---

1) Who we are

Rhubarb (the "Service") is provided by Rhubarb Analytics Inc. ("Rhubarb", "we", "us").

• Company: Rhubarb Analytics Inc.
• Product: Rhubarb Viz
• Websites: rhubarbviz.com; rhubarbanalytics.com
• Contact email: privacy@rhubarbanalytics.com
• Mailing address: 367 St Marks Ave #1060 Brooklyn, NY 11238 United States
• Operations focus: United States (we may have users outside the US; see International transfers below)

2) Scope

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

• visit our websites,
• create an account,
• use Rhubarb Viz to create visualizations and manage data sources, or
• communicate with us (for example, support requests or marketing signups).

3) Information we collect

3.1 Information you provide

• Account information: email address, username, password (stored as a hash), registration code (if required).
• Payment information: we use Stripe to process payments. We do not store full payment card numbers; Stripe handles that information.
• Content you create or upload: text prompts, visualization descriptions, uploaded datasets, and other content you submit to generate or manage outputs in the Service.
• Connected data sources: connection details and credentials you provide to connect external data sources (for example, database credentials, API keys, or OAuth tokens).
• Communications: messages you send to support, feedback you submit, and information you provide in forms.

3.2 Information collected automatically

• Usage and device data: log data such as IP address, browser type, device identifiers, pages visited, actions taken in the Service, and timestamps.
• Diagnostic and security data: information used for debugging, performance monitoring, fraud prevention, and abuse detection.
• Analytics data (Google Analytics or equivalent): we use analytics tools that may collect information about how you use the Service, including pages viewed, time spent, clicks, approximate location derived from IP address, device/browser information, and a unique identifier stored in a cookie or similar technology. We use this information to understand usage, improve performance, and make product decisions. Where required by law, we deploy analytics only after you provide consent through our cookie controls.

3.3 Information from third parties

We may receive information from service providers (for example, payment confirmation from Stripe) or from advertising/analytics partners if you engage with our ads on other platforms (see Advertising and marketing).

4) How we use information

We use personal information for the following purposes:

• Provide the Service: create accounts, authenticate users, generate visualizations, store your outputs, and support connected data sources.
• Fraud prevention and security: protect accounts, investigate suspicious activity, and prevent misuse.
• Debugging and analytics: diagnose errors, monitor performance, and understand product usage (including using tools like Google Analytics where enabled).
• Marketing: send marketing emails (you can opt out), and run targeted advertising to reach potential users on other platforms.
• Compliance and legal: comply with applicable laws, resolve disputes, and enforce our terms.
• Improve the Service: develop new features and improve reliability and user experience.

4.1 Legal bases (EEA/UK users)

If you are in the EEA or UK, we rely on one or more of the following legal bases (depending on the context):

• Contract: to provide the Service you request.
• Legitimate interests: to secure and improve the Service, prevent fraud, and understand usage (balanced against your rights). In some jurisdictions, analytics may be treated as requiring consent; where required, we rely on your consent for analytics cookies and similar technologies.
• Consent: where required for certain cookies (including analytics), marketing emails, or similar activities.
• Legal obligation: where we must process data to comply with law.

5) Cookies and similar technologies

We use cookies and similar technologies for:

• Essential functionality: authentication and security (for example, session and CSRF protection).
• Analytics: to understand performance and usage (for example, Google Analytics or an equivalent analytics provider).
• Debugging: to diagnose errors and monitor reliability.
• Marketing: to measure and improve marketing campaigns.

5.1 Analytics cookies (Google Analytics)

If enabled, Google Analytics uses cookies or similar technologies to collect and analyze information about use of the Service. This information is generally transmitted to and processed by Google. We use Google Analytics reports to understand how people use the Service and to improve it.

Your choices: Where required by law, we will ask for your consent before setting analytics cookies. You can also manage your cookie preferences through our cookie banner/controls (when available), and you may be able to limit Google Analytics by using browser settings or tools provided by Google.

5.2 Cookie choices

Depending on your location, you may have choices about certain cookie categories. If we implement a cookie consent banner, it will provide these choices where required and allow you to change your preferences later.

6) How we share information

We may share personal information with:

• Service providers that help us operate the Service, such as:
  • Stripe (payments)
  • AWS (hosting and infrastructure)
  • Google (analytics and email/productivity tooling, where used)
  • OpenAI and Anthropic (AI processing to provide features)
• Professional advisors (lawyers, accountants) as needed.
• Legal and safety recipients when required to comply with law or protect rights, safety, and security.
• Business transfers if we are involved in a merger, acquisition, or sale of assets (you will be notified as required).

We do not disclose your connected data source credentials to other users. We use them only to provide the Service (for example, to access a connected source at your direction).

7) Advertising and marketing

7.1 Marketing emails

We may send marketing emails. You can opt out at any time by using the unsubscribe link (when provided) or by contacting us at privacy@rhubarbanalytics.com.

7.2 Targeted advertising on other platforms

We may use targeted advertising to reach potential Rhubarb users on other platforms. Depending on how advertising technology is configured, some jurisdictions may treat certain ad-related disclosures as "sharing" for cross-context behavioral advertising.

California notice: If "sale" or "sharing" is interpreted to include certain advertising technology activities, we will comply with applicable law and honor opt-out requests where required.

Opt-out (where applicable): You can request to opt out of sale/sharing and targeted advertising by emailing privacy@rhubarbanalytics.com with the subject line "Opt out of sale/sharing".

8) Data retention

We retain information for as long as necessary to provide the Service and for legitimate business purposes such as security, compliance, and dispute resolution.

• Service data and outputs: We retain the data you produce within the app to provide the Service, unless you delete it or request deletion (subject to legal and operational limits).
• Chat conversations: We may retain chat conversations to support and improve the Service experience.
• Server logs: We delete server logs regularly. We may keep limited security logs longer when necessary to prevent fraud and abuse.

Where a specific retention period is not listed, we use criteria such as account status, operational necessity, and legal requirements to determine retention.

9) Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is 100% secure. You are responsible for keeping your credentials confidential.

10) International transfers

We store and process data in the United States, regardless of where the user is located.

If you are located in the EEA/UK and we transfer personal data to the United States, we will use an appropriate transfer mechanism where required, such as standard contractual clauses and/or equivalent UK transfer addenda, and implement supplementary measures as appropriate.

11) Your privacy rights

11.1 United States

You may request access to, correction of, or deletion of your personal information by contacting privacy@rhubarbanalytics.com. We will respond as required by applicable law.

11.2 California (CCPA/CPRA)

If you are a California resident, you may have rights to know, delete, correct, and to opt out of the sale or sharing of personal information (as those terms are defined under California law). You may also have the right to limit the use and disclosure of sensitive personal information in certain circumstances.

To submit a request, email privacy@rhubarbanalytics.com with "California Privacy Request" in the subject line. Please include enough information for us to verify your request.

11.3 EEA/UK (GDPR/UK GDPR)

If you are located in the EEA or UK, you may have rights including access, correction, deletion, restriction, portability, and the right to object to certain processing. You may also withdraw consent where we rely on consent.

To exercise these rights, email privacy@rhubarbanalytics.com with "GDPR Request" in the subject line. We will respond within the timeframe required by applicable law.

12) Children

The Service is not intended for children under 13. If you believe a child under 13 has provided us personal information, please contact us at privacy@rhubarbanalytics.com and we will take appropriate steps.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and we may provide additional notice where required by law.

14) Contact us

If you have questions about this Privacy Policy or our privacy practices, contact:

• Email: privacy@rhubarbanalytics.com
• Mail: 367 St Marks Ave #1060 Brooklyn, NY 11238 United States

---