# Privacy Policy

**Last updated:** October 26, 2026

This Privacy Policy explains how **Rare X Labs Inc.** ("**Rare**," "**we**,"
"**us**"), a company incorporated in British Columbia, Canada, collects,
uses, and discloses personal information through the hosted version of Rare
CRM at rarecrm.ai (the "**Service**").

We're a relationship-journal product built around a genuinely portable
data format — you can read what that design commitment means for your data
in [Section 8](#8-exporting-and-deleting-your-data).

## 1. Two kinds of personal information

This is a relationship-journal product, so we handle two different kinds of
personal information, and they're subject to different rules:

- **Account information** — about *you*, the person or organization who
  signed up: your name, email, authentication details, billing
  information, and how you use the Service. Rare is the one responsible
  for this information, as described below.
- **Journal content** — the entries, contacts, notes, and attachments *you*
  write into your journal, which routinely includes personal information
  about *other people* (your contacts, clients, colleagues — "**Third-Party
  Data**"). For this information, **you are the one responsible for the
  data**, and **Rare acts only as your service provider** — we store,
  sync, and process it on your instructions, to provide the Service to
  you, and not for our own purposes. If you're on a team or business plan,
  your organization is responsible for this data, not Rare.

If you are a person whose information appears in someone else's Rare
journal (rather than a Rare account holder yourself), see
[Section 9](#9-if-youre-a-contact-not-an-account-holder).

## 2. What we collect

### From you directly

- **Account data**: name, email address, authentication credentials (or
  identity from your login provider), organization/team details.
- **Billing data**: handled by our payment processor on our behalf — see
  [Subprocessors](https://rarecrm.ai/legal/subprocessors) — we receive subscription status and
  the minimum needed to reconcile billing, not your full card number.
- **Journal content**: everything you write or import into your journal,
  including any Third-Party Data within it, and any files you attach.
- **Voice recordings**: if you use voice capture, your audio clip is
  processed to produce a transcript (see [Section 3](#3-how-we-use-it) and
  [Section 5](#5-subprocessors-and-third-parties)).
- **Waitlist/application data**: if you join the waitlist before an
  account exists, we collect your email and any answers you provide to
  qualify and review applications.
- **Support communications**: anything you send us at contact@rarecrm.ai.

### Automatically

- **Usage and diagnostic data**: log data, device/browser information, IP
  address, and how you interact with the Service, for security, debugging,
  and reliability.
- **Website visits**: on rarecrm.ai, the pages you view, what you click,
  whether you join the waitlist, and recordings of each visit (how you
  scroll and move through the pages) to see where the site helps and where
  it loses people. Recordings mask everything you type into a form field,
  including your email.
- **Cookies / local storage**: used for session management and basic
  product functionality, as well as analytics cookies that help us
  understand how the Service is used — see
  [Subprocessors](https://rarecrm.ai/legal/subprocessors) for which providers we use.

### From connected third parties, at your direction

- **Google Contacts**: if you connect Google Contacts sync, we access the
  contact data your Google account authorizes, under the scope you grant,
  to compare and merge it with your journal. You control the connection
  and can disconnect it at any time in Settings. We don't access your
  Google account for anything beyond what the sync feature does.

### Google user data ("Limited Use")

Rare CRM's use and transfer of information received from Google APIs
adheres to the
[Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
including the Limited Use requirements. In practice, that means the
contact data your Google Contacts connection authorizes is used only to
provide and improve the sync feature you turned on — never for
advertising, never transferred to a third party except as needed to
provide that feature or as required by law, and never reviewed by a human
except with your consent, to investigate abuse or a security incident, or
to comply with the law.

## 3. How we use it

We use personal information to:

- provide, operate, and maintain the Service (store your journal, serve
  the web/mobile apps, run sync, keep your data durable and versioned);
- power the Service's AI features — the relevant journal content, your
  prompt (if any), and (for voice capture) your audio are sent to the
  configured AI/transcription provider to generate a response or
  transcript;
- authenticate you and secure your account;
- process billing and payments;
- communicate with you — service notices, security alerts, and, only with
  your consent or as permitted by law, product updates;
- monitor, debug, and improve the Service's performance and reliability;
- review waitlist applications and manage early access;
- meet legal obligations and enforce our [Terms of Service](https://rarecrm.ai/legal/terms).

We may also create aggregated or de-identified data from the information
we collect — data that doesn't identify you or any other individual — and
use it for any purpose, including analytics, benchmarking, and improving
the Service.

We do not sell personal information.

