Privacy Policy

This Privacy Policy describes how Randolph Business Resources (“RBR,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal and financial information in connection with our accounting operations platform (the “Service”). RBR serves clients based in the United States. Because we process financial data on behalf of our clients, we apply the heightened standards expected of financial-services providers.

Geographic scope. RBR’s clients are currently based in the United States. This policy is written to comply with applicable U.S. federal and state law. If RBR’s client base expands to include organizations subject to the GDPR, UK GDPR, or other non-U.S. privacy frameworks, this policy will be updated accordingly.

1. Scope

This policy applies to:

• Authorized users of the Service (employees or agents of RBR’s clients).
• Visitors to our marketing website and related pages.
• End Customers — individuals whose information is processed by RBR’s clients through the Service.

For End Customer data, RBR acts as a service provider / data processor on behalf of the client (the data controller). The client’s own privacy notice governs our processing of End Customer data. Please review that notice, or contact the relevant client organization, to understand how your information is used.

2. Information We Collect

• Account information: name, email address, role, organization, authentication identifiers, and MFA metadata.
• Financial and bookkeeping data: ledgers, journal entries, bank balances and transactions, statements, invoices, time entries, and related records ingested from connected systems (e.g., QuickBooks Online, Plaid, BigTime, Double).
• Tax and compliance information: EINs, W-9 details, 1099 vendor records, annual report status, and similar regulatory artifacts you upload or generate.
• Communications: emails ingested into the inbox module, in-app messages, support requests, and notification logs.
• Usage and device data: IP address, browser type, operating system, pages viewed, timestamps, and diagnostic logs.
• Cookies and similar technologies: session, preference, and limited analytics cookies. See Section 5 for details.

Sensitive data we do not collect. We do not knowingly collect Social Security Numbers or full payment card numbers through the Service. Do not upload such data unless explicitly required by a feature designed for it.

No sale of personal information. We do not sell or rent personal information.

3. How We Use Information

• Provide, operate, secure, and improve the Service.
• Authenticate users and enforce role-based access controls.
• Synchronize and reconcile data across connected financial systems.
• Generate reports, dashboards, and notifications you configure.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal, tax, audit, and regulatory obligations.
• Communicate service updates, security alerts, and support responses.
• Respond to consumer privacy requests.

AI features. We do not use client financial data to train third-party general-purpose AI models. AI-assisted features operate on a per-request basis and only on data you direct us to process.

4. How We Share Information

We share information only as necessary and with appropriate contractual safeguards:

• Subprocessors: vendors hosting or operating the Service (cloud infrastructure, database, email delivery, error monitoring). A list of current subprocessors is available upon request at privacy@rbr.apexblueprint.ai.
• Connected services you authorize: such as QuickBooks Online, Plaid, Google, BigTime, and Double, each governed by its own terms and privacy notice.
• Professional advisors: auditors, lawyers, and accountants under confidentiality obligations.
• Authorities: when required by law, subpoena, court order, or to protect rights, safety, or property.
• Business transfers: in connection with a merger, acquisition, or sale of assets; we will provide notice and the acquiring entity will remain bound by this policy.

We do not sell or rent personal information.

5. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary: required for authentication, session management, and security. These cannot be disabled without impairing core functionality.
• Preference: remember your settings and preferences.
• Analytics: help us understand usage patterns and improve the Service.

Do Not Track. Our Service does not currently respond to browser DNT signals. We will update this policy if our practices change.

6. Data Security

• Encryption: TLS 1.2+ in transit; AES-256 at rest for stored data.
• Access controls: role-based access control and row-level security on databases; least-privilege production access for personnel.
• MFA: TOTP-based MFA is available to all users and strongly recommended; certain administrative roles require it.
• Audit logging: administrative and synchronization actions are logged and retained for security review.
• Subprocessor security review: vendors handling client data undergo security assessment before onboarding.
• Personnel: background-verified staff operate under confidentiality obligations and least-privilege access controls.
• Breach response: we maintain a written incident response plan. In the event of a qualifying security breach affecting personal information, we will notify affected clients and comply with applicable state breach notification laws and the FTC Safeguards Rule notification requirements where applicable.

No method of transmission or storage is 100% secure. Report suspected vulnerabilities to security@rbr.apexblueprint.ai.

7. Data Retention

We retain client and End Customer data for the duration of the engagement and for the periods required by law — typically seven (7) years for accounting records under U.S. federal and state law. We will confirm applicable retention periods upon request. Where no retention obligation applies, you may request deletion of your data (see Section 8).

8. Your Privacy Rights

Depending on your state of residence, you may have some or all of the rights described below. Submit requests to privacy@rbr.apexblueprint.ai. We will not discriminate against you for exercising any privacy right. For End Customer data processed on behalf of a client, please contact that client organization; RBR will assist their response.

8.1 California Residents (CCPA / CPRA)

• Know: request disclosure of categories and specific pieces of personal information collected, how it is used, and with whom it is shared.
• Delete: request deletion of personal information (subject to legal exceptions).
• Correct: request correction of inaccurate personal information.
• Opt out of sale or sharing: we do not sell or share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. No opt-out mechanism is therefore required.
• Limit use of sensitive personal information: request that we limit our use and disclosure of sensitive personal information (e.g., financial data, tax identifiers) to the purposes permitted under the CPRA. We use sensitive PI only to perform contracted services and comply with legal obligations.
• Non-discrimination: we will not deny, charge different prices for, or provide a different level of service because you exercised a CCPA/CPRA right.
• Authorized agent: you may designate an authorized agent; we will require written proof of authorization and may verify your identity directly.

