Privacy Policy

This Privacy Policy explains how Simplisik LLC (“Simplisik”, “we”, “us” or “our”) collects, uses, shares and protects personal information through Rightnote. Rightnote includes the Rightnote Chrome extension for Gmail, the web app at app.rightnote.ai, our email tracking service at t.rightnote.ai, and the rightnote.ai website (together, the “Services”). It also explains your choices and rights.

1. Scope and our role

This policy covers information about:

• people who sign in to Rightnote or join a workspace (“customers” or “you”);
• people our customers email or keep as clients in Rightnote (“contacts” or “recipients”), including people who open, click or unsubscribe from emails sent through Rightnote;
• people who visit rightnote.ai.

Our role. For account information and our website, we decide how information is used, so we are the “controller” or “business”. Contact and email information that customers manage in Rightnote belongs to those customers. When we process it, including tracking opens and clicks on their emails, we act on the customer’s behalf as a “processor” or “service provider”, and the customer’s own privacy practices also apply. If you are a recipient and contact us about a customer’s emails, we may refer you to that customer and help them respond.

2. Google user data

When you sign in with Google, Google asks you to grant Rightnote the permissions (“scopes”) below. Rightnote uses each one only for the purposes listed. The data is accessed by our servers through the Gmail API, and by the Chrome extension inside your browser while you use Gmail.

What the Chrome extension reads in Gmail

The extension runs only on Gmail (mail.google.com) and on the Rightnote web app. In Gmail it reads the email addresses and names of the people in the threads and inbox rows you look at, and Gmail’s thread identifiers, to show the matching client, deal, sequence and stage next to them. When you ask Rightnote to create or fill in a client from an email you have open, it sends that email’s sender, subject and text (including the signature) to our servers to suggest a name, title, company, phone number and deal details. It does not read or upload other email.

What we store from Gmail

• Connection details: your Gmail address, the scopes you granted, and the OAuth refresh and access tokens Google issues. Tokens are encrypted with AES-GCM before they are stored.
• Emails Rightnote sends or tracks for you: recipient, subject, a short text snippet, Gmail message and thread identifiers, and when the email was sent, opened, clicked, replied to or bounced. The subject and body of your sequence steps and templates are stored as you write them.
• Replies in tracked threads: the sender, date, a short snippet, a classification (for example “positive”, “not now” or “out of office”) and a one-line summary.
• A message log for your clients: for messages between your inbox and people who are clients in Rightnote, the Gmail message and thread identifiers, direction (sent or received), subject and date. We use it for last-contact dates, email activity and reply times.
• Client suggestions: for people you email who aren’t clients yet, their name, email address and domain, how many threads you share, and why we suggested them.
• Meetings: the title and time of calendar invitations sent to or from your clients.
• Sync state: Gmail’s mailbox history position, so we only process new messages.

What we don’t store

• We don’t store a copy of your mailbox. To detect replies we read message headers. We read a message’s body only when it is a reply, bounce or calendar invitation in a thread Rightnote tracks, and we keep only the snippet, classification and summary described above.
• We don’t store attachments.
• Email text the extension sends to suggest client details is processed to produce those suggestions and is not kept. Only the details you save become part of the client record.

Limited Use

Rightnote’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The extension also complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described in this section.
• We don’t transfer it to others except as needed to provide or improve those features (for example, to our hosting provider), to comply with applicable law, or as part of a merger, acquisition or sale of assets, with notice to you.
• We don’t use or transfer it for advertising, including personalized, retargeted or interest-based ads.
• We don’t sell it, and we don’t use it to determine creditworthiness or for lending.
• Our staff don’t read it unless you give us permission for specific messages (for example, in a support request), it’s necessary for security purposes such as investigating abuse, it’s required by law, or the data is aggregated and anonymized for internal operations.
• We don’t use it to develop, improve or train generalized AI or machine-learning models.

You can see and remove Rightnote’s access to your Google account at any time at myaccount.google.com/permissions. Without it, Rightnote can’t send sequence steps or detect replies, so your active sequences pause until you reconnect.

3. Other information we collect

Information you give us

• CRM information: clients (contacts) and companies, including names, email addresses, job titles, phone numbers, cities and time zones; deals, their values, stages and close dates; notes; reminders; meetings; pipelines; and the sequences and templates you write.
• Workspace information: your workspace name, your role, the email addresses of people you invite, and your settings (such as send windows and daily sending limits).
• Billing information: your plan, billing period, seats and subscription status. Stripe, our payment processor, collects your card details. We never receive your full card number, but we can see limited details such as card brand, last four digits and expiry date.
• Communications: what you send us when you email or call us.

