Privacy Policy

What we collect

• Account information: your name, work email, and workspace details you provide when you sign up.
• Workspace data: the accounts, locations, kits, campaigns, vendors, quotes, spend, and rep activity you and your team enter into Rekit.
• Uploaded files: photos, artwork, and documents you upload (for example placement photos and production files).
• Usage and device data: basic log and device information (pages visited, timestamps, browser type) used to operate and secure the service. This includes the IP address a request came from, which we also use to rate-limit abuse.

How we use it

We use your data to provide and operate the service, authenticate you, send transactional notifications you have enabled, respond to support requests, and maintain security and reliability. We do not sell your data, and we do not use your workspace data for advertising.

Service providers

Rekit relies on a small set of subprocessors to run. They process data only to provide their service to us:

• Supabase: database, authentication, and file storage.
• Vercel: application hosting and delivery.
• Resend: transactional email delivery.
• Stripe: payment processing, if and when you subscribe to a paid plan.
• Anthropic: AI processing for reading vendor quotes, invoices and other files you upload, reading field photos, answering questions in Ask, and drafting written summaries. Details in “AI features” below.
• PostHog: visit counts for our public website only (this site’s home, pricing and legal pages). It receives anonymous page views; nothing is stored on your device unless you accept analytics cookies, and Reject stops the counting. A request for a pilot is counted without your address. The Rekit app itself (everything after you sign in, the sign-in pages and onboarding) sends PostHog nothing: no page views, no usage events, no account or workspace details, no screen recordings.
• Sentry: error monitoring. Receives the error and where in our code it happened. Request bodies, cookies, page-address query strings and user identities are removed before a report is sent.
• Expo: push notification delivery to the Rekit Field app. Receives the device token and the notification text, which can include the title of the request it refers to.

Two delivery paths are chosen by you rather than by us. Browser push notifications travel through the push service your own browser vendor operates, and if you subscribe your Rekit calendar feed into an external calendar app, that provider fetches and stores a copy of the feed on its servers.

AI features

Rekit uses Anthropic’s API for a defined set of features: reading a vendor quote, invoice, distribution list or other file you drop in; tagging and describing field photos; turning a question in Ask into one of Rekit’s reports; and drafting negotiation briefs, event narratives and mission reports. Each sends only what that feature works on: the file or photo, the question, or the figures and names behind the summary. Account imports and column mapping do not use AI.

Under Anthropic’s commercial terms, Anthropic does not train its models on this content. Anthropic keeps API inputs and outputs for up to 30 days, longer only when its safety systems flag content for review, and may process requests in data centers outside the United States. Rekit does not have a zero-retention agreement with Anthropic today.

On our side, Rekit does not store prompts. It stores what you keep (an extracted quote you save, a narrative you accept) and a log of each AI request: the feature, who asked, when, and whether it completed, never the content. A workspace owner can see that log, and can turn every AI feature off, in Settings under Data. When AI is off, those features fall back to manual entry and nothing from the workspace is sent to Anthropic.

Figures Rekit calculates (totals, budgets, variance, savings ranges) come from Rekit’s own code and your workspace data. Figures the AI reads out of a document, such as the prices on an invoice, are shown to you to confirm before they are saved. AI-written text can restate figures, so treat it as a draft and check it before you send it.

ClearQuoter benchmarks (optional)

A workspace owner can choose, in Settings, to contribute invoice prices to ClearQuoter, a pricing benchmark service operated by the same team as Rekit. When it is on, each invoice line’s vendor name, item, unit price and quantity are contributed under a pseudonym for your workspace; your brand name, your accounts and the people in your workspace are not. It is off unless an owner turns it on, and turning it off stops further contributions.

Data ownership, retention, and deletion

Your workspace data is yours. We retain it for as long as your workspace is active. There is no automatic expiry: records you archive inside Rekit are hidden rather than removed, so that your history survives ordinary tidying up.

A workspace owner can download an export of the workspace at any time from Settings: every core table as CSV in one archive, with a list of the stored files and the record each belongs to. You can request deletion of your workspace, or the return of its files, at any time by contacting us. We will act on verified requests and complete them within 30 days, keeping only what we are required to keep for legal or security reasons. We are direct about the window because deletion is handled by a person today rather than by a self-serve button.

Deletion and backups. Our database is backed up daily and each backup is kept for seven days, in the same region as the live database. Deleting a record removes it from the live system immediately, but a copy remains in any backup already taken until that backup ages out on its own cycle. We do not edit backup media. In practice this means the longest gap between a deletion request and true erasure everywhere is seven days after the deletion is done.

How long we keep what. “While your workspace exists” means the data is kept until the workspace is deleted, and removed with it.

Outside Rekit, our service providers keep what they receive for their own periods: AI request content at Anthropic up to 30 days (content their safety systems flag, up to two years); request logs at Vercel one day; error reports at Sentry 30 days; email content and delivery logs at Resend 30 days; public-website visit counts at PostHog one year; billing records at Stripe for as long as the law requires (five years or more). Invoice prices contributed to ClearQuoter, if a workspace owner opts in, stay in that benchmark corpus.

Where your data is stored

All Rekit workspace data is stored in the United States, in Oregon. Both the database and the servers that run the application sit in the same region. Requests reach you from whichever edge location is nearest, but your records are read from and written to Oregon.

Some processing necessarily leaves that region. Email delivery, error monitoring and the public website’s visit counts run with providers in the United States. AI requests go to Anthropic, which may process them in data centers outside the United States. Payments run through Stripe, and push notifications through Expo and your browser’s push service. We do not currently offer data residency outside the United States, or a guarantee that AI processing stays inside it.

Security

Data is encrypted in transit and at rest. Access to workspace data is scoped per organization: Rekit’s servers check your workspace membership and role on every read and write, and row-level security in the database enforces the same separation for any direct access, so that one workspace’s data is not visible to another. Uploaded photos and documents are held in private storage and served through links that expire. Sign-ins, role changes, invitations, removals and exports are recorded in a security log your workspace’s admins can read in Settings; it is kept for 13 months.

No system is perfectly secure, but we work to protect your data and to limit access to what is necessary to operate the service. We hold no third-party security certification today, and we would rather say so than imply one.

Calendar feed

Rekit can give you a personal subscribe URL for your workspace calendar, covering event names and key dates, campaign gates, and retailer booking deadlines. That URL is unauthenticated by design: calendar apps cannot sign in, so the unguessable link in the address is the only thing protecting it. Anyone who has the link can read that schedule without a Rekit account, so treat it like a password.

When you paste the URL into Google Calendar, Outlook, or Apple Calendar, that provider fetches the feed on its own schedule and keeps a copy of the contents on its servers. You can create a new link at any time in Settings, which immediately stops the old one from working; the link is shown once, when it is created. Creating a new one does not remove data a calendar provider has already fetched.

Cookies

We use cookies that are necessary to keep you signed in and to remember your active workspace. If you use two-factor sign-in and choose not to be asked for a code on a device, a cookie remembers that device for 30 days; you can forget it at any time in Settings. On our public website, and only if you accept, analytics storage remembers that you have visited before. We do not use third-party advertising cookies.

Your choices

You can update your account details in-app, control which notifications reach your inbox in your notification preferences, and request access, export, or deletion of your data by email. Rekit is a business tool intended for use by adults; it is not directed to children under 18.

Changes

As Rekit is in early-access pilot, this policy may change as the product develops. We will update the effective date above when we make material changes.