LEGAL

Privacy Policy

Effective date: June 1, 2026 · Operator: House of Hayes, Inc., operating as Rinney

CONTENTS

Who we are
What information we collect
How we use your information
How we share your information
Data storage and security
Your rights and controls
Data retention
Children's privacy
California residents (CCPA)
International users (GDPR)
WhatsApp and Meta
Changes to this policy
Contact us

Plain-language summary: Rinney is a task-specific coordination and booking assistant. We collect only what we need to coordinate your crew — messages, preferences, and optionally your calendar availability and a saved payment method. You can view, correct, and delete your data at any time. We never sell your data. We never custody your funds.

Who we are

Rinney is a task-specific coordination and booking service operated by House of Hayes, Inc., a corporation organized under the laws of the State of New York ("Rinney," "we," "us," or "our"). Our service helps friend groups coordinate outings and book experiences through WhatsApp.

Rinney is not a general-purpose AI assistant. Our service is scoped exclusively to coordination, scheduling, and booking tasks on behalf of groups that have explicitly opted in.

What information we collect

Information you provide directly

Account and identity information: Your display name and WhatsApp phone number when you join a Rinney crew.
Opt-in consent: A timestamped record of your consent to receive messages from Rinney, as required by WhatsApp Business Platform rules.
Crew preferences and constraints: Information you share in the crew chat that Rinney uses to coordinate — dietary preferences, scheduling constraints, budget ranges, and similar.
Payment method: If you save a payment method, it is tokenized by Stripe, Inc. We never receive or store your full card number. We store only Stripe's tokenized reference.
Loyalty and points accounts (future feature): If you choose to link loyalty program accounts, we store only the information needed to surface relevant deals. This is optional and off by default.

Information collected automatically

Message content: Messages sent within your Rinney crew room are received and logged to power the crew brain — the persistent memory that enables Rinney to make useful suggestions. Only messages sent in a Rinney-hosted group (not your personal WhatsApp chats) are processed.
Derived crew facts: Rinney uses an AI model (Anthropic's Claude API) to extract structured facts from messages — recurring intentions, key dates, preferences, and constraints. These derived facts are stored separately and are visible and editable by crew members.
Booking and transaction history: Records of proposals, votes, and completed bookings within your crew, used to power the crew's history and annual value summary.
Usage metadata: Timestamps of messages, API call logs, and service events used for reliability and debugging. This data does not include message content.

Calendar information (optional)

If you choose to connect a calendar (Google Calendar, Microsoft Outlook, or Apple Calendar), Rinney requests read-only access to your free/busy availability. We do not read the titles, descriptions, or attendees of your calendar events — only whether a time slot is free or busy. Calendar access tokens are encrypted at rest and stored with least-privilege access. You can disconnect your calendar at any time.

Information we do not collect

We do not access your personal WhatsApp chats outside of Rinney-hosted crew rooms.
We do not collect biometric data, precise geolocation, or government-issued identification numbers.
We do not retain full payment card numbers at any point.
We do not collect data from minors under 13. See Section 8.

How we use your information

We use the information we collect exclusively to operate the Rinney service. Specifically:

To coordinate your crew: Processing messages to identify coordination requests, extracting and maintaining the crew brain, proposing plans, and conducting availability polls.
To facilitate bookings: Generating Stripe payment links, presenting confirmation gates before any charge, and logging completed bookings in crew history.
To send crew communications: Sending messages within your crew room in response to requests, and sending approved proactive utility templates (e.g., a weekly crew digest or an event reminder) at rationed frequency. We do not send unsolicited marketing messages.
To improve the service: Anonymized and aggregated usage data helps us understand how crews use Rinney and improve the coordination logic. We do not use individual message content for model training without explicit consent.
To comply with legal obligations: Maintaining records required by applicable law, responding to lawful requests from authorities, and enforcing our Terms of Service.

We do not use your information for advertising, profiling for third-party purposes, or any purpose unrelated to operating the Rinney coordination service.

How we share your information

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

Service providers

We share data with third-party vendors who help us operate the service, each bound by data processing agreements and limited to using data only for the services they provide us:

Meta Platforms, Inc. (WhatsApp): Messages sent and received through the WhatsApp Business Platform are subject to Meta's terms and privacy policy. Rinney operates as a WhatsApp Business Solution provider.
Anthropic, PBC: Message content is sent to Anthropic's Claude API for intent extraction and proposal generation. Anthropic processes this data as a data processor under our agreement and does not use your data to train models by default.
Stripe, Inc.: Payment tokenization and checkout link generation. Stripe receives payment information directly from you under Stripe's own privacy policy. We do not transmit full card data to Stripe — Stripe's tokenization occurs client-side.
Supabase, Inc.: Database hosting for crew data, messages, and facts. Data is stored in encrypted databases with row-level security.
Google LLC / Microsoft Corporation: If you connect a Google or Microsoft calendar, we interact with their OAuth and Calendar APIs under their respective privacy policies.
Vercel, Inc. / Railway Corp.: Infrastructure and hosting providers for our application layer.

Within your crew

Certain information is shared by design with other members of your Rinney crew room — including proposals, votes, booking confirmations, and crew brain facts. This is the core function of the service. Do not share information in a Rinney crew room that you do not wish other crew members to see.

Legal requirements

We may disclose information if required by law, subpoena, court order, or other governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Rinney, our users, or the public.