Information collected automatically

• Sign-in records: when you signed in, the kind of session (web or extension), basic device details and when the session was last used. Session tokens are stored only as cryptographic hashes.
• Extension details: the extension version and when it last connected, so we can show whether Rightnote is working in your inbox.
• Request data: our servers and hosting provider automatically receive technical information with each request, such as IP address, browser type and the page requested. We use it to deliver and secure the Services, for example to limit repeated requests.
• Activity: an activity history in your workspace, such as stage changes and sequence events.

Our website

rightnote.ai does not use analytics or advertising cookies, and it serves its own fonts and scripts, so visiting it does not send your information to a third-party font, analytics or script service.

Information from third parties

Google provides the account and Gmail information described in Section 2. Stripe tells us whether payments succeed and the status of your subscription.

4. How we use information

• To provide the Services: sign you in, show your clients and deals inside Gmail, send sequence steps on schedule, stop sequences when someone replies, unsubscribes or bounces, fire reminders, and produce reports.
• For billing: process payments, manage trials and subscriptions, and prevent payment fraud.
• To communicate with you: send service, security, billing and legal messages and respond to your requests. If we send marketing emails, you can unsubscribe at any time.
• For safety and security: authenticate users, enforce sending limits, prevent abuse, spam, fraud and illegal activity, and enforce our Terms of Service.
• To fix and improve the Services: troubleshoot problems and fix bugs. We use Google user data for this only as allowed by Limited Use.
• For legal reasons: comply with the law and legal process, and establish or defend legal claims.
• With your consent, or as you direct.

We may create aggregated or de-identified information that cannot reasonably identify you or any individual and use it for any lawful purpose. We never create it from Google user data except as Limited Use allows.

5. AI processing

Rightnote uses AI models to classify replies in tracked threads (for example “positive”, “not now”, “unsubscribe” or “out of office”), to write the one-line summary shown in “Needs you”, and to suggest client and deal details from an email you have open. These models run on Cloudflare Workers AI, on the same Cloudflare infrastructure that hosts Rightnote. The text is processed to produce the result and is not used to train or improve any AI model, by us or by Cloudflare. We do not send your email to other AI providers. When AI is unavailable, Rightnote falls back to simple rules. AI results can be wrong, so you can always change a classification or suggestion.

6. People you email: tracking and unsubscribes

This section is for people who receive email from Rightnote customers, and for customers who send it.

Open and click tracking

Sequence emails, and emails customers choose to track, can contain a small invisible image and links that pass through our tracking service at t.rightnote.ai. When an email’s images load, or a link is clicked, we record that it happened and when, and show it to the sender. Some opens are recorded automatically by email providers’ image proxies or privacy features, so we mark those that look automated. We do not set cookies on the tracking service and do not store recipients’ IP addresses with these events. Senders can turn tracking off. You can avoid open tracking by not loading images in your email app.

Unsubscribing

When the sender has it turned on, emails include an unsubscribe link and a standard List-Unsubscribe header, which many email apps show as an “Unsubscribe” button. Using either stops every Rightnote sequence from that sender’s workspace to your address and marks you as unsubscribed so you aren’t added again. Replying to ask a sender to stop also stops their sequence, because Rightnote stops on any reply.

Your information in a customer’s workspace

Customers decide whom they email and what they keep about their clients. To ask about or change information a customer holds about you, contact that customer. You can also email privacy@rightnote.ai, and we will forward your request or help you directly where appropriate.

7. How we share information

Within your workspace

Members of a workspace can see each other’s names and email addresses. On the Team plan, clients, deals and pipelines are shared with the workspace, and sequences and templates are visible to others when their owner shares them. Workspace admins can manage members and workspace data.

Service providers

We share information with companies that help us run the Services. They may use it only to provide services to us, under contracts that require them to protect it.

Other disclosures

• Legal and safety: to comply with law, subpoenas or court orders, and to protect the rights, property or safety of our users, the public or us.
• Business transfers: in a merger, acquisition, financing, reorganization, sale of assets or bankruptcy. The commitments in this policy, including Limited Use, will continue to apply to the transferred information.
• With your consent or at your direction.

