, HttpOnly authentication cookies, hashed portal/reset tokens, rate limits, server-generated file hashes, and append-only audit-table controls. Browser encryption protects local evidence bytes where supported; metadata and all other browser storage are not covered by that encryption. These measures do not provide end-to-end encryption or independent signer verification. No system is completely secure.
We will provide notification and cooperation required by applicable breach-notification law and signed data-processing agreements. To report a security problem, email contact@rrpcentral.com. If we confirm a breach affecting your data, we will investigate, contain it, and notify affected firms without unreasonable delay. See our Security page for implemented controls and operational limits.
8. Requests and choices
You can update supported workspace fields and export available records. Email contact@rrpcentral.com to request access, correction, a copy, closure, or deletion, identifying the account or responsible firm. Do not send passwords or unnecessary identity documents. We may proportionately verify identity and authority and coordinate with the firm. Applicable legal deadlines govern responses; lawful retention, security, and other exceptions can limit requests.
Where applicable law grants them, rights can include access, portability, correction, deletion, limits on sensitive processing, opt-outs of sale, targeted advertising or specified profiling, authorized agents, appeals, and regulatory complaints without unlawful discrimination. We do not sell information or use it for targeted advertising in the current Service. The app has no dedicated Global Privacy Control or Do Not Track handler. Most state privacy laws apply only to much larger businesses, but we answer privacy requests from anyone. Email contact@rrpcentral.com; if we deny a request, you can email us to ask for a second review.
You control recipients you enter and whether to enable automatic packets. The app sends service-related emails and has no general unsubscribe preference center. Account, security, and record emails are part of the Service. You can turn off automatic packet sending in Settings. Turning off automatic packets does not disable all due-date or unsigned-pamphlet reminders. Reply "stop" to a trial-reminder email and we will stop sending trial reminders to that workspace.
9. Children
The Service is intended for adult business users and adult recipients, not children under 13. It does not solicit child accounts. Firms may submit limited occupancy or lead-related facts about properties; that is distinct from inviting children to use the app. Contact us if a child supplied information directly or unnecessary child information was uploaded. We will assess and address it as applicable law requires.
10. Processing locations
Solvetix is based in Missouri, United States, and we serve customers in the United States. Our providers store and process data mainly in the United States but may process it in other countries under their own safeguards. We do not guarantee a storage region. We do not currently offer the Service to customers in the EU or UK.
11. Updates and contact
We will update this notice for material practice changes, indicate the effective date, and give notice or obtain consent where law requires. We will email the account owner and post a notice on our website at least 30 days before a material change. A policy update does not itself authorize a new use requiring consent.
Solvetix LLC
2200 Bredell Ave, St. Louis, MO 63143-1102
United States
contact@rrpcentral.com