RFG Studio's PRIVACY POLICY

This Privacy Notice explains how RFG Studio's ("we," "us," or "our") processes personal information when you use our website, RFG Portal, accounts, developer services, connected applications, and other services (together, the "Services"). It applies to visitors, customers, staff, contractors, developers, and other people who interact with us. Some services may have additional notices.

For questions or privacy requests, contact [email protected].

1. WHAT INFORMATION DO WE COLLECT?

The information depends on the services you use and your relationship with us. It may include:

• Account and identity information: names, email addresses, usernames, nicknames, linked Discord, Roblox or GitHub identifiers, account roles, authentication methods, passkeys, sessions, OAuth consents, and connected applications. We process credentials and tokens to operate and secure accounts.
• Staff and contractor information: onboarding details, communication email, country, gender where provided, department, status, permissions, work activity, workload, and payroll or payment records where applicable.
• Service content: tasks, comments, messages, notifications, files, project records, documents, signatures, reviews, orders, customer communications, and information submitted through integrations.
• Technical and security information: IP addresses, device and browser details, session history, API usage, access and audit records, database or deployment activity, error reports, and operational logs.

Please do not submit sensitive personal information unless it is needed for an authorized service or business process. Some staff, payment, or document records may require additional protection because of their contents.

When you link an external account, we may receive identifiers and profile details from that service under the permissions you grant. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

2. HOW DO WE USE YOUR INFORMATION?

We process information to provide accounts and access controls; manage staff, projects, orders and communications; operate developer tools and integrations; maintain records; respond to requests; and protect the Services against misuse and security incidents.

Depending on the activity and applicable law, we rely on performance of a contract, legitimate interests, legal obligations, or consent. Where we rely on consent, you may withdraw it. Withdrawal does not affect processing already carried out or processing supported by another legal basis.

Legal bases and regional requirements

We use the legal basis appropriate to each purpose. We may process information where it is necessary to provide a service or perform a contract with you, to meet a legal obligation, or for our legitimate interests in operating and securing the Services, provided those interests are not overridden by your rights. In limited circumstances, we may rely on consent or on the need to protect someone's vital interests. We do not treat use of the Services as consent to every processing activity.

Where Canadian privacy law requires consent, we seek express or implied consent as appropriate to the information and circumstances. Sensitive information or uses that you would not reasonably expect may require express consent. Other collection, use, or disclosure may be permitted or required by law without consent.

3. MONITORING AND DIAGNOSTICS

We use Sentry to receive application errors, performance information, logs, and related diagnostic data from our website and backend. The current application configuration enables default personal information in Sentry events. Browser Session Replay is also enabled: the configuration samples 10% of sessions and 100% of sessions when an error occurs, subject to Sentry's capture behavior. A replay may record interactions and visible page content. We use these records to investigate faults and protect the Services.

Diagnostic events may contain account or technical identifiers. We limit access to these records and seek to avoid collecting information beyond what is needed for troubleshooting. If you encounter sensitive information in a diagnostic record, contact us using the address above.

4. WHEN DO WE SHARE INFORMATION?

We share information with authorized staff and contractors who need it for their work; hosting, storage, monitoring, communications, and other service providers that help operate the Services; and connected services such as Discord, Roblox, GitHub, or Google when a feature or account connection requires it. Sentry receives the diagnostic data described above. Information may also be available to an application you authorize through an OAuth consent flow.

We may share information where required by law, to protect rights and security, or in connection with a business transfer. External services have their own privacy practices. International transfers may occur when a provider processes information outside your country; applicable safeguards depend on the provider and transfer.

5. COOKIES AND LOCAL STORAGE

We use cookies or similar browser storage where needed for sign-in, sessions, security, and service preferences. Monitoring tools may also use browser storage. Your browser can limit or clear storage, but doing so may prevent account features from working. We will provide any additional choices required by applicable law.

6. ARTIFICIAL INTELLIGENCE FEATURES

Some features use an AI service to process the prompts and related content needed to provide a response. The backend supports a configured Ollama service. Whether that service runs on RFG-controlled infrastructure or another provider depends on the deployment. Do not include information in a prompt that you are not authorized to share. We will update this notice if additional AI providers or data flows are introduced.

7. HOW LONG DO WE KEEP INFORMATION?

Retention depends on the record and why it is held. Account and identity records are generally kept while an account is active and for a period needed to close it securely. Staff, payroll, order, signature, and financial records may be kept longer to meet contractual, accounting, employment, or legal requirements. Project content remains while needed for the relevant work or business record. Security and diagnostic records are kept for troubleshooting, audit, and protection for periods set by the relevant systems and providers.

When information is no longer needed, we delete or anonymize it where practical. Deletion from live systems may not immediately remove copies from backups. Backups expire under their own schedules, and records restored from a backup may need to be deleted again. We may also preserve information needed for legal claims, investigations, or legal holds.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

We use technical and organizational measures intended to protect personal information, including access controls and security monitoring. No electronic service can be guaranteed completely secure.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") feature. At this stage, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

10. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

If you reside in a US state with applicable privacy rights, you may be able to request access to, correction of, or deletion of your personal information, subject to legal exceptions. Other rights may apply under your state's law. Please contact us using the address below to make a request.

11. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

Australia and New Zealand: Depending on applicable law, you may request access to or correction of personal information we hold about you.

Republic of South Africa: You may request access to personal information and correction or deletion where the law provides for it.

12. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice as our Services or practices change. The date above shows the latest revision.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at [email protected].

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on applicable law, you may request access, correction, export, restriction, objection, or deletion of your information. The portal offers a JSON or CSV export of certain account data. That export may not contain every record associated with you. For a broader request, please email [email protected]. We may need to verify your identity and may retain records where the law or legitimate business requirements permit or require it. You may also complain to the relevant data protection authority.