Privacy Policy

RichRep is business software used by sales teams. Accounts belong to a workspace, and a workspace is normally created and administered by the organization that employs the people using it. If your employer gave you a RichRep account, that organization decides what is recorded and kept; this policy explains what the software does with it.

Account information. Your email address and sign-in credentials, handled by our authentication provider, plus a profile record and your membership and role in one or more workspaces.

Content you or your team put in. Contacts and leads and the details attached to them, notes, tasks, follow-up drafts, calendar and meeting details, playbooks and scripts, uploaded knowledge documents, business profile information, campaign lists and recipients, and messages you exchange with the in-app assistant.

Calls and conversations. Uploaded or recorded call audio, transcripts, per-segment speaker labels, the outcome and notes you record for a call, and analysis output derived from a transcript. Phone conversations, in-person conversations, and online or in-person meeting sessions recorded through the browser work the same way.

Telephony and messaging records. When calling and texting are configured for a workspace, we store phone numbers, call and message records, timestamps, durations, delivery status and message text.

Connected mailbox data. When a user connects a Gmail or Microsoft mailbox, the app can read the chosen inbox content — message headers, body snippets or plain-text bodies, participant addresses and message times — and cache a copy in RichRep so it can be displayed and searched. Approved follow-up mail is sent through that mailbox. Optional open and link signals may be added to outbound mail when tracking is enabled; these are best-effort and cannot be certain. Disconnecting the mailbox stops future reading and sending; it does not delete cached mail already stored in RichRep.

Connected calendar data. When a user connects one or more Google accounts, RichRep can read events from the calendars they choose to show, to help with scheduling. Two-way sync is off until the user turns it on for an account and picks one calendar they can edit; then only the events they choose for that calendar are sent to it, and changes made there come back. An event sent to a calendar others can see — a shared, team or work calendar — can be seen by them in Google. RichRep deletes an event in Google only when the user deletes it in RichRep and chooses to delete it there too, or moves it to another calendar. Personal tasks, goals and planner categories are stored separately from shared workspace records.

Map and route planning data. The Map feature stores private places such as Home, Office and favorites, plus route plans created by the user. When you open a directions or search link in the Map feature, the selected addresses are sent to Google Maps to build the link or directions page. If the workspace owner has also configured the optional server and browser keys, RichRep can additionally order stops, estimate driving times, and draw the embedded map picture through the Google Maps APIs.

Rich assistant data. Text, files, images and voice messages you send to Rich are passed to the configured AI and speech providers to produce answers, tool results, generated images, transcriptions and voice output. Rich's assistant requests are processed through the Lovable AI Gateway and its model providers. Contact us for information about the providers used for your workspace.

Live Coach extension information. The RichRep Live Coach extension runs only on the supported dialer sites (Salesloft, Outreach, HubSpot and Apollo) and on RichRep's own site. Its content scripts read the address of the dialer page in your browser to choose the right dialer adapter; that address is processed locally and is not sent to RichRep. When a call starts, after you have enabled coaching, it sends RichRep the contact name, phone number and company shown on the dialer page, which dialer it was, and the call audio. See the Chrome extension section below.

Vault extension information. The separate RichRep Vault extension stores encrypted credentials locally inside its own Chrome profile storage. It does not use Proton or any other password manager, does not send credentials to the RichRep web app or to the Live Coach extension, and does not sync to the cloud. When you click the Vault extension's fill button on a website, it can enter the stored credential into the exact website's login fields. Backups are encrypted files you download; clipboard copies of a credential remain outside the vault until you clear them. Uninstalling the Vault extension or clearing its browser data can remove the local vault, so the master passphrase and backups matter.

Technical and diagnostic data. Ordinary server logs and error reports generated when the app runs, and counters recording how much processing a workspace has used.

We do not ask for or store payment card details in the application.

To operate the product: sign you in, show your workspace, place and receive calls and messages you initiate, transcribe and analyze conversations, produce coaching, summaries, contact profiles, tasks and draft follow-ups, plan routes, read and send mail and calendar events you connect, and keep a history you can search.

To keep the service working and safe: diagnosing errors, preventing abuse, enforcing per-workspace processing limits, and accounting for usage.

We do not sell your data, and we do not use your conversations or contacts to advertise to you.

