Privacy Policy

1. Information We Collect

We collect information you provide directly and information generated through your use of the Platform:

1.1 Account Information

When you create an account, we collect your name, email address, username, and password (stored as an Argon2id hash — we never store or have access to your plaintext password). If you enable two-factor authentication (TOTP) or passkeys (WebAuthn), the associated cryptographic data is stored securely.

1.2 Usage & Telemetry Data

We automatically collect API request logs including endpoint accessed, HTTP status code, response duration, timestamp, and anonymized IP address. This data is used for usage metering, quota enforcement, and platform reliability monitoring.

1.3 Contact & Inquiry Data

When you submit a contact form or discovery audit, we collect your name, email, company name, phone number, service interest, estimated budget, project timeline, and message content.

1.4 Cookies & Session Data

We use essential session cookies to maintain your authenticated state. These cookies are HTTP-only, secure, and scoped to the .rimnex.com domain. We do not use third-party tracking cookies or advertising pixels.

1.5 Payment Information

Payment processing is handled entirely by Lemon Squeezy (our Merchant of Record). Rimnex does not collect, store, or have access to your credit card numbers or bank account details. Lemon Squeezy's privacy policy governs the handling of payment data.

2. How We Use Your Data

• Provide, maintain, and improve the Platform and its services
• Authenticate your identity and manage your session
• Process subscriptions, enforce usage quotas, and manage billing
• Respond to support tickets, inquiries, and discovery audits
• Send transactional emails (account verification, billing notifications, lead alerts)
• Monitor platform health, detect abuse, and ensure security
• Generate anonymized, aggregated analytics for internal use

We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes.

3. Data Storage & Security

Your data is stored in a self-hosted PostgreSQL 16 database with pgvector extension, running on our private infrastructure. Key security measures include:

• Password Hashing: Argon2id with secure salt — industry-leading resistance to brute force attacks
• Session Security: HTTP-only, secure, SameSite=Lax cookies with server-side session validation
• TLS Encryption: All traffic encrypted via TLS 1.3 (Cloudflare DNS-01 ACME wildcard certificates)
• Network Isolation: Database port (911) and application port (913) are Docker-internal only — never exposed to the public internet
• API Credentials: OAuth2 client secrets are hashed with SHA-256 and shown only once at creation — never retrievable
• Access Control: Role-based access (admin/member/user) with ForwardAuth middleware for protected routes

4. Third-Party Services

We integrate with the following third-party services, each governed by their own privacy policies:

• Lemon Squeezy: Payment processing, subscription management, and invoicing (Merchant of Record)
• Gmail SMTP: Transactional email delivery (lead notifications, account alerts)
• Cloudflare: DNS management, CDN, DDoS protection, and TLS certificate issuance

We do not share your personal data with any third party beyond what is strictly necessary to provide the services described above.

5. Data Retention

• Account Data: Retained for the lifetime of your account. Upon deletion, all data is permanently removed within 30 days.
• API Request Logs: Retained for 90 days for usage analytics, then automatically purged.
• Contact/Lead Data: Retained until the inquiry is resolved or 2 years, whichever is shorter.
• Audit Logs: Retained for 1 year for security compliance purposes.
• Support Tickets: Retained for the lifetime of your account for reference.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to certain processing activities

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookie Policy

Rimnex uses only essential, first-party session cookies required for authentication and security. We do not use analytics cookies, advertising cookies, or any third-party tracking technologies. No cookie consent banner is necessary as our cookies are strictly functional.

8. Children's Privacy

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has provided us with their data, please contact us immediately.

9. International Data Transfers

Your data may be processed on servers located in different jurisdictions. By using the Platform, you consent to the transfer and processing of your data in accordance with this Privacy Policy. We ensure appropriate safeguards are in place for any cross-border data transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Material changes will be communicated via email or a prominent notice on the Platform. The “Last updated” date at the top of this page indicates when the policy was last revised.

11. Contact

For privacy-related inquiries, data requests, or concerns, contact us at:

• 📧 [email protected]
• 📧 [email protected]