## 4. Legal basis (for users in regions that require one)

Where applicable privacy law (such as PIPEDA or BC's PIPA) requires a
stated basis, we rely on: your consent (where you give it, e.g. connecting
Google sync or opting into product email), performance of our contract
with you (running the Service you signed up for), and our legitimate
interests in operating and securing the Service, balanced against your
rights. For Third-Party Data, the legal basis is yours to establish — see
[Section 9](#9-if-youre-a-contact-not-an-account-holder).

## 5. Subprocessors and third parties

We use a small number of service providers to operate the Service —
hosting and storage, authentication, payments, the AI and transcription
models behind the assistant and voice capture, product analytics, and
(only if you connect it) Google Contacts sync. Each processes personal
information only as needed to perform its function for us, under its own
confidentiality and data-protection commitments, and we keep the current
list on a dedicated page — see [Subprocessors](https://rarecrm.ai/legal/subprocessors) —
rather than here, so it can be kept accurate as our stack changes without
requiring a full revision of this policy. If you want notice before we add
or replace a subprocessor, you can ask to be added to the subprocessor
change list, as described on that page.

We may also disclose personal information: to comply with a legal
obligation (a valid court order, subpoena, or similar); to protect the
rights, safety, or property of Rare, our users, or the public; or in
connection with a merger, acquisition, or sale of assets, with notice to
you where required by law.

## 6. Where data is processed and stored

We and our subprocessors may process and store your information in one or
more countries, which may include countries other than the one you're
located in. We choose our infrastructure providers and locations based on
performance, reliability, and cost, and this may change as the Service
grows.

## 7. How long we keep it

- **Active accounts**: journal content, including its version history, is
  kept for as long as your account is active, so you always have your full
  history available.
- **After cancellation or deletion**: your data is retained for 30 days —
  from the date you delete your account, or from cancellation or
  suspension for non-payment (see
  [Terms of Service, Section 7](https://rarecrm.ai/legal/terms#7-billing)) — in case of
  accidental cancellation, then permanently deleted from active systems.
- **Billing records**: kept as long as required by tax and accounting law
  (in Canada, generally six years).
- **Waitlist data**: kept while your application is pending, and for a
  reasonable period after a decision for our own records, unless you ask
  us to delete it sooner.

## 8. Exporting and deleting your data

Your journal is built to be portable: you can export the whole thing —
every entry, every version — at any time, and use it independently of
Rare. This isn't a compliance afterthought; it's how the product is built.

To delete your account and data, use the in-product deletion option or
email **contact@rarecrm.ai**. We'll delete your account data within the
retention window in
[Section 7](#7-how-long-we-keep-it), except what we're required to keep by
law (e.g., billing records).

## 9. If you're a contact, not an account holder

If someone else's Rare journal contains information about you, Rare is
processing that information as their service provider, on their
instructions — we don't control why they collected it or what they use it
for. To exercise a right over that data (see, correct, or ask to have it
deleted), the right place to start is the account holder who wrote it.
If you're unable to resolve it with them, you can contact us at
**contact@rarecrm.ai** and we'll pass on requests we're able to act on
consistent with our obligations to our customer and the law.

## 10. Your rights

Depending on where you are, you may have the right to:

- access the personal information we hold about you;
- correct inaccurate information;
- request deletion, subject to legal retention requirements;
- withdraw consent (e.g., disconnect Google sync, opt out of product
  email) without affecting the lawfulness of processing before that;
- (California/CCPA) know what personal information is collected, request
  its deletion, and not be discriminated against for exercising these
  rights;
- complain to a supervisory authority — in Canada, the Office of the
  Privacy Commissioner.

To exercise any of these, email **contact@rarecrm.ai**. For account data,
we handle this directly. For journal content about you specifically as a
third party, see [Section 9](#9-if-youre-a-contact-not-an-account-holder).

## 11. Security

We use technical and organizational measures appropriate to the
sensitivity of the data — encryption in transit, access controls scoped
per tenant, and versioned, auditable storage. No system is perfectly
secure, and we can't guarantee absolute security.

## 12. Children

The Service isn't directed at children, and we don't knowingly collect
personal information from anyone under 18 (or the age of majority in their
jurisdiction). If you believe a child has provided us information, contact
us and we'll delete it.

## 13. Changes to this policy

We may update this policy as the Service evolves. For a material change,
we'll give notice — for example, by email or an in-product notice — before
it takes effect.

## 14. Contact

Questions, requests, or complaints about this policy: **contact@rarecrm.ai**.

---

*This document works together with the
[Terms of Service](https://rarecrm.ai/legal/terms) and the
[Subprocessors](https://rarecrm.ai/legal/subprocessors) page. Where this policy and the
Terms conflict on how personal information is handled, this policy
controls.*