Privacy Policy

Table of Contents

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. AI Features
4. Legal Bases for Processing
5. Who Do We Share Your Information With?
6. Cookies and Tracking
7. Social Logins
8. Data Retention
9. Data Security
10. Children's Privacy
11. Your Privacy Rights
12. United States — State Privacy Rights
13. Google API & Limited Use Disclosure
14. Updates to This Notice
15. Contact Us

1. What Information Do We Collect?

Information you provide

When you create an account, we collect your name, email address, and optionally your phone number. If you sign up with Google, we receive your name, email, and profile picture from Google.

Information captured by the rarefriendX Chrome Extension

The extension captures contact information from social platforms only when you initiate a save or sync action. It does not collect data in the background.

From LinkedIn:

• Name, headline, job title, company
• Profile photo and profile URL
• Email and phone (when visible on profile)
• Location, bio, employment history, education, and skills

From Twitter / X:

• Display name, username, profile photo
• Bio, location, job title

From WhatsApp Web:

• Contact name, phone number, profile photo
• About text, business details (for business accounts)

Information from integrations

When you connect Google Calendar or Google Contacts, we access data from those services as described in Section 14 (Google API Disclosure).

If you use our WhatsApp features, we process messages and voice messages you send to our WhatsApp Business number.

What we do NOT collect

• Browsing history or activity outside supported platforms
• Passwords for third-party services
• Financial or payment card information (handled by our payment processor)
• LinkedIn messages or private communications (the extension's template UI parses messages locally but never sends message content to our servers)
• Biometric data or device sensor data

Crash reporting

The extension sends anonymous error reports to Sentry. These reports contain only the error type, extension version, and a random identifier. They never contain names, emails, phone numbers, or contact data.

2. How Do We Process Your Information?

We process your information to:

• Provide and maintain your CRM account
• Import and sync contacts from connected platforms
• Detect and merge duplicate contacts
• Sync calendar events and link attendees to contacts
• Create, reschedule, or cancel calendar events on your behalf (when you or our AI assistant request it)
• Import contacts from Google and, when you choose, push updated professional information back to your Google Contacts
• Provide AI-powered search, insights, and scheduling (see Section 3)
• Transcribe voice messages
• Display contact locations on a map
• Send transactional emails (verification, password reset, notifications)
• Provide customer support
• Comply with legal obligations

We do not use your data for advertising, ad targeting, selling to third parties, or creditworthiness assessments.

3. AI Features

Rarefriend uses third-party AI providers to power features like chat, contact insights, and meeting scheduling.

How it works

When you use an AI feature, your query and relevant contact data are sent to one of our AI providers to generate a response. We only send the data needed to answer your specific request — not your entire contact list.

What we do NOT do

• We do not use your data to train AI models
• Our AI providers do not use your data for training under their API terms
• We do not make automated decisions with legal or significant effects on individuals

Voice transcription

Voice messages sent via WhatsApp are transcribed using a third-party speech-to-text service. Audio is processed in real-time and not retained after transcription.

External AI tools (MCP)

If you connect external AI tools (such as Claude or Cursor) to rarefriend, those tools can access your contact data, notes, and calendar events through the same permissions as our built-in AI.

4. Legal Bases for Processing

For users in the EU, UK, or Switzerland:

• Consent— for connecting integrations and enabling AI features. Withdrawable at any time.
• Contract— to provide CRM services you signed up for.
• Legitimate interest— for security, fraud prevention, and service improvement.
• Legal obligation— to comply with applicable laws.

For contact data imported from third-party platforms, you (the user) are the data controller. You are responsible for ensuring you have a lawful basis to collect and process that data.

5. Who Do We Share Your Information With?

We share your data only with service providers who help us deliver the Service. Each operates under a data processing agreement or equivalent terms.

We do not sell or rent your data to third parties, data brokers, or advertisers. We may share data during a merger, acquisition, or asset sale, or when required by law.

6. Cookies and Tracking

We use cookies to maintain your session, save preferences, and ensure security. The rarefriendX extension reads your existing LinkedIn session cookie (li_at) locally to check if you're logged in before syncing. This cookie is never sent to our servers.

