1. Who we are
Rai2nbow is provided by Vista Ventures Holding INC., 16192 Coastal Hwy, Lewes, DE 19958, United States (“we”). Contact: privacy@rai2nbow.com.
Our representative in the EU is PRIME FLOW S.R.L., 32 Regina Maria Blvd., ground floor, office no. 12, module “K”, Sector 4, Bucharest, Romania. You can also write to it about your data.
2. Whose data this policy covers
- Business users: people who use the Rai2nbow console for a business customer, and visitors of rai2nbow.com. We decide how this data is used.
- Buyers: people who ordered from a business that uses Rai2nbow, and whom that business contacts through Rai2nbow. The business decides how their data is used, and we handle it on the business's instructions. Buyers should also read the privacy notice of the business they ordered from.
3. What data we receive
| From | Data |
|---|---|
| Business customers | Staff names, email addresses, roles and login records; settings; their buyers' order details (name, phone number, delivery address, products, price, order status) and opt-out records |
| Meta, when a business connects its WhatsApp Business account | The business's WhatsApp account and phone number identifiers, display names, templates, quality ratings and limits; its business portfolio's name and verification status; buyers' WhatsApp messages, profile names, phone numbers or WhatsApp user IDs, and message statuses; call events and call audio |
| The contacts we handle | Message text, call transcripts, call recordings where the business turns recording on, and the outcome of each contact |
| Visitors of rai2nbow.com | Server logs only (IP address, time, page), kept for security. No cookies and no analytics. |
4. How we use it
- To provide the Service the business asked for: confirm orders, answer buyers, check addresses, place calls, pass confirmed orders to the business's courier, and show the results in the console.
- To keep the Service secure and working: logs, abuse prevention and troubleshooting.
- To bill business customers and to meet legal duties.
We do not sell personal data, do not use it for advertising, and do not use one business's data for another business. AI models read messages and listen to calls to understand buyers and to write or speak replies. These models run for us on Google Cloud (Vertex AI) in the EU, and Google does not use the data we send them to train its models.
5. Legal bases, for data we decide on
Contract, to provide the console and the Service to business customers; legitimate interests, for security, fraud prevention and improving the Service; legal obligations. For buyers' data, the business customer chooses the legal basis, such as carrying out the buyer's order.
6. Who else handles the data
These providers run parts of the Service. Each may use the data only to provide its service to us.
| Provider | What it does for us | Data | Where |
|---|---|---|---|
| Hetzner Online GmbH | Servers, databases, storage of call recordings | All Service data | Germany |
| Google Cloud (Vertex AI, BigQuery) | AI that reads messages, handles calls and checks AI replies; the archive of event logs | Message text, call audio, transcripts; event logs | EU |
| LiveKit (LiveKit Cloud) | Real-time audio of WhatsApp calls | Call audio and call events | EU |
| Meta Platforms | WhatsApp Business Platform | WhatsApp messages and calls | Meta's infrastructure |
| Zadarma | Phone calls | Buyers' phone numbers, call audio | EU |
| Infisical | Storage of keys and access tokens | Keys and tokens, no buyer data | EU |
| Hostinger | Our website and our support and privacy mailboxes | Website visits and the emails you send us; no WhatsApp data | France (EU) |
| Stripe | Card top-ups of credits | Billing name, address and card payments; card numbers stay with Stripe | EU and US |
On the business customer's instructions we also send order details to the delivery and warehouse partners it chooses, for example its courier. We give data to authorities only as section 11 describes.
7. Where data is stored, and transfers
We store the Service's data in Germany, and the archive of event logs in the EU (Google Cloud). Meta and Stripe may process data outside the EU. Where personal data leaves the EU or the UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
8. How long we keep it
| Data | Kept for |
|---|---|
| Call audio, message text, transcripts, and buyers' personal order details | 90 days |
| Event logs, including any personal details in them | 90 days in our database, then 10 years in an archive (Google Cloud BigQuery, EU) |
| Conversation sessions and WhatsApp message records | 1 year |
| Orders and call records, without the personal details above | 2 years |
| Incoming webhook records | 30 days |
| Records of staff actions in the console | 400 days |
| Opt-out records | As long as the Service runs, so the person is never contacted again |
| Backups | 30 days |
A business customer can set shorter periods. When a business leaves, its data is deleted as section 10 describes.
9. Security
Encryption in transit and at rest. Buyers' personal fields are encrypted with keys held separately for each business. Each business has its own database schema and login. Staff access is limited to those who need it, and staff actions in the console are logged.
10. Deletion and your rights
- Buyers. To stop messages, reply STOP, or the stop word in your language, to any message. To see or delete your data, ask the business you ordered from, or write to privacy@rai2nbow.com with your phone number and the business's name; we pass the request to the business and carry out its decision.
- Business users and visitors. You can ask to see, correct, delete or move your data, or object to its use, at privacy@rai2nbow.com. We answer within one month. You can also complain to your data protection authority.
- How to ask for deletion, and what we delete: rai2nbow.com/data-deletion.
11. Requests from public authorities
We check that every request is lawful, challenge requests that are not, disclose only the minimum the request requires, document every request and our answer, and tell the business concerned unless the law forbids it.
12. Data from Meta
Our use of information we receive from Meta's APIs follows the Meta Platform Terms and Developer Policies.
13. Children
The Service is for businesses and is not directed at children.
14. Changes
We publish changes on this page with a new date, and tell business customers of important changes by email.