Right Hand · Privacy Policy

The short version

Right Hand is software that home-service companies use to run their business. Revive Flow LLC, doing business as Right Hand, makes it.

If you are a company that subscribes, we collect what we need to run your account and bill you.

If you are a client, caller, or employee of one of those companies, that company decides what is collected about you. We handle it for them, on their instructions. Ask them first about your data. We'll help them answer.

We don't sell personal information, and we don't share it for targeted advertising.

We never share phone numbers or text-message opt-in consent with third parties for their marketing.

The AI companies we use work under terms that don't allow them to train their models on the data we send.

1. Who we are and what this policy covers

"Right Hand," "we," "us," and "our" mean Revive Flow LLC, a Florida limited liability company doing business as Right Hand, ADDRESS.

This policy covers personal information we handle through:

our websites, including the marketing site and the sign-in pages
the Right Hand web dashboard and iPhone app
Mike, our AI receptionist, which answers and places calls and texts for our subscribers
the quote, invoice, client portal, booking and payment pages subscribers send to their clients (see also Terms for Your Clients)
our support, sales, and billing contacts

It applies to four groups of people:

You are…	Example	Our role
Visitor	Someone browsing our website or using the help chat	We decide how your data is used (a "controller" or "business")
Subscriber contact	The owner, manager, or office staff of a company that pays for Right Hand	Controller for account, billing, and support data
Subscriber's client or caller	A homeowner who calls a lawn company and talks to Mike, gets a reminder text, or pays an invoice	Processor / service provider for the subscriber. The subscriber is in charge of your data
Subscriber's employee or crew member	A crew member who clocks in on the Right Hand app	Processor / service provider for the subscriber (your employer), plus controller for your login and app security

When we act for a subscriber, the subscriber's own privacy notice governs, and our Data Processing Addendum with them limits what we may do. This policy explains our practices so you know what happens behind the scenes.

2. What we collect

2.1 Visitors

What you send us: name, email, phone, company, trade, and team size, when you fill in a form, book a demo, start a sign-up, or use the help chat.
Device and usage data: IP address, browser, device type, pages viewed, referring page, approximate location from your IP address, and time stamps. We collect this through server logs and privacy-focused analytics (Vercel Web Analytics). These analytics do not use advertising cookies.

2.2 Subscriber contacts

Account details: name, business name, email, phone, role, password (stored only as a secure hash), and the sign-in provider you use (Google, Apple, Intuit, or email).
Billing: plan, billing history, billing address, and the last four digits and expiry of your card. Stripe processes full card details. We don't receive or store full card numbers.
Business details for carrier registration: legal business name, EIN, business address, website, and contact. Carriers require these to register your texting (A2P 10DLC).
Support communications: emails, chats, call recordings with our support team (we tell you when a call is recorded), and feedback.
Usage and device data: log-ins, features used, device and app version, crash reports, and IP address.
Sign-in data: sign-in time, device, a "remember this device" token (up to 30 days), and security events.

2.3 Data subscribers put in Right Hand (we process it for them)

Depending on which features a subscriber uses, this may include:

Clients and leads: names, phone numbers, emails, service addresses, property notes, gate codes, photos of the property, quotes, jobs, invoices, payment records (amount, status, last four digits, and card brand, never full card numbers), reviews, and communication history.
Calls with Mike: caller phone number, call recording, transcript, AI summary, the request details the caller gives, and appointment details. Calls handled by Mike are recorded and transcribed, and the caller is told at the start of the call.
Text messages and emails: messages sent to and from the subscriber's Right Hand number, and emails synced from a Gmail account the subscriber connects (see Section 9).
Employees and crew:
name, contact details, role, and pay rate
time clock records, clock-in and clock-out location, job-site time, and route data
truck or phone GPS location during work, when the employer turns that feature on
photos taken on jobs
receipts
signed handbook acknowledgments, new-hire forms, and certifications
injury reports, write-ups, and other HR paperwork the employer chooses to store
Business records: receipts, expenses, equipment, and data synced from QuickBooks, marketing accounts (Google Ads, Google Business Profile, Search Console, Meta), and other tools the subscriber connects.

