Rraft Privacy Policy

Last Updated: August 19, 2026

This Privacy Policy explains how Rraft ("Rraft," "we," "us," or "our") collects, uses, discloses, stores, and protects personal information when you access or use the Rraft website, applications, dashboards, communications, Tasks, Rewards, and related products and services (collectively, the "Services").

This Privacy Policy applies to Property Providers, Residents, Community Members, individuals invited to join Rraft, individuals referred through Rraft, and other persons whose information is processed through the Services.

By using the Services, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

The information Rraft collects depends on how you interact with the Services and which features you use.

Account and Profile Information

When you create or maintain a Rraft account, we may collect information such as:

• your full name;
• email address;
• home or Property address;
• unit number;
• account type and role;
• Property or organization associations;
• account preferences and settings; and
• a profile image if profile-image functionality is enabled.

Property Providers may also provide business or organization information, including company or management information and information about Properties managed through Rraft.

Information Provided by Property Providers

A Property Provider may provide information about a Resident before that Resident creates a Rraft account.

This information may include:

• Resident name;
• email address;
• Property address;
• unit information; and
• information reasonably necessary to associate the Resident with the applicable Property and send a Rraft invitation.

Rraft may use this information to create an invitation record, associate the Resident with the appropriate Property, and send an invitation to use the Services.

A Property Provider may remove an invited Resident record from its Property where permitted through the Services.

Authentication Information

Rraft uses a passwordless authentication system.

Users may authenticate using supported methods such as Google OAuth or login credentials or links delivered to the User's email address.

When you use Google to authenticate, Rraft may receive information made available through the authentication process, such as your name, email address, Google account identifier, and other profile information you authorize Google to provide.

Rraft does not receive or store your Google account password.

We may also collect authentication records such as login timestamps, IP addresses, device or browser information, authentication events, and related security information.

Task and Participation Information

When a Community Member accepts, performs, or completes a Task or other Rraft activity, we may collect information associated with that activity.

Depending on the Task, this may include:

• Task acceptance and completion records;
• Task status and history;
• form responses;
• written comments;
• checklists and checkbox responses;
• photographs;
• videos;
• receipts;
• documents;
• mailing or tracking information;
• timestamps;
• IP addresses;
• precise location information;
• device and browser metadata;
• electronic signatures;
• completion attestations;
• declarations or factual certifications; and
• other evidence or information required by the applicable Task.

We refer to information submitted to demonstrate or verify completion of a Task as "Task Evidence."

Precise Location Information

Rraft may collect precise device location information, including latitude and longitude, when you access certain portions of the Services, including the Community Member dashboard.

We use precise location information to:

• center maps and location-based interfaces around your current location;
• identify Tasks or opportunities available near you;
• determine geographic eligibility for certain features;
• verify that a Community Member is at or near a required Task location when a Task requires location verification;
• support fraud prevention and platform integrity; and
• support safety and compliance where appropriate.

Rraft may store precise location information collected through these features.

Precise device location is not displayed to Property Providers, other Residents, or other Community Members merely because they use Rraft.

Precise location may be accessible to authorized Rraft personnel and may be processed by service providers that host or operate Rraft systems on our behalf.

Certain Task records may indicate the location at which a Task was completed when location is relevant to Task verification.

Photos, Videos, and Other Media

Rraft may collect photos, videos, documents, and other media submitted through Tasks or other supported features.

Image uploads may be resized and processed before storage. Rraft's current image-processing workflow generally removes embedded image metadata from the processed output, including EXIF metadata, while retaining information necessary to process the image such as its dimensions.

This image processing does not prevent Rraft from separately collecting precise location, IP address, timestamps, or other metadata through the Services.

Task Evidence and media may be viewed by authorized Rraft administrators and by the Property Provider associated with the applicable Task.

Property Providers may be able to view and download Task Evidence associated with their Properties and Tasks.

Users generally cannot individually delete Task Evidence after it has been submitted. Account or privacy deletion requests remain subject to the retention rules described in this Privacy Policy.

Task Chat and Communications

Rraft provides a text-based chat feature that may be used by a Community Member and Property Provider in connection with an active Task.

Rraft stores Task chat messages in its database. Task chat records are encrypted at rest and may be accessed by:

• the Community Member participating in the Task;
• the relevant Property Provider; and
• authorized Rraft administrators when reasonably necessary for support, safety, dispute resolution, fraud prevention, compliance, or administration of the Services.

Task chat messages cannot be deleted by Users after they are sent.

We may also retain communications you send directly to Rraft, including support requests, privacy requests, complaints, and other correspondence.

Usage, Device, and Activity Information

Rraft automatically or internally records certain information about how the Services are used.