8.2 Other U.S. State Residents

Residents of Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Iowa, Delaware, and other states with comprehensive privacy legislation have rights that may include access, correction, deletion, and portability of personal data, and the right to opt out of targeted advertising or profiling in furtherance of consequential decisions. Submit requests to privacy@rbr.apexblueprint.ai.

8.3 Response Timelines

We will not charge a fee for reasonable requests. For manifestly unfounded or excessive requests, we reserve the right to charge a reasonable fee or decline the request in accordance with applicable law.

9. International Data Transfers

RBR is headquartered in the United States and primarily serves U.S.-based clients. Data collected through the Service is stored and processed in the United States. To the extent any personal information is transferred to or processed by subprocessors in other countries, we require those subprocessors to maintain appropriate contractual and security safeguards consistent with this policy.

10. Children

The Service is designed for business users and is not directed to children under 13 years of age as defined under the Children’s Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently done so, we will delete it promptly. Contact privacy@rbr.apexblueprint.ai if you believe a child’s data has been submitted.

11. Financial Privacy Notice (GLBA and FTC Safeguards Rule)

When we process nonpublic personal financial information (“NPI”) on behalf of a financial institution or accounting client, we act as a service provider subject to the Gramm-Leach-Bliley Act (GLBA) and the FTC’s Standards for Safeguarding Customer Information (updated rule effective June 9, 2023), as well as applicable state financial privacy laws.

Consistent with these requirements, RBR:

• Uses NPI only to perform contracted services and for no other commercial purpose.
• Maintains a written information security program with administrative, technical, and physical safeguards appropriate to the size, complexity, and sensitivity of NPI handled.
• Designates a qualified individual to oversee the information security program.
• Conducts periodic risk assessments and monitors safeguard effectiveness.
• Reports qualifying security events to the FTC (and affected clients) within the timeframes required by applicable law.

California financial institution clients should note that California’s Financial Information Privacy Act (FIPA) may impose additional requirements. Contact us for further information.

12. Google User Data and Google API Services

Randolph Atlas connects to Google accounts (primarily Gmail) that authorized users of RBR’s clients choose to link. This section describes, specifically and separately, how Randolph Atlas accesses, uses, stores, and shares data obtained through Google APIs. This section governs Google user data and prevails over any conflicting statement elsewhere in this policy.

12.1 Google OAuth scopes we request and why

• openid, userinfo.email, userinfo.profile — to authenticate the user and display their name and email in the application.
• gmail.readonly — to read messages and message metadata from a mailbox the user explicitly connects, so Randolph Atlas can monitor client email threads for sentiment, at-risk signals, and missing project updates, and to summarize communications for firm leadership.
• gmail.send — only when the user explicitly chooses to have Randolph Atlas send a reminder or reply on their behalf from their connected mailbox.
• gmail.modify — only where the user enables labeling, archiving, or thread management within the accounts-payable workflow.

We request the narrowest scope needed for each feature. Users can revoke access at any time at https://myaccount.google.com/permissions.

12.2 How we use Google user data

• Detect negative sentiment and at-risk clients in email threads and surface them to firm leadership.
• Match inbound client email to monday.com projects and QuickBooks Online client records to flag missing status updates.
• Route accounts-payable emails (bills, statements, vendor requests) through the review queue and, upon explicit user action, send replies on the connected user’s behalf.
• Generate per-client tone and communication summaries for firm owners.

12.3 How we store Google user data

OAuth refresh tokens are encrypted at rest. Email content and metadata retrieved from Gmail are stored in our database in the United States, encrypted at rest (AES-256) and in transit (TLS 1.2+), and protected by role-based access control and row-level security scoped to the connecting user’s firm. Retrieved email is retained for the duration of the engagement and for the retention periods required by applicable law (see Section 7). Users may disconnect the Google account and request deletion of stored Gmail content at any time by contacting privacy@rbr.apexblueprint.ai.

12.4 How we share Google user data

We do not sell Google user data. We do not transfer Google user data to third parties except: (a) infrastructure subprocessors (cloud hosting, database, error monitoring) acting on our behalf under written confidentiality and security obligations; (b) as necessary to comply with applicable law, subpoena, or court order; (c) as necessary to prevent fraud, abuse, or a security incident; or (d) as part of a merger, acquisition, or sale of assets, subject to notice and this policy continuing to apply. We do not use Google user data to serve advertising.

12.5 Human access to Google user data

Randolph Atlas personnel do not read the content of end users’ Gmail messages except (i) with the user’s explicit prior consent for a specific support request; (ii) as necessary for security investigations or to comply with applicable law; (iii) to the limited extent necessary to operate or debug the Service where automated processes are insufficient; or (iv) in aggregate, de-identified form to improve operational features. Access is logged and least-privileged.

12.6 Use of AI and machine learning

Where Randolph Atlas uses AI models to classify sentiment, summarize threads, or draft replies, Google user data is sent to those models only to serve the user request that invoked the feature. Google user data is not used to train, retrain, or fine-tune generalized AI/ML models, and we do not permit our AI subprocessors to use Google user data for their own model training.

12.7 Limited Use affirmation

Randolph Atlas’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to This Policy

Material changes will be communicated via a prominent notice in the Service and/or by email to the account owner at least 30 days before the change takes effect, or as required by applicable law. Non-material clarifications may take effect immediately. We encourage you to review this policy periodically.

14. Contact