2.4 Sensitive information

Some of the data above can be "sensitive" under state privacy laws. That includes precise location of employees, and injury-report details. We process it only to provide the features the subscriber turns on, and only on their instructions. Subscribers are told not to store Social Security numbers, full bank or card numbers, or medical records in free-text fields.

3. Where it comes from

From you directly: forms, sign-up, calls, texts, and the app.
From the subscriber you deal with: if you are their client or employee.
From services a subscriber connects: QuickBooks, Google, Meta, Jobber, Housecall Pro, Zapier, Make, GPS providers, and Stripe.
From sign-in providers: Google, Apple, and Intuit share your name, email, and a user ID when you choose to sign in with them. Apple may give us a private relay email instead of your real one.
Automatically: from your device and from our systems.

4. How we use it, and why

Purpose	Data	Legal basis (where one is needed)
Provide the Service: run accounts, answer calls, send the texts and emails the subscriber sets up, take payments, sync integrations	All categories in Sections 2.2 and 2.3	Our contract with the subscriber, and the subscriber's instructions
Sign-in, security, fraud and abuse prevention	Account, device, and log data	Legitimate interest in keeping the Service and users safe; legal duty
Billing and accounting	Billing data	Contract; legal duty (tax records)
Support	Support communications, and account data needed to help	Contract; legitimate interest
Carrier and texting compliance (10DLC registration, opt-out handling, consent records)	Business registration data; opt-in and opt-out records	Legal duty; legitimate interest
Improve the Service	Usage data; aggregated and de-identified data	Legitimate interest. We don't use subscribers' client data to train general AI models
Tell subscribers about updates and offers	Subscriber contact details	Legitimate interest or consent. You can opt out anytime
Comply with law and enforce our terms	As needed	Legal duty; legitimate interest

We do not use personal information for decisions that have legal or similarly significant effects on you based only on automated processing.

5. AI features

Right Hand uses third-party AI providers to answer calls, transcribe, summarize, draft quotes and messages, and produce Mike's voice: Anthropic, OpenAI, and ElevenLabs (see Subprocessors).
We send them only what a task needs.
We use their business or API services, whose terms do not permit them to use the data we send to train their models. Under their own policies, they may keep data for a limited time to monitor for abuse.
We do not use subscribers' client, caller, or employee data to train general-purpose AI models.
Data from Google APIs (including Gmail) is never used to train AI models (Section 9).
Mike says it is an AI assistant, and that the call is recorded, at the start of every call.
We don't create voiceprints to identify callers. A custom voice for Mike is made only from recordings of a person who gave the subscriber written consent, and is deleted when that consent is withdrawn.
Full details: AI and Mike.
AI can make mistakes. Subscribers are told to review AI output, and a person at the subscriber's company is responsible for what is sent in their name.

We don't sell personal information. We don't "share" it for cross-context behavioral (targeted) advertising, as California law uses those terms. We do not share mobile phone numbers, or any text-message opt-in data and consent, with third parties or affiliates for marketing or promotional purposes. All the categories of sharing below exclude text-message originator opt-in data and consent.

We disclose personal information only to:

The subscriber the data belongs to, and the Users they authorize.
Our service providers (subprocessors), who process it for us under contracts that limit their use to providing services to us. They fall into these groups:
Hosting and database: Vercel, Supabase (and their cloud providers)
Payments: Stripe
Phone calls and text messages: Twilio, and the mobile carriers that deliver messages
AI: Anthropic, OpenAI, and ElevenLabs (voice)
Sign-in, maps, and Google features: Google
Sign in with Apple and app notifications: Apple
QuickBooks and Intuit sign-in: Intuit

The full current list is at Subprocessors. - Services a subscriber chooses to connect, such as QuickBooks, Google Ads, Meta, Zapier, a GPS provider, or their own Stripe account. The subscriber directs these transfers, and the receiving service's own policy then applies. - Carriers and registries, as needed to register and deliver business texting (for example, The Campaign Registry). - Professional advisers (lawyers, accountants, insurers) under confidentiality. - Authorities, when the law requires it, or when needed to protect someone's safety or our rights. We require valid legal process, push back on overbroad requests and, where allowed, tell the affected subscriber first. Our full approach is in Security, Section 11. - A buyer or successor, if Right Hand or Revive Flow LLC is reorganized, merged, or sold. This includes moving Right Hand into a separate company we control. That company must honor this policy.