This information may include:

• pages or screens visited;
• time spent on pages or screens;
• feature usage;
• Task-related activity;
• date and time of activity;
• IP address;
• browser type;
• device information;
• user-agent information;
• request, session, and technical metadata; and
• security, performance, and error information.

When a User is logged in, Rraft may associate this activity information with that User's account.

Referral Information

Rraft may allow a User to refer another person to Rraft.

A referral may include the referred person's:

• name;
• email address; and
• telephone number.

We may use this information to administer the referral program and, where applicable, communicate with the referred person about Rraft.

Users may not knowingly submit referral information relating to a person under the age of 18.

Property Provider Information

We may collect information relating to Property Providers and their organizations, including:

• Property Provider name;
• company or organization information;
• Property manager information;
• email and account information;
• Property addresses;
• Property names;
• Property images;
• Task and program information;
• Resident invitation and Property association information; and
• records relating to use of Rraft's management features.

Payment, Tax, and Identity Information

Rraft does not currently process real payments, collect payment-card or bank-account information, collect tax identification information, or use a third-party identity verification service during the initial beta program.

The initial beta may use simulated balances, free platform tokens, or other test functionality that does not represent actual payment processing.

If Rraft introduces real payments, Reward payouts, tax reporting, identity verification, or similar functionality, this Privacy Policy will be updated as appropriate before or in connection with that collection.

2. Sources of Personal Information

Rraft may collect personal information:

• directly from you;
• from a Property Provider that adds or invites a Resident;
• from another User who submits a referral;
• from Google or another supported authentication provider when you choose that authentication method;
• automatically or internally when you use the Services;
• from your device when you authorize location or other device functionality; and
• from service providers operating systems on Rraft's behalf.

3. How We Use Personal Information

Rraft may use personal information to:

• provide and operate the Services;
• create and administer accounts;
• authenticate Users;
• associate Residents and Community Members with participating Properties;
• send invitations and administer referrals;
• display relevant Properties and available Tasks;
• provide maps and location-based features;
• allow Community Members to discover, accept, and complete Tasks;
• verify Task completion;
• allow Property Providers to review Task Evidence;
• administer Task Rewards and Participation Rewards;
• maintain Task, participation, training, and qualification records;
• operate Task chat;
• communicate with Users;
• provide customer support;
• send transactional, administrative, security, and legal notices;
• send marketing communications where permitted;
• measure use of the Services and understand how features are used;
• perform analytics and improve the Services;
• prevent fraud, abuse, falsified Task Evidence, and unauthorized activity;
• protect Users, Rraft, Properties, and the Services;
• investigate disputes, complaints, or potential violations of Rraft policies;
• maintain evidentiary and audit records;
• comply with applicable legal obligations; and
• establish, exercise, or defend legal rights.

4. How We Disclose Personal Information

Rraft does not disclose personal information indiscriminately. We may disclose information in the circumstances described below.

Property Providers

Rraft may provide a Property Provider with information reasonably necessary to manage its participation in the Services and administer Tasks associated with its Properties.

Depending on the feature, a Property Provider may have access to information such as:

• Community Member name;
• profile image when that feature is enabled;
• Property and account association;
• Task status and history;
• Task Evidence;
• Task chat;
• training or Rraft Qualification information where relevant;
• approval or rejection information; and
• other information necessary to administer the applicable Task or Property.

Precise device coordinates collected for map centering or Rraft location verification are not generally displayed to Property Providers.

Community Members and Residents

Community Members may receive information necessary to use Rraft and complete Tasks, including:

• Property Provider or company name;
• Property manager name;
• Property address;
• Property images;
• Task information; and
• other information reasonably necessary to complete the applicable Task.

Future Restricted Tasks may require a qualified Community Member to receive additional information necessary to perform that Task.

For example, a notice-related Restricted Task may require the Community Member to view the notice document and information contained within it because the Community Member must print, post, mail, or otherwise complete the authorized Task.

Access to such information will be limited to the applicable Task and subject to Rraft's Task requirements and Terms of Service.

Service Providers

Rraft uses third-party service providers to operate portions of the Services.

These providers currently include or may include:

• Amazon Web Services ("AWS") for application and infrastructure hosting;
• MongoDB Atlas, using AWS infrastructure, for database services;
• Bunny for content delivery and media storage;
• Google when a User chooses Google OAuth authentication; and
• other infrastructure, security, communications, or operational providers used to provide the Services.

These providers may process information on Rraft's behalf as reasonably necessary to provide their services.

Legal and Safety Disclosures

We may disclose personal information when we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to a valid subpoena, court order, warrant, or other lawful process;
• respond to governmental or regulatory requests;
• investigate suspected fraud, abuse, or unlawful activity;
• enforce Rraft's Terms of Service or other agreements;
• protect the rights, safety, property, or security of Rraft or others; or
• establish, exercise, or defend legal claims.

