Privacy Policy
Privacy Policy
It is the policy of Convbox Digital Limited to respect your privacy regarding any information we may collect while install our app or visit our site. This Privacy Policy applies to https://www.rto.ai and RTO apps including Omnitrack series of apps (hereinafter, “Convbox Digital Limited”, “us”, “we”, “app” or “rto.ai”). We respect your privacy and are committed to protecting personally identifiable information you may provide us through the Website or App. What information may be collected on our Website and App, how we use this information, and under what circumstances we may disclose the information to third parties. This Privacy Policy applies only to information we collect through the Website and App and does not apply to our collection of information from other sources.
Google API Services Disclosure
RTO uses Google's Application Programming Interface (API) Services to enable the user authorization feature for accessing the RTO platform (i.e. use of your Gmail account to login to the RTO platform). RTO 's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Collection of your Personal Information
When you visit rto.ai, our site may collects some non-personally-identifying information such as the browser type, language preference, the date and time of each visitor request. we may also collect some potentially personally-identifying information like Internet Protocol (IP) addresses for logged in users
When you install RTO apps, we may collect the following infos from your shopify account
- View Shopify account data: Only for customers using our app – email, store url and name.
- View products:
- read_products – Access to Product, Product Variant, Product Image, Collect, Custom Collection, and Smart Collection.
- read_product_listings – Access to Product Listing, and Collection Listing.
- Manage your Online Store:
- read_themes and write_themes – Access to Asset and Theme.
- read_script_tags and write_script_tags – Access to Script Tag.
How Do We Use Your Personal Information
- Helping us to establish and verify the identity of users, and to keep user accounts secure
- Manage users’ accounts or memberships.
- Providing services and support to users.
- Providing users with product or service updates, promotional notices and offers, and other information about RTO.
- Corresponding with you, and responding to your questions, inquiries, comments, and instructions.
- Complying with applicable laws.
Data Retention
| Data category | Retention period | Disposal |
|---|---|---|
| Event / attribution data (raw and processed) | 24 months from collection | Deleted or anonymized thereafter |
| Aggregated / statistical reports | Retained in aggregated form (no longer identifies individuals) | Retained as needed |
| Account / profile data | For the life of the account, then 30 days after closure | Deleted or anonymized |
| Marketing contact data | Until consent is withdrawn or 24 months of inactivity, whichever is earlier | Deleted |
| Backups / archives | 30 days (90 days for financial/compliance-critical data) | Rotated and destroyed per backup policy |
Legal Basis for Processing
Where the GDPR applies, we rely on the following legal bases under Article 6(1) of the GDPR for each processing purpose:
| Processing purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Providing, operating, maintaining, and improving the Convbox service (performance of our contract with you) | Art. 6(1)(b) — performance of a contract |
| Marketing attribution, aggregated analytics, and product improvement | Art. 6(1)(f) — legitimate interests (subject to a balancing test that does not override your rights and freedoms) |
| Fraud prevention, security, and troubleshooting | Art. 6(1)(f) — legitimate interests |
| Sending marketing communications where consent is required | Art. 6(1)(a) — consent |
| Complying with legal obligations (e.g., tax, audit, law enforcement) | Art. 6(1)(c) — legal obligation |
CCPA / CPRA
California residents (CCPA/CPRA)
This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").
Categories of personal information we collect. We may collect the following categories of personal information: identifiers (such as name, email address, online identifiers); internet or other electronic network activity (such as browsing and interaction data); commercial information (such as purchase history); and inferences drawn from the above.
Sources. We collect personal information directly from you, automatically when you use our services, and from our business customers and third-party data partners.
Purposes. We use personal information for the business purposes described in this Policy, including providing and improving our services, analytics and attribution, security and fraud prevention, and legal compliance.
Sale / sharing of personal information. We do not "sell" personal information as that term is defined under the CCPA. We may disclose personal information to third parties on behalf of our customers and at their direction, including in connection with advertising and marketing services, subject to applicable privacy requirements and customer-configured privacy settings.
California consumer rights. Subject to certain exceptions, California residents have the right to:
- Know — request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, and sold/shared;
- Delete — request deletion of personal information we have collected;
- Correct — request correction of inaccurate personal information;
- Opt out of sale/sharing — the right to opt out of the sale or sharing of personal information where applicable under the CCPA;
- Limit use of sensitive personal information — the right to limit the use or disclosure of sensitive personal information (we do not use or disclose sensitive personal information to infer characteristics about you);
- Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
Exercising your rights. To exercise any of these rights, contact us at support@rto.ai or submit a request through the mechanism on our website. We will verify your request and respond within the time required by law. You may designate an authorized agent to make a request on your behalf.
Sharing Your Personal Information
We don’t share any personally identifying information publicly or with third-parties, except when required to by law. we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive.
Note to Residents of the European Union: In order to comply with the requirements of the European General Data Protection Regulation (GDPR) for our European users, this Privacy Statement outlines the legal basis on which we process your Personal Data and provides other information required by the GDPR.
Your Rights
Under applicable data protection law, you may have the following rights regarding your personal data:
- Right of access — obtain a copy of the personal data we hold about you;
- Right to rectification — correct inaccurate or incomplete personal data;
- Right to erasure ("right to be forgotten") — request deletion of your personal data in certain circumstances;
- Right to restriction of processing — request that we limit how we process your personal data;
- Right to data portability — receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller;
- Right to object — object to processing based on legitimate interests, including for direct marketing;
- Right to withdraw consent — withdraw consent at any time where processing is based on consent;
- Right to lodge a complaint — lodge a complaint with a supervisory authority.
To exercise any of these rights, contact us at support@rto.ai (or the designated privacy contact). We will respond to verified requests within 30 days. We may need to verify your identity before fulfilling a request.
Changes to Privacy Policy
Convbox Digital Limited reserves the right to change this Privacy Policy from time to time. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address specified in your account.
Contact Information
If you have any questions about our privacy policy, please feel free to contact us.