RichRep runs on infrastructure and services operated by other companies. Depending on which features your workspace has turned on, data may pass through:

• our application hosting and database, authentication and file storage provider, which hold workspace content and shared sales records;
• an AI processing service, which receives text, image, file and related context needed to produce answers, analysis, coaching, summaries, drafts and images;
• a speech-to-text provider, when live transcription is configured for the workspace and its deployment;
• a telephony provider, when calling or texting is configured — it necessarily handles the phone numbers and the call or message itself;
• a CRM, when a workspace connects one — imported people come in from it, and call activity is written back only for the reviews you explicitly choose to sync;
• Gmail or Microsoft, when a user connects a mailbox — approved follow-ups are sent through that mailbox and inbox content is read from it;
• Google Calendar, when a user connects a calendar — events are read from it and chosen RichRep items can be written to it;
• Google Maps, when you use Map directions or search links, and additionally when the owner has configured the optional routing keys — selected addresses are sent to order stops, estimate driving times, or draw the embedded map;
• a public news source, for the shared industry news feed. Those requests use a fixed public list of topics only; nothing from your workspace, profile, contacts or filters is sent outside the app.

We may also disclose information if we are legally required to, or as part of a business transfer, in which case this policy continues to apply to the data transferred. Transfers of Google user data are additionally subject to the restrictions in the Google API data section below.

Shared sales records — calls, transcripts, contacts, notes, analysis and related workspace content — belong to the workspace and are scoped to it. The database refuses reads and writes from anyone who is not a member of the workspace. Other members of your workspace — including administrators — can generally see those shared records according to their role. Some actions are restricted by role.

User-owned personal data uses its own owner access rules. This includes private tasks, goals and planner categories you create; connected mailbox and calendar data tied to your account; private text files and images you store; and private places and route plans in the Map feature. Other workspace members cannot see those items simply because they are in the same workspace.

Call audio is kept in private storage that is never publicly readable; the app opens it through short-lived links generated for the signed-in member who is allowed to hear it.

The web app keeps your session token in your browser's local storage so you stay signed in; it is not used for tracking or advertising. Signing out removes it.

The Live Coach extension stores, in the browser's own extension storage on your computer, your RichRep sign-in token and its expiry, your email, the workspace you selected and the RichRep address to talk to. The token is stored locally and sent only to the trusted RichRep API to authenticate requests. It is never handed to the dialer page you are visiting; audio connections use a separate scoped, short-lived, single-call ticket instead. Disconnecting in the Live Coach extension's options or toolbar popup deletes those stored values.

The Vault extension keeps its vault encrypted in its own Chrome profile storage on your computer, protected by the master passphrase you set. It does not store credentials in the RichRep web app, in the Live Coach extension, or in any cloud service.

No call audio is captured or contact details sent to RichRep before you read the extension's in-product notice and press Enable coaching. Before that, adapters may inspect contact fields, the page address and call state locally on supported dialer pages to select the adapter and detect calls. This is limited supported-page inspection, not access to your general browsing history. That choice is saved, with the version of the notice, for your account in the selected workspace. Using another account or workspace, or a newer version of the notice, asks again. Automatic sign-in refreshes never switch coaching back on after you disconnected.

Once enabled, capture starts automatically when the extension detects a call on a supported dialer — there is no separate Record button or browser prompt for each call. Call audio is streamed to RichRep, transcribed by RichRep's configured speech-to-text providers (Deepgram, and/or the Lovable AI Gateway and its model providers). Live coaching cards are retrieved by matching the conversation against the selected workspace's playbook cards, not generated by the Lovable AI Gateway. Separately, subsequent transcript analysis may use configured AI services, including OpenAI where configured. The transcript and call record are saved to the workspace you selected.

Disconnecting (in RichRep, the extension's options or its toolbar popup), signing out, switching workspace or an expired sign-in stops RichRep's capture in every open dialer tab and ignores late results. It stops only RichRep's own audio processing — your phone call and the dialer are not interrupted. A bounded drain of up to 12 seconds attempts to save results from audio already sent; it does not guarantee a complete transcript.

Kept locally in extension storage: the sign-in token and its expiry, your email, the selected workspace, the RichRep address, your coaching consent record, a disconnect flag, and a short note on whether the last call was fully saved. Signing out, disconnecting or switching workspace removes the session values and the last-call note; the consent record stays scoped to its account and workspace until replaced, revoked, extension data is cleared or the extension is uninstalled.

Disconnecting an integration — a CRM, a mailbox, a calendar, or a phone connection — stops future access and removes the stored access credentials or token for it. It does not delete data already imported into or created in your workspace, and it does not delete anything held in that outside system.

Disconnecting a mailbox stops future reading and sending; cached mail already stored in RichRep remains. Disconnecting Google Calendar removes RichRep's local busy-event cache, sync cursors and pending exports for that calendar connection; existing events in Google Calendar itself and RichRep private tasks are not deleted.

The separate RichRep Vault extension has no account bridge to disconnect. Closing the Vault popup locks it until you re-enter the master passphrase. Uninstalling the Vault extension or clearing its browser data can delete the local vault; an encrypted manual backup made with the same master passphrase can restore it. There is no recovery service, and RichRep cannot reset a forgotten passphrase.