7. How long we keep it

Data	How long
Subscriber's business data (clients, jobs, calls, messages, time records, documents)	While the subscription is active, or until the subscriber deletes it. After cancellation: 30 days to export, deleted from live systems within 60 days after that, and from backups within 35 days more
Call recordings and transcripts	Same as above, unless the subscriber sets a shorter retention period, or deletes them sooner
Items a User deletes	Moved to "Recently deleted" for up to 30 days so they can be restored, then permanently deleted (records the law requires the subscriber to keep, such as signed documents, may be locked against deletion by the subscriber's settings)
Text-message opt-out and consent records	As long as the number is in use, plus up to 5 years, to prove compliance
Billing and tax records	7 years
Records of who accepted our Terms and Privacy Policy, and which version	Life of the account, plus 7 years
Security logs	Up to 1 year
Website analytics	Up to 24 months, in aggregate form
Visitor form submissions that don't become customers	Up to 24 months after last contact
Clients' electronic signatures and quote approvals (name, time, IP address, document version)	With the signed document, for as long as the subscriber keeps it
Bank (ACH) payment authorizations	At least 2 years after the authorization ends, as Nacha rules require (Stripe keeps the mandate for payments made through it)
Custom voice recordings and the voice model made from them	Until the subscriber deletes the voice, consent is withdrawn, or the account ends. Then deleted, and deletion requested from our voice provider
Data sent to AI providers for a task	Not kept by them for training. Kept only briefly, if at all, for abuse monitoring under their terms
Copyright notices and counter-notices	3 years

We may keep data longer if the law requires it or to resolve a dispute. While we keep it, we protect it.

8. Security

More detail, including how to report a vulnerability, is on our Security page.

Encryption: data is encrypted in transit (HTTPS/TLS), and at rest by our hosting and database providers.
Separation between companies: each subscriber's data is kept apart at the database level, so one company can't see another's data.
Passwords: stored only as salted hashes.
Staff access: limited to people who need it, logged, and protected by multi-factor authentication.
Testing and monitoring: we test and monitor for security problems.

No system is perfectly secure. If we confirm a breach affecting your personal information, we will notify affected subscribers without undue delay, and notify individuals and regulators as the law requires. Florida law, for example, requires notice to affected individuals within 30 days. Report a security concern to security@righthandcrm.com.

If you connect Google, we access only the data needed for the features you turn on. Each feature uses specific data:

Feature	Google data we access	What we do with it
Google sign-in	Name, email, and Google account ID	Sign you in
Gmail sync	Emails and metadata	Show client emails in each client's record, match them to jobs, and let you reply from Right Hand
Google Ads, Business Profile, Search Console	Your business's account data	Show your marketing results and leads

Right Hand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

use Google user data only to provide and improve the user-facing features described above
do not use it for advertising, and do not sell it
do not use it to develop, improve, or train generalized AI or machine-learning models
transfer it to third parties only when one of these applies:
it's needed for those features, such as an AI provider summarizing an email you asked about
it's needed for security
the law requires it
Right Hand is merged or sold, with your consent
do not let people read it, except in these cases:
you ask us to, for a specific message
it's needed for security or abuse investigations
the law requires it
it's aggregated and anonymized for internal operations

You can disconnect Google at any time in Integrations or in your Google account permissions. Disconnecting stops access. Ask support if you also want synced copies deleted.

Sign in with Apple: we receive your name (the first time only) and an email, which may be an Apple private relay address. We use them only to create and secure your account. You can stop using Sign in with Apple in your Apple ID settings.
Intuit (QuickBooks):
Sign-in: if you sign in with Intuit, we receive your name, email, and Intuit ID.
QuickBooks sync: if you connect QuickBooks, we read and write only the accounting records the sync needs (customers, invoices, payments, items, expenses). This happens on your instructions.
Disconnecting: you can disconnect anytime in Integrations or in your Intuit account.
Deleting your account in the app: you can start deleting your Right Hand account inside the iPhone app (Settings → Account → Delete account). The owner deleting a company account deletes the company's data on the schedule in Section 7.

