Privacy Policy

R2 Command (“R2 Command,” “we,” “us”) is business software for home service contractors, operated by R2 Sealing, LLC of York, Pennsylvania. This policy explains what information we handle, why, who we share it with, and what choices you have. It covers our website at r2command.com and the R2 Command app.

1. Two roles

Most of the information in R2 Command is not about the people who use it. It is about a contractor's customers, and the contractor put it there. So we play two roles:

• For the businesses that sign up (“account holders”) and their team, we decide how information is used to run the service, and this policy describes that.
• For a business's own customers, leads and vendors, the business decides what to collect and why, and we handle it on the business's behalf to provide the software. If you are a customer of a business that uses R2 Command, that business's privacy policy governs, and requests about your information should go to them first.

2. Information we handle

Account information

Name, email address, phone number, role, business name and address, and sign-in details for each person on an account. We do not see or store card numbers; payment details go directly to Stripe.

Business information that a business enters or connects

• Contacts and leads: names, phone numbers, email addresses, service addresses, how they heard about the business, notes, photos and documents.
• Jobs, estimates, contracts, invoices, payments, expenses, bills and the books built from them.
• Messages: text messages, emails and call records, and call recordings where the business has turned recording on.
• Bank accounts and transactions, when a business links an account through Plaid. We receive the account and transaction data the business authorizes. We do not receive the bank sign-in credentials.
• Tax identification numbers for vendors and contractors a business pays, where the business enters them to prepare 1099 information.
• Payroll information, where a business connects Gusto.
• Crew time, and location when a crew member uses features such as mileage tracking or route reporting.
• Knowledge-base documents a business writes so the AI features can sound like the business.

Requests for access

If you ask for access to R2 Command on our website, we keep the name, business, email address, phone number and any notes you send, and when you asked, so we can reply. We use them only to follow up with you about R2 Command, and you can ask us to delete them at any time.

Information collected automatically

IP address, browser and device type, pages and actions in the app, and timestamps, kept in server logs and in an audit log of important changes (who changed what, and when). The audit log exists so a business can see its own history.

Cookies

We use cookies to keep you signed in and, when you arrive through a partner's referral link, to remember which partner referred you. We do not use advertising or third-party analytics trackers on our website.

3. How we use information

• To provide, secure and support the service, including sending the messages and documents a business asks us to send.
• To bill account holders and pay partners.
• To detect fraud and abuse, enforce our terms, and keep records the law requires.
• To improve the service, using usage information about how features are used rather than the content of a business's records.

We do not sell personal information, and we do not share it for advertising across other companies' sites or apps.

4. AI features

Some features use a third-party AI provider: drafting texts and emails, summarizing conversations, helping draft estimate lines, reading receipts, and the AI receptionist that can answer a business's phone calls. When one is used, we send the provider the information needed for that task, such as a message thread, a job description, a receipt image or a call. We do not use a business's information to train AI models. Where the AI receptionist answers calls, the business is responsible for the call disclosure and recording consent that its state requires, and R2 Command provides settings for both.

5. Who we share information with

We share information only with service providers that help us run R2 Command, and only for that purpose:

• Supabase: database, sign-in and file storage
• Vercel: hosting the app and website
• Stripe: card and bank payments, and our own subscription billing
• Plaid: connecting bank accounts you choose to link
• Telnyx: text messages and phone calls, on the business's own account
• Brevo, SendGrid or Gmail: sending email, through whichever the business connects
• Gusto: payroll, if the business connects it
• Anthropic: the AI features (drafting, summaries, estimate help, receipt reading)
• Google Maps and Geoapify: address lookup, maps and routing
• Google Search Console: search performance figures, if the business connects its Google account (read-only)

Many of these connect to a business's own account with that provider (for example, its own Telnyx or Brevo account), and that provider's terms and privacy policy also apply to what passes through it.

We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of the business, in which case we will tell account holders first and the commitments in this policy will continue to apply to their information.

6. Bank connections through Plaid

We use Plaid Inc. (“Plaid”) to connect the bank accounts a business chooses to link. When you link an account, you sign in directly with your financial institution through Plaid. Your bank username and password never pass through R2 Command and are never stored by us. By linking an account, you grant R2 Command and Plaid the right, power, and authority to act on your behalf to access and transmit your information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy

Depending on which features you use, we receive some or all of: account holder name and account identifiers; account and routing numbers, used to verify an account for payments; account balances; and transaction history. We use this information only to provide the features you turned on: syncing transactions into your books, showing balances, and verifying accounts for payments. We do not sell it, and we do not use it for advertising.

You can disconnect a bank account at any time in Settings. Disconnecting stops new information from coming in and deletes our live connection. Transactions already synced into your books remain part of your business records; you can ask us to delete them as described in the “Your choices and rights” section. Information Plaid itself holds is governed by Plaid’s policy and Plaid’s own deletion process.

7. Text messages and email

Businesses send texts and email to their own customers and leads, and are responsible for having the consent the law requires. R2 Command records consent, honors STOP and unsubscribe requests automatically, and adds the identification and unsubscribe details the law requires to marketing email. Text messaging originator opt-in data and consent will not be shared with third parties or affiliates for marketing or promotional purposes.

8. How long we keep information

We keep a business's information while its account is active. A business can export its data, and can ask us to delete it when it closes its account. We may keep some records afterward where the law requires it, such as billing and tax records, and in backups until they expire. Deleting a record inside the app removes it from the business's view; backups roll off on a schedule.

9. Security

Each business's data is kept separate from every other business's, access inside a business depends on a person's role (an accountant a business invites can see its financial records, including tax identification numbers, and where a business works with an agency, that agency's staff can access the business's account as the business allows), the credentials for services a business connects are encrypted before they are stored, tax identification numbers are kept apart from ordinary records where only the server can read them, and important changes are written to an audit log that account holders cannot edit. Our hosting providers encrypt data in transit and at rest. No system is perfectly secure, and we cannot promise that information will never be accessed without authorization. If a breach affects your information, we will notify you and the authorities as the law requires.

10. Your choices and rights

You can ask to see, correct, export or delete the personal information we hold about you as an account holder. Depending on where you live, including California, Colorado, Connecticut, Virginia and other states with privacy laws, you may also have the right to know what we collect, to opt out of the sale or targeted-advertising use of your information (we do neither), and to appeal a decision on your request. We will not treat you differently for using these rights.

Email info@r2sealing.com to make a request. We may need to verify who you are first. If you are a customer of a business that uses R2 Command, contact that business; if you contact us, we will pass your request to them where we can.

11. Who this is for

R2 Command is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. The service is operated in the United States and information is processed here.

12. Changes

We will post changes here and update the date above. If a change is significant, we will also tell account holders by email or in the app before it takes effect.

13. Contact

R2 Sealing, LLC, operating R2 Command, York, Pennsylvania.

Email: info@r2sealing.com