Deleting a call in the app hides it immediately and can be undone for a short window (currently ten seconds). After that the record is removed through a controlled path that also queues its stored audio for removal from file storage. Contacts, notes, tasks and drafts you delete are removed from your workspace.

To request deletion of an account or of a whole workspace, email support@richrep.com. We will confirm the request with a workspace administrator before deleting shared workspace data, because it affects other members.

We keep workspace content for as long as the workspace keeps it. There is no automatic expiry built into the product: calls, transcripts, analysis, contacts, notes and message history remain available until a member deletes them, an administrator deletes the workspace, or we act on a deletion request. Audio queued for removal is deleted from file storage through the cleanup path described above. Hosting-provider log and error-report retention has not been verified; we do not promise a particular retention period.

We are deliberately not stating a fixed number of days for each category, because the product does not currently enforce one. If we introduce scheduled deletion we will update this policy.

You are responsible for recording lawfully. Laws about recording calls and meetings differ by country and state, and often require telling the other person or getting their agreement. RichRep does not obtain consent on your behalf.

In the RichRep web app, a recording starts when you press the explicit Record button and the browser asks for the permissions it needs — microphone, and for meeting or screen capture where applicable. Pressing Stop ends it.

In the Live Coach Chrome extension, capture works differently: after you enable coaching once, it starts automatically on each detected call on a supported dialer and stops when the call ends or you disconnect. See the Chrome extension section above. In both cases, telling the other person and getting any required agreement is your responsibility.

Connecting Google is optional. With your permission, RichRep receives your Google account email address to identify the connected account, along with access and refresh tokens that let the integration work without asking you to sign in for every sync.

For Google Calendar, RichRep reads your calendar list and selected calendars' event information. This includes calendar and event identifiers, titles, times, time zones, all-day and recurrence details, event status and, for two-way sync, descriptions or notes and synchronization metadata. We use this information to show your schedule, avoid conflicts, and synchronize events according to your calendar settings. When you turn on two-way sync for an account, RichRep creates and updates events in the one calendar you chose, only for the events you send there, and deletes them there only when you choose to.

If you connect Gmail, RichRep reads and caches the mailbox information described above to display and search your messages and recognize replies. It sends messages you approve. Mailbox access is separate from connecting Google Calendar.

Connection tokens are encrypted before storage on the server. Connected account details, imported messages, calendar event copies and synchronization records are stored in RichRep's database to provide these features. Relevant content you include in a request to Rich may also be processed by the AI services described above to answer that request.

RichRep follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the visible features you authorize. We do not sell it, use it for advertising or credit decisions, or use it to train general-purpose AI models. Service providers may receive it only as needed for those features with your consent, for security, or as required by law. A business transfer of Google user data requires your prior explicit consent. Human access is limited to your affirmative permission for specific data, security needs, legal obligations, or aggregated internal operations permitted by Google's policy. These restrictions also apply to data derived from Google APIs and take precedence over broader sharing language elsewhere in this policy.

You can disconnect an integration in RichRep and revoke its Google permissions at your Google Account connections. Revoking permission stops future authorized access but does not itself erase stored copies. Calendar disconnection removes connection credentials, cached busy events, sync cursors and pending exports; it does not delete events in Google or personal tasks already created or imported into RichRep. Cached mailbox messages remain after disconnection. Delete retained RichRep items using the available controls or email support@richrep.com to request deletion of imported Google data or your account.

RichRep Live Coach itself does not access Google Calendar or Gmail; those are separate, optional web app integrations described above. Its handling of extension user data follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• we use the data only to provide and improve the coaching features the user installed the Live Coach extension for;
• we do not sell it, and we do not transfer it for advertising or credit purposes;
• we transfer it only to the service providers needed to run those features, or where required by law;
• RichRep staff and service-provider humans may access specific data only with the user's affirmative permission for that data, or for security, legal compliance, or internal operations using aggregated and anonymized data as permitted by the policy.

Authorized workspace members' access to shared records through the product is described separately under “Who can see your data inside RichRep”; it is not blanket permission for staff or service-provider humans to read those records.

RichRep is for business use and is not intended for anyone under 16.

Our providers may process and store data in countries other than the one you are in, including the United States.

You can ask us for a copy of your personal data, ask us to correct it, or ask us to delete it. Email support@richrep.com from the address on your account and we will verify the request before acting on it. If your account was created by your employer, we may need to route the request through that workspace's administrator.

If we change this policy we will update the effective date above, and for significant changes we will tell workspace administrators. Before using Google user data for a new purpose, we will update the disclosures and request your consent.

Privacy questions, data requests and security reports: support@richrep.com.