7. Social Logins

You can sign up or log in with Google. We receive your name, email, and profile picture. Social login only requests basic profile information and does not grant us access to Google Calendar, Contacts, or any other Google service. Those require separate authorisation.

8. Data Retention

We retain your data only as long as necessary:

• Account data— kept while your account is active. Upon deletion, permanently removed within 90 days.
• Contact data— kept while your account is active. Deleted contacts are permanently purged within 90 days.
• Voice recordings— not retained after transcription.
• AI conversations— automatically purged after 30 days of inactivity.
• Extension local data— stored on your device until you uninstall the extension or reset sync.
• Backups— retained for a minimum of 7 days after deletion from active systems.

When you delete your account, all associated data — contacts, notes, events, files, and AI conversations — is permanently removed from our systems.

9. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Encrypted storage of sensitive credentials
• Multi-factor authentication (MFA)
• Role-based access controls and workspace isolation
• Rate limiting and abuse prevention
• Regular security reviews

No method of electronic transmission or storage is 100% secure. We strive to protect your data but cannot guarantee absolute security.

10. Children's Privacy

We do not knowingly collect data from children under 18. If you believe a child's data has been collected, contact us at privacy@rarefriend.com and we will promptly delete it.

11. Your Privacy Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data
• Export your data in a machine-readable format
• Restrict or object to certain processing
• Withdraw consent at any time

For contacts stored in our users' CRM

If your personal information has been stored in someone else's rarefriend account and you wish to request access, correction, or deletion, you may submit a request at rarefriend.com/erasure-request.

To exercise any of these rights, email privacy@rarefriend.com. We respond within 30 days.

12. United States — State Privacy Rights

Residents of California and other US states with comprehensive privacy laws have additional rights, including:

• Know whether we process your personal data
• Access, correct, or delete your data
• Obtain a portable copy of your data
• Non-discrimination for exercising your rights
• Opt out of targeted advertising or sale of personal data

Categories of information we collect

We have not sold or shared personal information for business or commercial purposes in the preceding 12 months, and will not do so in the future.

To exercise your rights, email privacy@rarefriend.com. If we decline your request, you may appeal, and if your appeal is denied, you may submit a complaint to your state attorney general.

13. Google API & Limited Use Disclosure

Rarefriend's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access

• Google Contacts— We read your contacts and "Other Contacts" (auto-saved from email interactions) to import them into your workspace. We access names, emails, phone numbers, job titles, organisations, and photos. When you choose to push updated professional information (such as a new job title) back to Google, we write those specific fields to the corresponding Google Contact on your behalf.
• Google Calendar— We read your events to display meetings alongside contacts. We access event titles, times, attendees, and descriptions. When you or our AI assistant create, reschedule, or cancel an event, we write to your calendar on your behalf.

Our commitments

• Google data is used only to provide user-facing features of rarefriend
• Google data is not sold to third parties or data brokers
• Google data is not used for advertising or retargeting
• Google data is not used for creditworthiness or lending
• Google data is not used to train AI or machine learning models
• Google data is not transferred to other apps except as needed to provide the Service
• Humans do not read your Google data unless you give affirmative consent, or it is required for security or legal purposes

Revoking access

Disconnect Google integrations any time from Settings → Integrations. This immediately revokes our access. You can also revoke access from myaccount.google.com/permissions. Revoking access does not delete data already imported — use the delete options in your workspace or contact us.

14. Updates to This Notice

We may update this Privacy Notice from time to time. Material changes will be communicated by email or an in-app notice. The "Last updated" date at the top reflects the most recent revision.

15. Contact Us

For privacy-related inquiries:

• Email: privacy@rarefriend.com
• Website: rarefriend.com/contact
• Erasure requests: rarefriend.com/erasure-request

Google API Services

rarefriend's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide and improve features directly requested by you and is never sold, used for advertising, or shared with third parties for purposes unrelated to the Service.

If you connect your Google account, we request only the scopes necessary for the features you enable (Google Contacts sync, Google Calendar access). You can revoke access at any time from your Google Account permissions page.