Privacy policy

This policy is from Rusti.Red ("we", "us"). It covers people who visit rusti.red, people who have a login (a shop's owners, its office staff, and its technicians), and the partners who send shops our way.

If you are a customer of a shop that uses Rusti.Red (you booked a visit, or got a quote, an invoice, or a text from them), the shop decides what is kept about you and why, and its own privacy policy applies. Every booking, quote, and invoice page links to it. We hold that information for the shop; see "Homeowners and other customers of a shop" below.

We collect what running the service takes, and nothing to sell.

About you

Your name, email, mobile number, and password (kept only as a one-way hash). A photo and a light or dark theme, if you choose them. The secret behind two-factor authentication, if you turn it on.

About your shop

Its name, logo, address, phone, timezone, and settings. For texting registration: its legal name, EIN, address, website, and a contact person.

Your shop's records

What you and your people put in: customers with their addresses and equipment, the price book, quotes, invoices, jobs, photos, signatures, notes, payments, and messages.

Billing

Your plan and its status and, from Stripe, your card's brand, last four digits, and expiry date. The card number itself goes straight to Stripe and never reaches our servers.

Sign-ins

The time, internet (IP) address, and browser of each session, which you can see and end under Active sessions.

Help

The messages you send us in Help, and which page of the app you were on when you wrote, so we can see what you were looking at.

Email

What you write to [email protected], and what we answer.

Partners

If you are one of our partners: your name, email, and the code you share; the shops that signed up through you (their name, their plan, and whether they pay); and what you have earned and been paid. Stripe holds your bank account, identity check, and tax details, not us.

Technical logs

Requests reach us through a security service that stands in front of the site, and the address, time, and page of a request may be logged for a short time to keep the service secure and to limit abuse. Errors are logged so we can fix them.

We do not buy information about you from anyone, and we do not build advertising profiles.

We use no advertising cookies, no analytics trackers, and no social media pixels.

• Cookies that keep you signed in and protect forms from forgery, and one more if you tick "Stay signed in". The app cannot work without them.
• The security service in front of the site may set a cookie of its own, to tell people from bots.
• In your browser's storage: your theme and layout choices and, so the app works with no signal, a copy of the day's jobs, your quotes, the price book, your Help conversation, and anything waiting to be sent. It stays on that device.
• If you arrive through a partner's link, which partner sent you, kept in your browser for 60 days so that signing up credits them. It goes to us only when you sign up.

A browser's "Do Not Track" or Global Privacy Control signal changes nothing here, because we do not track you across sites, and we do not sell or share your information to begin with.

• To run the service for your shop: show your records to your people, send your quotes, invoices, texts, and emails, receive your customers' replies, and charge for your plan.
• To send you messages about your account: verifying your email, resetting a password, invites, receipts, an export that is ready, and notices about the service or these policies.
• To answer you in Help or by email.
• To keep the service secure, stop abuse, and fix errors.
• To meet our legal and tax obligations.

We do not send newsletters or marketing email. We do not sell personal information, and we do not use it or share it for advertising.

Companies that work for us handle information only to do their part of running the service:

• hosting our servers and backups, in the United States;
• standing in front of the site to block attacks and speed it up;
• Stripe, which charges for your plan and processes card payments from a shop's customers into the shop's own Stripe account;
• carrying a shop's texts, and registering its number with the mobile carriers;
• sending and receiving email, including a shop's customers' replies, and running the mailbox where an email you write to us arrives.

A shop's texting registration (its legal name, EIN, address, and contact) goes through our texting provider to the carriers' registry and the carriers, who require it.

Beyond that, we disclose information only:

• when you ask us to, and to the other people in your own shop according to their role;
• when the law requires it. We ask for a valid legal order and hand over only what it covers;
• to protect the service, our rights, or someone's safety, for example while looking into fraud or abuse;
• if the business is sold or merged. We would tell you before your information moves to a new owner, and this policy would keep applying to it until you are told otherwise.

People at Rusti.Red look at a shop's records only to help with something you asked us about, to fix an error that stopped something from working, to look into a security problem or a report of abuse, or when the law requires it. Your Help conversation is different: it is written to us, so we read it.

• Your shop's records: for as long as the shop has an account, including after a plan ends, so you can come back to them or download them. An owner can delete the shop, and everything in it, at any time from the Import and export page in Settings.
• Your own login: until you delete it in Account settings. The work you did, such as a quote you wrote or a note on a job, stays with the shop's records.
• A customer's yes or no to texts: with the shop's records, for as long as the shop has an account. It is in the shop's export, which a shop keeps for its own proof.
• Your Help conversation: it stays with us after your login is deleted, under your name and your shop's name, as a record of what was asked and answered.
• An account export: the download works for seven days.
• Backups: kept for a limited time and then overwritten. Something deleted from the live service can remain in a backup until then.
• Billing records: for as long as tax law requires.

• See and correct: your name, email, mobile number, and photo are in Account settings, and the shop's details are in Settings.
• Take it with you: an owner can download the shop's records at any time.
• Delete: remove your own login in Account settings. An owner can delete the whole shop from the Import and export page in Settings.
• Ask: for anything you cannot do yourself, write to [email protected] and we will answer within 30 days. We may need to confirm that it is you, and we keep what the law requires.

Some states give their residents specific privacy rights: to know, to correct, to delete, and to opt out of the sale of their information or of targeted advertising. We give these to everyone, wherever they live, and we will never treat you worse for using them. Since we do not sell information or advertise with it, there is nothing to opt out of.

If we turn a request down, we will say why, and you can ask us to look again.

When you book with a shop, or it sends you a quote, an invoice, or a text through Rusti.Red, the shop is the business responsible for your information. We store and handle it for the shop, on its instructions and under our agreement with it.

To see, correct, or delete what a shop holds about you, ask the shop. Its contact details and its privacy policy are linked at the bottom of its pages. If you write to us instead, we will point you to the shop.

What we promise you directly: we do not sell your information, we do not use it for marketing of our own, and we do not let one shop see another shop's customers.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party.

When you pay by card, your card details go to Stripe, not to the shop and not to us.

Everything travels over an encrypted connection (HTTPS). Passwords are kept only as one-way hashes. Each shop's records are kept apart from every other shop's by the software itself. Two-factor authentication is there for every login, and anyone can see and end their own sessions.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the shop's owners without unreasonable delay and say what we know, so that a shop can meet its own duties to its customers.

The service runs in the United States, for shops in the United States. If you use it from somewhere else, your information is sent to and kept in the United States.

The service is for businesses and for people 18 or older. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.

When this policy changes, the date at the top changes too. If a change affects how we use information we already hold, we will email the shop's owners or show a notice in the app before it takes effect.

Questions about this policy or your information? Write to [email protected]. If you have an account, Help in the app reaches the same people.