Do Not Sell or Share My Personal Information

We do not sell your personal information for money, and we do not share it with third parties for cross-context behavioural advertising. We don't run advertising on Rufus today. The phrases “sell” and “share” here have the broad definitions given to them by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

We still provide this page because the law requires us to offer the right to opt out, and because we want you to be able to assert it in one place regardless of what we do in the future.

If you are a California resident, you have the right to:

• Know what personal information we collect, the sources, the purposes, and the categories of recipients.
• Access a copy of the personal information we hold about you.
• Deletepersonal information we collected from you, with limited exceptions (e.g. records we're legally required to retain for tax).
• Correct inaccurate personal information.
• Opt out of sale or sharing of personal information.
• Limit use of sensitive personal informationto what's strictly necessary to provide the service.
• Non-discrimination— we won't deny service, charge a different price, or provide a lower quality of service because you exercised these rights.

• Global Privacy Control (GPC). When your browser sends the GPC signal, we automatically apply an opt-out to your session: analytics and marketing categories are denied, no banner is shown, and the choice is recorded.
• Cookie preferences. Use the banner or the button below to set your categories at any time.
• Email request. Send us your request directly at privacy@exposql.com with the subject line “Do Not Sell or Share”. We'll confirm within 15 business days and complete the request within the timelines required by California law.

Email privacy@exposql.com from the address associated with your Rufus account. Include:

• The request type (access / delete / correct).
• Enough detail for us to verify your identity — we may ask for additional information consistent with what we already hold about you.
• For corrections, the specific item to correct and the corrected value.

We respond within 45 days. We may extend by another 45 days if your request is complex, and we'll tell you when we do. Requests are free unless they're manifestly unfounded or excessive — we'll explain any charges in advance.

You may use an authorized agent to submit a request on your behalf. The agent must provide written permission signed by you, and we may still verify your identity directly. Send the agent's request to privacy@exposql.com.

For full detail see the Privacy Policy. In summary, in the past 12 months Rufus has collected:

• Identifiers — name, email, Google user ID.
• Customer records — account information.
• Commercial information — subscription, credit ledger.
• Internet activity — log files, device + browser metadata.
• User-generated content — workspace profile, knowledge base, proposals, RFP responses, contracts uploaded for review.

We do not knowingly collect biometric identifiers, geolocation data more precise than approximate IP-based location, government IDs, or any other category of sensitive personal information beyond what is needed to operate the product.

• Sale of personal information: none.
• Sharing for cross-context behavioural advertising: none.
• Disclosure for a business purpose: categories listed in the Privacy Policy — primarily our sub-processors (sign-in, hosting, payments, database, AI provider). See the Subprocessors page.

Rufus is not directed at and not used by individuals under 16. We do not knowingly sell or share personal information about minors.

Privacy team: privacy@exposql.com. General contact: hello@exposql.com.