Business Transfers

Personal information may be disclosed or transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, change of control, or similar business transaction.

Any successor that receives personal information through such a transaction will be subject to applicable legal obligations concerning that information.

5. We Do Not Sell Personal Information

Rraft does not sell personal information.

Rraft does not rent personal information, sell User lists, or disclose personal information to third parties in exchange for monetary consideration.

Rraft also does not currently disclose personal information to advertising networks for cross-context behavioral or targeted advertising.

Disclosures to Property Providers, hosting providers, infrastructure providers, authentication providers, and other service providers described in this Privacy Policy are made for the purpose of operating the Services and are not intended as sales of personal information.

6. Cookies, Tracking, and Internal Analytics

Rraft does not currently use third-party advertising trackers, advertising pixels, or third-party behavioral analytics tools to track Users across unrelated websites or online services.

Rraft does, however, collect first-party usage information about activity within the Services, including pages visited and time spent on pages.

When a User is authenticated, this information may be associated with the User's account.

Authentication providers and other third-party services may operate their own technologies subject to their own privacy policies when you interact directly with those services.

7. Marketing and Service Communications

Rraft may send marketing emails, newsletters, product announcements, and other promotional communications where permitted by applicable law.

Marketing emails will provide a method to unsubscribe.

Opting out of marketing communications does not prevent Rraft from sending non-promotional communications necessary to operate the Services, including:

• login or authentication messages;
• account notices;
• Resident invitations;
• Task notifications;
• Reward or participation notifications;
• security notices;
• privacy notices;
• legal notices; and
• important changes affecting the Services.

8. Artificial Intelligence and Model Training

Rraft does not currently use identifiable User Task Evidence, photos, videos, chat messages, or other personal information to train artificial intelligence models.

Rraft may use aggregated or de-identified information for internal analytics, research, platform improvement, and development where the information is not reasonably capable of identifying an individual.

Rraft may in the future develop or use artificial intelligence, machine-learning, computer-vision, or similar technology, including internally operated systems or services such as image-analysis technology.

Before materially expanding the use of identifiable personal information or Task Evidence for AI or model training, Rraft will provide appropriate notice and obtain additional consent where required by applicable law or Rraft policy.

Rraft will not use identifiable private Task Evidence in public advertising or marketing without additional permission where appropriate or required.

9. Future Restricted Tasks

Rraft's Terms of Service contemplate certain future Restricted Tasks that may involve additional personal information.

These features may include notice delivery, move-in or move-out condition documentation, scheduled access to another Resident's dwelling, or other specially controlled activities.

If such functionality is enabled, Rraft may process information including:

• Resident identity information;
• Property and unit information;
• notice documents;
• Task-specific documents;
• scheduling records;
• Resident consent records;
• photographs and videos;
• receipts and mailing records;
• electronic signatures;
• attestations or declarations;
• location information;
• timestamps;
• Task chat or communications; and
• other records necessary to perform and document the Restricted Task.

Restricted Task information may be retained for longer periods when reasonably necessary for legal, evidentiary, dispute-resolution, compliance, or recordkeeping purposes.

The description of a future feature in this Privacy Policy does not mean that the feature is currently available.

10. Data Security

Rraft uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, loss, misuse, alteration, or disclosure.

Current safeguards include measures such as:

• HTTPS/TLS for network communications;
• encryption at rest for database information where supported by Rraft's infrastructure;
• encryption of Task chat records in the database;
• passwordless authentication;
• role-based restrictions on administrative access;
• administrative and system audit logging;
• data backups;
• media and document processing intended to reduce unnecessary data and security risks;
• security monitoring and fraud-prevention controls; and
• incident-response procedures.

No method of transmission or storage is completely secure. Rraft cannot guarantee that unauthorized persons will never defeat security measures or gain access to information.

If Rraft experiences a security incident that requires notification under applicable law, Rraft will provide legally required notices.

11. Data Retention

Rraft retains personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining records, protecting the platform, resolving disputes, preventing fraud, and complying with legal obligations.

