Privacy Policy

This site and the Rootwork platform are operated by [Legal entity name](“Rootwork”, “we”, “us”). We build websites and manage Google Business Profiles for local businesses, and we provide a dashboard our clients use to see the work we manage for them.

This policy explains what personal information we collect, why, and what we do with it. If anything here is unclear, email us at [privacy@yourdomain.com].

When you request a free audit. We collect your business name, your name, email address, and optionally your phone number, website address, Google listing, and any notes you write. We use this only to prepare and send the audit and to reply to you.

When you become a client. We collect account details for your workspace, along with the business data you or we enter into it — contacts, reviews, and related records.

When you connect a Google account. Clients may connect a Google account so we can manage email follow-ups on their behalf. This is described in detail in the next section.

Automatically. Our servers record standard technical information such as IP address and browser type as part of serving and securing the site.

Where a client connects a Google account, we request access to that account's email in order to identify messages that need a follow-up, show them in the client's dashboard, draft suggested replies, and send replies the client approves.

Rootwork's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not:

• sell Google user data;
• use Google user data for advertising, or transfer it for advertising purposes;
• allow humans to read this data, except where the client has given explicit permission, where it is necessary for security purposes or to comply with the law, or where the data has been aggregated and anonymised.

Message content is processed by our automation and by OpenAI to generate suggested replies. It is not used to train models. A client can disconnect their Google account at any time, which revokes our access, and can also revoke it directly from their Google account permissions page.

• To prepare and send the free audit you requested.
• To deliver and support the services a client has engaged us for.
• To operate, secure, and troubleshoot the platform.
• To reply to you when you contact us.
• To meet legal and accounting obligations.

We do not sell personal information, and we do not send marketing email to people who requested an audit unless they separately ask us to.

Data is stored in our Supabase database (hosted on [AWS region / hosting location]) and transmitted over encrypted connections. Client workspaces are separated so that one client cannot access another's data.

We use a small number of service providers who process data on our behalf: Supabase (database, authentication, and file storage), OpenAI (generating suggested replies and summaries), n8n (automation, self-hosted by us), Google (where an account has been connected), and [hosting provider]. We share information with them only as needed to run the service.

We may also disclose information where we are legally required to.

Audit requests are kept for [12 months] from the date of submission, then deleted. Client data is kept for the duration of the engagement and for [X months] afterwards, unless you ask us to delete it sooner. Backups may persist for a short additional period before being overwritten.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email [privacy@yourdomain.com] and we will respond within [30] days. If you are in a jurisdiction with specific data protection rights, such as the UK, EU, or California, those rights apply and we will honour them.

We use cookies that are necessary for the site and dashboard to work — principally to keep clients signed in. [Add a line here if you introduce analytics or any non-essential cookies, which would also require a consent banner in some jurisdictions.]

Our services are intended for businesses. We do not knowingly collect personal information from children.

If we change this policy we will update the date at the top of this page. Where the change is significant, we will tell affected clients directly.

Questions about this policy, or about data we hold, go to [privacy@yourdomain.com]. Postal address: [Business address].