We do not sell personal information and do not share it for cross-context behavioral (targeted) advertising. The Services contain no advertising trackers.

8. Cookies and local storage

rightnote.ai and the tracking service at t.rightnote.ai set no cookies. We do not sell personal information or use it for targeted advertising, so Global Privacy Control and Do Not Track signals currently have nothing to opt you out of. If that ever changes, we will treat Global Privacy Control as a valid opt-out request.

9. How long we keep information

Deleted information may remain in database backups for up to 30 days before it is overwritten. We may keep information longer if the law requires it, or to resolve disputes, prevent fraud or enforce our agreements.

10. Your choices, deletion and rights

Deleting your account

Use Delete account in Settings → Account in the web app. Deleting your account revokes Rightnote’s access to your Google account, stops your sequences, and deletes every workspace where you are the only member, with its clients, deals, sequences and email records. In a shared workspace you are removed and the team keeps the workspace’s data. If you are the only admin of a shared workspace, make another member an admin first. You can also email privacy@rightnote.ai from your account email to ask us to delete your account.

Other choices

• Edit or delete clients, deals, notes, reminders, sequences and templates at any time.
• Disconnect an inbox in Settings, or remove Rightnote’s access in your Google account.
• Turn off open and click tracking, or the unsubscribe link, for any sequence.
• Uninstall the extension from Chrome at any time.

Your rights

Depending on where you live, you may have privacy rights. We honor the following for all users:

• Access: confirm whether we process your personal information and get a copy of it.
• Correction: correct inaccurate personal information.
• Deletion: delete your personal information, including your account.
• Portability: get your personal information in a portable, commonly used format.
• Opting out of the sale of personal information, targeted advertising and profiling. We do none of these.
• Non-discrimination: we will not treat you differently for using your privacy rights.

Email privacy@rightnote.ai from the email address on your account, or write to us at the address below. We verify requests by matching them to your account, for example by confirming the request from your account email. You can use an authorized agent if they give us your signed permission and we can verify your identity. We respond within 45 days. If we need more time, we will tell you why and may take up to 45 more days.

If we decline your request, you can appeal by emailing privacy@rightnote.ai with the subject “Privacy appeal”. We will respond within 60 days and explain our decision. If we deny your appeal, you can contact your state attorney general.

11. Security

We protect information with technical and organizational safeguards, including:

• encryption in transit (HTTPS) and encryption at rest by our hosting provider;
• Google OAuth tokens additionally encrypted with AES-GCM, with a key kept separately from the database;
• sign-in tokens stored only as cryptographic hashes, and no passwords at all;
• role-based access to workspaces, and staff access to customer data only as described in this policy.

See our Security page for more. No system is perfectly secure, so we cannot guarantee security. If a breach affects your personal information, we will notify you as the law requires.

12. Children

The Services are for business use by adults, and you must be 18 or older to use them. They are not directed to children under 13, and we do not knowingly collect personal information from them. If you think a child has given us personal information, contact us at privacy@rightnote.ai and we will delete it.

13. Where we process information

We are based in the United States. Our service providers, including Cloudflare and Google, operate globally and may process information in the United States and other countries. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

14. Additional information for the EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland:

• Legal bases. We process account and Gmail information to perform our contract with you; security, abuse-prevention and service-improvement processing on the basis of our legitimate interests; billing records to meet legal obligations; and anything else with your consent, which you can withdraw at any time.
• Recipients. For contacts and recipients, the customer is the controller and is responsible for having a lawful basis to email and track them (see our Terms). We process that information as their processor.
• Transfers. Where we transfer personal information out of these regions, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents.
• Your rights include access, correction, deletion, restriction, portability and objection, and the right to complain to your data protection authority.

15. Additional disclosures for U.S. state residents

Some U.S. state laws, including California’s, require us to describe what we collect using specific categories. In the past 12 months, we collected the following:

The sources, purposes and retention periods for this information are described above. We use sensitive personal information only to provide the Services, as the law permits, and never to infer characteristics about you. We do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their own direct marketing.

16. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows the current version. Before a material change takes effect, we will notify you by email or in the Services. We will not use Google user data in a materially different way without first telling you and, where required, asking for your consent.

17. Contact us

Questions or requests about privacy:

Simplisik LLC
Attn: Privacy
5510 Old Hickory Blvd, Suite B #32
Hermitage, TN 37076
Phone: (615) 879-5066
Email: privacy@rightnote.ai