Privacy Policy

1. Who we are and whose policy applies

R4AI LLC, operated from Colorado, United States, owns and operates R4ACO. Benjamin Vigil is the owner of R4AI LLC. This policy covers R4ACO websites, web and mobile applications, APIs and related support. R4ACO is a product name, not a separate legal entity. Privacy contact: ben@r4ai.net.

R4AI determines the purposes of global account, authentication, platform billing, security and support processing. For provider-directed workspace operations, R4AI generally processes data for the ACO provider under its instructions and the Data Processing Addendum. Actual activities and applicable law determine each party’s role. Each provider has a separate privacy policy; joining several providers creates separate relationships even when you use one R4ACO ID.

2. Information collected and its sources

You provide account names, email addresses, usernames, a password when using email sign-in, contact phone numbers, shipping and billing addresses, selected SKUs, submission instructions, retailer account credentials and, where enabled, checkout cardholder name, card number, expiry and security code. We store a salted one-way password verifier rather than your account password. Providers supply releases, account assignments, business details, pricing, policies and customer-operation records.

Connected services supply identifiers and status: Discord identity and delivery information; Stripe customer, subscription, invoice and payment records; authorized retailer order and shipment evidence from a provider-connected mailbox; and Apple or Expo push registration and delivery information. Mailbox processing may temporarily access message headers and content to find relevant retailer evidence. Connected mailboxes should contain only mail the provider is authorized to process; unrelated personal mail is not intentionally imported into customer history.

We also process workspace memberships and roles, policy-acceptance records, audit and sign-in events, IP or network information available to hosting and security systems, session identifiers, device installation and push tokens, app version, browser requests and operational diagnostics. We do not request device contacts, precise location, health records or government identification for ordinary R4ACO use.

3. Why we use information

We use information to authenticate users; keep workspace data separated; save customer profiles; accept and export authorized submissions; monitor supported orders and shipping; calculate and track disclosed provider PAS fees; process platform subscriptions and provider payments; send transaction, security and requested operational updates; assist with support; prevent misuse; investigate errors; and comply with applicable legal, accounting and recordkeeping requirements.

Where a legal basis is required, we rely on performance of the relevant agreement, compliance with law, legitimate interests where permitted and appropriately balanced, or consent where required. Provider-directed processing follows that provider’s lawful instructions. Optional marketing or legally required sensitive-data consent must be handled separately; acknowledging this notice is not blanket consent for unrelated processing.

4. Who receives information

The provider and authorized staff in the workspace you choose can access information needed to operate your submissions. Authorized exports can contain readable retailer credentials and full checkout card details for use in the provider’s tools. The recipient’s storage, bot software and devices are outside R4ACO’s control. Another unrelated ACO provider does not receive access to your workspace records merely because both use R4ACO.

We use infrastructure and delivery services including Vercel for hosting, Neon for PostgreSQL, AWS for encrypted key and secret custody, Resend for email, Discord for optional identity and notifications, and Apple/Expo for mobile notification delivery. Stripe handles platform and connected-provider payment processing under its own terms and privacy practices. Providers may connect AYCD/Uplink or other supported integrations and choose third-party export recipients.

We may disclose necessary information to professional advisers under confidentiality, in response to lawful demands, to address fraud or threats, or in a corporate transaction with appropriate protections and notices. We do not sell personal information or share it for cross-context behavioral advertising. We do not use customer data to build advertising profiles.

5. Cookies, notifications and mobile use

R4ACO uses cookies and similar storage for sign-in, security, session continuity and interface preferences. The mobile app uses device credentials and push registrations. We do not operate an advertising-cookie program. Essential session information is required for protected features; clearing it may sign you out.

Manage optional push and Discord notifications in the available settings, and use device controls to disable push. Email verification, password recovery, security, billing and necessary transactional messages support your account and service. Optional marketing, if offered, will provide a separate opt-out. Notification content may be visible on lock screens or to members of a configured Discord channel.

The native customer app directs retailer card entry to the web intake. Using a browser from the app does not remove the web intake’s collection and disclosure practices.

6. Security and payment-data limits

Controls include encrypted transport, scoped authorization, password hashing, audit records, dedicated secret custody and application-layer encryption of stored checkout cards using AWS KMS and AES-256-GCM. Ordinary pages use masked card summaries. These controls reduce risk; no system guarantees absolute security, and authorized downloads contain readable values needed by the selected bot format.

Encryption is not a claim of PCI certification. Retaining a card security code after payment authorization is prohibited by PCI DSS even if encrypted. Payment-industry obligations apply to each party’s actual handling of information. Do not submit credentials through notes, email or Discord support messages. Report suspected exposure to ben@r4ai.net without including the secret.

7. Retention and deletion

We retain information only while reasonably needed for the described purpose, the service relationship, fraud prevention, disputes or applicable legal duties. Retention depends on the data type and the reason it must be retained. Credentials and checkout data require tighter controls than accounting records; lawful accounting retention is not a reason to retain a CVV.

The account-deletion workflow revokes access and deletes or irreversibly anonymizes active contact/address information, password and identity links, card data and device registrations. External-provider cleanup can complete asynchronously. Limited pseudonymized payment, tax, order, PAS, consent and audit evidence may be retained for up to seven years where needed, or longer where a specific law or legal hold requires it. We assess requests and do not use a blanket retention exception to avoid applicable deletion rights.

Backups can contain historical copies until their configured lifecycle expires. Access is restricted and restored data must undergo applicable deletion reconciliation before returning to service. Providers, retailers and downloaded exports have separate retention responsibilities. Ask the relevant provider about copies it controls; R4AI will assist with requests within its role.

8. Your choices, rights and requests

You can update available saved information, control optional notifications and initiate deletion of your global R4ACO ID at https://app.r4aco.io/account/delete. Deletion can require transferring sole workspace ownership. You may also send a privacy request to ben@r4ai.net; identify the workspace and account using a safe reference, never a password or full card number.

Depending on your location and applicable law, you may have rights to access, correct, delete or obtain a portable copy of information, withdraw applicable consent, object to or restrict processing, and opt out of sale, targeted advertising or covered profiling. We do not sell information, conduct targeted advertising or use automated profiling to make legally significant eligibility decisions. We will not unlawfully discriminate against you for exercising privacy rights.

We verify identity proportionately and may request limited additional information. An authorized agent may act with the proof required by applicable law. We respond within applicable deadlines, explain a lawful denial and provide any available appeal route. Send appeals to ben@r4ai.net with “Privacy appeal” in the subject. Colorado residents may complain to the Colorado Attorney General; other users may contact their applicable authority. A provider may need to act on workspace-controlled records, but you can contact R4AI for help identifying the correct recipient.

9. Location, children and policy changes

R4ACO is operated from the United States and may use service providers in other countries. Data protection laws differ between locations. Where restricted international-transfer rules apply, the required safeguards must be established before the transfer; using R4ACO or accepting this policy does not itself supply a missing legal safeguard.

R4ACO is intended for adults 18 and older. We do not knowingly offer accounts to children. If you believe a child submitted information, contact ben@r4ai.net so we can investigate and take appropriate action.

This version is dated September 26, 2026. Material changes will be presented with a new version and notice or consent where required. Acknowledging this policy does not waive privacy, security or consumer rights. Contact R4AI LLC at ben@r4ai.net for questions or to request an accessible copy.