Privacy Policy

Information We Collect

We try to collect as little personal information as we can while still making RebelOps work:

• Account information: Email or username identifier, display name, and optional profile details such as a bio. Email addresses can be fictional because we treat them as login identifiers rather than as guaranteed contact channels.
• Organization content: Tasks, projects, chat, files, prompts, and other content created inside organizations.
• Website analytics: Anonymous or aggregated information about visits to rebelops.app.

Important: We do not require valid email addresses for account creation. Within the app, we do not use traditional user-tracking analytics to follow people across organizations.

End-to-End Encryption

Organizations can enable end-to-end encryption for supported data. When that is enabled:

• Encryption keys are never transmitted to or stored on RebelOps servers
• We cannot access encrypted data
• Organization directors can see what information is encrypted in Organization Settings
• Encryption keys can be rotated if compromise is suspected

Isolated Organization Architecture

Unlike many tools that keep all customers in a shared environment, RebelOps runs each organization in its own isolated environment with its own database, file storage, credentials, authentication, and processing layer.

Anonymous-by-Design Architecture

Our main server is designed not to keep normal operating links between users and organizations. The goal is to reduce what a central system can reveal about which users belong to which organizations.

AI Privacy and Data Handling

Organization directors decide what data is shared with AI features and which AI provider is used. Privacy and retention for AI conversations depend in part on the AI provider chosen by the organization.

Data Storage and Security

Organization data is stored in the organization's isolated environment with encryption in transit and encryption at rest where supported by the stack. We also use backups and operational safeguards designed to improve reliability and recovery.

When live session recording is enabled, RebelOps stores those recordings on the RebelOps side as part of the organization's data environment and file storage flows.

We work to keep data secure, but no system can promise perfect security or guaranteed recovery in every case. Only organization roles with the right permissions can export or delete organization data through the product.

Retention and Deletion

We keep account and organization data for as long as it is needed to operate the Service, unless it is deleted earlier through the product workflows or legal requirements say otherwise.

If a founder schedules organization deletion through the Service, there is currently a 24-hour grace period before permanent deletion. After that period ends, organization data may be permanently removed.

If an organization stays unpaid or in a negative balance for more than 7 days after the first nonpayment notice, we may limit or suspend Service features. If the balance remains unpaid and the organization does not respond within 14 days after the first nonpayment notice, we may terminate the organization and permanently delete its data after a final notice.

Even after deletion or termination, we may keep limited records where needed for law, security, fraud prevention, accounting, dispute handling, or similar legitimate business reasons.

Third-Party Integrations

When you use integrations with other services:

• Integration data flows through your organization's isolated environment
• No cross-organization integration data sharing
• Organization directors control what data extensions access for all organization members
• These settings are subject to individual organizations and may differ between organizations

Calls and live sessions are currently provided through Daily.co. In its Data Protection documentation, Daily.co states that it does not store audio, video, or screen-sharing media from calls except through its documented recording APIs, which are controlled by the application developer. All session recordings are immediately transferred to the organization's file storage and deleted from Daily.co's systems.

You can review Daily.co's Data Protection page here: https://www.daily.co/security/data-protection/

What We Don't Do

RebelOps is built with privacy-first principles. We do not:

• Sell your data to third parties
• Use your data for advertising
• Use central app analytics to track users across organizations
• Share data between organizations
• Require email verification (fictional emails are acceptable)
• Access your encrypted data

Your Rights

Because we keep account-level personal data relatively limited, you generally have the following rights inside RebelOps:

• Access and correction: View and correct the information in your profile
• Deletion: Request deletion of your account through the app or by contacting info@rebelops.app

Organization administrators also control access to organization data, subject to the permissions built into the product.

Legal Compliance

We try to design RebelOps in a way that supports privacy and data protection obligations. However, we do not promise that RebelOps alone makes any organization compliant with GDPR, CCPA, or any other law.

Each organization remains responsible for its own legal, regulatory, employment, accounting, tax, and operational obligations. That is especially true when the organization chooses what data to collect, what AI provider to use, and whether to enable end-to-end encryption.

We may help with privacy and security, but we do not act as your law firm, compliance department, accountant, or data protection officer.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Email: info@rebelops.app

For detailed information about our privacy philosophy, see our Privacy Manifesto.