Privacy Policy

Riff OS is a product of Chiller Tech Support LLC, a Utah limited liability company headquartered in Salt Lake City, Utah (“Chiller Tech,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you access or use the Riff OS platform at riffos.io and any associated applications or services (collectively, the “Service”).

2.1 Information You Provide Directly

• Account information: Name, email address, business name, phone number, billing address when you register or purchase a subscription.
• Payment information: Processed exclusively through Square. We do not store raw card numbers on our servers.
• Business data: Inventory records, customer information, repair orders, lesson schedules, rental contracts, and other operational data you enter into the platform.
• Support communications: Messages you send to our support team.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, click events, and navigation paths — collected to improve the platform.
• Device and browser data: IP address, browser type, operating system, and device identifiers.
• Cookies and local storage: Session tokens, preference cookies, and analytics identifiers. See Section 7 for cookie details.

2.3 Information From Third Parties

We may receive limited data from Square (payment confirmation and subscription status) and from identity verification services if you choose to use them.

• Provision, operate, and improve the Riff OS platform
• Process payments and manage subscription billing
• Send transactional emails (receipts, onboarding instructions, service alerts)
• Provide customer support and respond to inquiries
• Monitor platform health, detect fraud, and maintain security
• Comply with applicable laws and legal obligations
• Send product updates and feature announcements (you may opt out at any time)

We do notsell your personal data. We do not use your business's operational data (inventory, customers, transactions) to train AI models or for any purpose beyond delivering the Service to you.

We share your information only in the following circumstances:

• Service providers: Vercel (hosting), Square (payments), and analytics tools operating under data processing agreements with appropriate protections.
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with advance notice to affected users.
• With your consent: For any other purpose with your explicit prior consent.

We retain account and operational data for as long as your subscription is active and for a period of 90 days following cancellation, during which you may request a full data export. After 90 days, data is permanently deleted from production systems. Backups are purged within 30 additional days.

All data in transit is encrypted via TLS 1.3. All data at rest is encrypted using AES-256. Access to production data is restricted to authorized personnel only, governed by role-based access controls. We conduct periodic security reviews and vulnerability assessments.

No system is 100% secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law, no later than 72 hours after becoming aware of the breach.

We use the following categories of cookies:

• Strictly necessary: Session authentication tokens. Cannot be disabled without breaking the Service.
• Functional: User preference cookies (theme, language). Persist for 12 months.
• Analytics: Aggregate usage data. You may opt out via your browser settings or by emailing privacy@riffos.io.

We do not use advertising or cross-site tracking cookies.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Export your data in a machine-readable format
• Withdraw consent for optional processing
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email privacy@riffos.io. We respond within 30 days.

Riff OS is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such information, contact us immediately at privacy@riffos.io.

We may update this Privacy Policy periodically. Material changes will be communicated via email to account holders at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Chiller Tech Support LLC
Salt Lake City, Utah
privacy@riffos.io