Business transfers

If House of Hayes, Inc. is acquired, merged, or undergoes a change of control, user data may be transferred as part of that transaction. We will notify affected users and, where required, obtain consent before any such transfer.

Data storage and security

We take the security of your data seriously — particularly because Rinney holds sensitive information including calendar availability and payment tokens.

Encryption at rest: All calendar OAuth tokens and payment method tokens are encrypted at rest using AES-256. The crew brain database uses row-level security so each crew's data is isolated.
Encryption in transit: All data transmitted between your device, WhatsApp, and Rinney's servers is encrypted using TLS 1.2 or higher.
Least-privilege access: Rinney's application components access only the data they require to perform their specific function. No component has blanket access to all user data.
Audit logging: Every action Rinney takes on behalf of a crew — every message sent, every booking initiated — is logged in an audit trail accessible to the crew.
No fund custody: Rinney never holds, transfers, or custodies your money. All payments flow directly from you to the merchant or booking platform via Stripe-hosted checkout links.

No security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Your rights and controls

You have meaningful control over your data in Rinney. The following rights are available to all users regardless of location:

View your crew brain: Any crew member can request to see the full set of facts Rinney holds about the crew at any time by messaging Rinney directly.
Correct inaccurate facts: You can instruct Rinney to update or correct any fact in the crew brain that is inaccurate.
Delete crew brain entries: You can request deletion of specific facts, or the entire crew brain, at any time.
Disconnect your calendar: You can revoke Rinney's calendar access at any time, either by messaging Rinney or through your Google/Microsoft account settings. Rinney will fall back to polling for your availability.
Remove your payment method: You can remove a saved payment method by messaging Rinney. The underlying Stripe token will be deleted.
Leave a crew: You can leave a Rinney crew at any time. Your message history will remain in the crew log (as it is part of the crew's shared record), but your personal preferences and consent records can be deleted upon request.
Delete your account: You can request complete deletion of all personal data associated with your phone number by contacting us at [email protected]. We will process deletion requests within 30 days.
Opt out of proactive messages: You can mute or opt out of proactive messages (nudges, digests) at any time by messaging Rinney the word STOP or contacting us directly.

To exercise any of these rights, message Rinney directly in your crew room or contact us at [email protected].

Data retention

Active crew data: Retained for as long as the crew is active and members have not requested deletion.
Message logs: Raw message logs are retained for 12 months, after which they are deleted. Derived crew brain facts persist until deleted by the crew.
Booking records: Retained for 7 years for accounting and tax compliance purposes, in anonymized form after 24 months.
Consent records: Opt-in consent timestamps are retained for the duration of the service relationship plus 3 years, as required for legal compliance.
Calendar tokens: Deleted immediately upon disconnection or account deletion.
Payment tokens: Deleted immediately upon removal or account deletion.
Inactive crews: Crew data for groups with no activity for 18 consecutive months may be deleted after 30 days' notice to the crew captain.

Children's privacy

Rinney is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete that information.

WhatsApp's minimum age requirement is 13 (or 16 in certain jurisdictions). By using Rinney, you represent that you meet WhatsApp's minimum age requirement for your jurisdiction.

California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Correct: You may request that we correct inaccurate personal information we hold about you.
Right to Opt Out of Sale: We do not sell personal information. You do not need to opt out.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To submit a verifiable consumer request, contact us at [email protected]. We will respond within 45 days.

Categories of personal information collected: Identifiers (name, phone number); commercial information (booking history); internet or other electronic network activity (message logs); inferences drawn from the above (crew brain facts).

International users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies:

Legal basis for processing

Contract performance: Processing necessary to provide the Rinney service you have requested.
Consent: Where we rely on consent (e.g., calendar access, proactive messages), you may withdraw consent at any time without affecting the lawfulness of prior processing.
Legitimate interests: Service security, fraud prevention, and improving service reliability, where not overridden by your interests.
Legal obligation: Processing required to comply with applicable law.

Your GDPR rights

You have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with your local data protection authority.

Data transfers

Rinney is operated from the United States. If you are located outside the US, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses or other approved transfer mechanisms where required.

To exercise your GDPR rights, contact [email protected].

WhatsApp and Meta

Rinney operates on the WhatsApp Business Platform, provided by Meta Platforms, Inc. By participating in a Rinney crew room, you acknowledge that:

Messages transmitted through WhatsApp are subject to WhatsApp's Privacy Policy in addition to this policy.
Rinney is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. or WhatsApp.
Rinney is a task-specific coordination and booking assistant operating under WhatsApp's Business Platform terms. We do not use the WhatsApp platform for general-purpose AI assistant services.
Your opt-in consent to receive Rinney messages is required before we send you any communications, and you may opt out at any time.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by sending a message through your Rinney crew room and updating the effective date at the top of this page. Your continued use of Rinney after the effective date of a revised policy constitutes your acceptance of the changes.

We encourage you to review this policy periodically. The current version is always available at rinney.com/privacy.

Contact us

Privacy questions and requests

For privacy-related inquiries, data deletion requests, or to exercise any of your rights under this policy, please contact:

House of Hayes, Inc.
Operating as Rinney
53 Boerum Pl. Suite 7A, Brooklyn, NY

Email: [email protected]
General: [email protected]

We aim to respond to all privacy requests within 30 days. For urgent matters, please include "URGENT" in your subject line.

rinney.com