11. Cookies and similar technology

We use:

Essential cookies: to keep you signed in (including the "remember this device" cookie, up to 30 days), protect against fraud and cross-site request forgery, and remember settings such as light or dark mode.
Privacy-focused analytics that count visits without advertising cookies or cross-site tracking.

We don't use advertising or cross-site tracking cookies or pixels on our website, in the app, or on client pages. If that ever changes, we will update this policy first, add a "Do Not Sell or Share My Personal Information" link, and give you a way to opt out. Your browser lets you block cookies, but sign-in won't work without essential cookies. The full list is in our Cookie Notice.

Global Privacy Control: we treat a GPC signal from your browser as a valid request to opt out of sale and sharing, today. Because we don't sell or share, we don't currently show a "Do Not Sell or Share" link.

12. Your privacy rights

12.1 If a subscriber holds your data (you are their client, caller, or employee), contact that company first. They decide on your request. We help them answer, as our DPA requires. If you contact us, we will pass your request to the subscriber (if we can identify them) and tell you we did.

12.2 Your rights with us. Depending on where you live, US state laws give you rights over personal information we control. These states include California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska, Rhode Island, and others. We extend these rights to everyone in the US, whether or not your state's law applies to us:

Know and access: what we collect, why, and who we disclose it to, and get a copy.
Correct inaccurate data.
Delete your data, subject to legal exceptions.
Portability: get your data in a usable format.
Opt out of sale, sharing, targeted advertising, and profiling: we don't do these, so there is nothing to opt out of. We still honor Global Privacy Control signals as an opt-out.
Limit use of sensitive personal information: we use it only as needed to provide the Service.
Appeal if we deny your request: reply to our decision with "Appeal." If we deny the appeal, we'll tell you how to contact your state attorney general.
No discrimination for using these rights.

12.3 How to make a request. Email privacy@righthandcrm.com with the subject "Privacy request," or write to us at ADDRESS.

Verification: we will verify your identity by matching information we already have, such as a code sent to your account email.
Agents: an authorized agent may ask for you with your signed permission.
Response time: we respond within 45 days. We may extend that once by 45 more days, and we will tell you if we do.
Account owners: can export and delete their company's data themselves from Settings.

12.4 California notice at collection (summary). In the last 12 months, we collected these categories of personal information:

identifiers
customer records
commercial information
internet activity
geolocation (employees, when their employer turns it on)
audio and electronic information (call recordings and messages)
professional or employment information (employee records held for subscribers)
sensitive personal information (account log-in; precise geolocation)
inferences limited to AI summaries of calls and requests

The sources, purposes, and recipients are described in Sections 3, 4, and 6. We have not sold or shared personal information. Retention is in Section 7.

13. Text messages and calls

Our messaging terms, including how to opt out (reply STOP) and get help (reply HELP), are in the Messaging and Calls Terms. Text-message opt-in data and consent are never shared with third parties for marketing. Mike's calls are recorded and transcribed, and callers are told at the start of the call.

14. Children

Right Hand is for businesses and adults. It is not directed to children under 13 (or under 16 where that is the law). We don't knowingly collect their personal information. If you think a child's data reached us, email privacy@righthandcrm.com and we will delete it.

15. Where data is stored

Right Hand is offered only to US businesses. We store and process data in the United States. A few providers may process limited data in other countries under contracts that protect it. If you contact us from outside the US, your information will be transferred to the US.

16. Changes to this policy

We will post any update here with a new version number and effective date. For material changes, we will notify subscribers by email and in the dashboard at least 30 days before the change takes effect. Where the law requires it, we will ask for your consent.

17. Contact

Revive Flow LLC, doing business as Right Hand · ADDRESS · Privacy: privacy@righthandcrm.com · Support: support@righthandcrm.com · Security: security@righthandcrm.com

Privacy Policy