Unless a longer period is reasonably necessary because of a dispute, investigation, legal hold, regulatory requirement, or other lawful purpose, Rraft generally applies the following retention periods:

• Active account and profile information: retained while the account remains active.
• Deleted account profile information: generally deleted or anonymized within 90 days after a verified deletion request, except where the information forms part of another record Rraft is permitted or required to retain.
• Unaccepted Resident invitations: generally retained for up to 180 days after the last invitation or related activity.
• Unaccepted referral information: generally retained for up to 180 days after the referral or last related activity.
• Precise location collected for dashboard and map functionality: generally retained for no more than 30 days, with newer location information replacing or superseding older location information where appropriate.
• Location information used to verify Task completion: generally retained for up to three years after Task completion.
• Ordinary Task Evidence and Task records: generally retained for up to three years after Task completion.
• Task chat: generally retained for up to three years after completion or closure of the associated Task.
• Task approval, rejection, and audit records: generally retained for up to three years.
• Usage analytics, page activity, IP address, user-agent, and ordinary technical logs: generally retained for up to twelve months.
• Support, privacy-request, complaint, and dispute records: generally retained for up to three years after resolution.
• Rraft Qualification and training records: retained while the qualification remains active and generally for up to three years afterward.
• Restricted Task evidence, signed declarations, notice records, move-in or move-out documentation, and related evidentiary records: may be retained for up to seven years after the applicable Task.
• Marketing opt-out records: retained as long as reasonably necessary to honor the User's opt-out request.
• Aggregated or de-identified information: may be retained for longer periods where it no longer reasonably identifies an individual.

Information contained in backups may remain until the applicable backup is securely overwritten, rotated, or deleted in the ordinary course of Rraft's backup procedures.

Rraft may retain information beyond the ordinary retention period when reasonably necessary to preserve evidence, investigate fraud, respond to a legal claim, comply with a court order, satisfy a legal obligation, or protect the rights and safety of Rraft or others.

12. Access, Correction, and Deletion Requests

Users may contact Rraft to request access to, correction of, or deletion of personal information associated with them.

At this time, account deletion requests are processed by contacting:

info@rraft.io

Please include enough information for Rraft to identify the account or information involved.

Rraft may require reasonable verification of your identity or authority before responding to a privacy request.

A verified deletion request will generally result in deletion or anonymization of ordinary account and profile information, subject to applicable retention requirements.

Rraft may retain information following an account deletion request when reasonably necessary or permitted for:

• completed Task records;
• Task Evidence;
• signed attestations or declarations;
• Restricted Task evidence;
• fraud prevention;
• security records;
• dispute resolution;
• legal claims;
• compliance obligations;
• enforcement of Rraft's Terms of Service; or
• another purpose permitted or required by law.

Deleting a Rraft account does not require alteration or deletion of records maintained independently by a Property Provider outside of Rraft.

13. Nevada Privacy Rights

Nevada residents may submit a verified request directing Rraft not to make a sale of covered information as provided by applicable Nevada law.

Rraft does not currently sell covered personal information.

Nevada residents may nevertheless submit a verified opt-out request or other privacy request to:

info@rraft.io

Please use "Nevada Privacy Request" in the subject line and provide information reasonably necessary for Rraft to verify the request.

Rraft will respond to a verified Nevada sale opt-out request within the period required by applicable Nevada law.

14. Other State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable law.

Depending on the law and whether it applies to Rraft, these rights may include the right to request access, correction, deletion, or information about certain uses or disclosures of personal information.

Rraft will honor privacy rights required by applicable law.

Requests may be submitted to:

info@rraft.io

Rraft may take reasonable steps to verify a request before providing access to, changing, or deleting personal information.

15. Children's Privacy

Rraft is intended only for persons who are at least 18 years old.

Persons under 18 may not create or use a Rraft account.

Users and Property Providers are prohibited from knowingly entering personal information about a minor into Rraft as a Resident, Community Member, or referral.

Task photos, videos, or other User-submitted content should not intentionally include minors unless the information is lawfully collected and specifically necessary for a permitted purpose.

If you believe personal information about a person under 18 has been improperly submitted to Rraft, contact us at info@rraft.io.

16. Information About People Who Do Not Have Rraft Accounts

Rraft may receive limited personal information about a person who has not created a Rraft account, including through:

• Property Provider Resident invitations;
• User referrals; or
• future Restricted Tasks where information about another Resident is necessary for the Task.

Rraft uses this information only for purposes reasonably related to the applicable invitation, referral, Task, Property, legal record, or other function described in this Privacy Policy.

A person who does not have a Rraft account may contact Rraft at info@rraft.io with a privacy question or request concerning information about that person.

17. Changes to This Privacy Policy

Rraft may update this Privacy Policy from time to time to reflect changes to the Services, data practices, technology, law, security practices, or business operations.

When a change materially affects how Rraft collects, uses, or discloses personal information, Rraft may provide notice through the Services, email, or another reasonable method before or when the updated policy becomes effective, as required by applicable law.

The "Last Updated" date at the top of this Privacy Policy indicates when the policy was most recently revised.

Rraft may request additional consent before applying materially different uses to information previously collected when consent is appropriate or legally required.

18. Relationship to the Terms of Service

This Privacy Policy should be read together with the Rraft Terms of Service and any applicable Task-specific, Restricted Task-specific, jurisdiction-specific, or other disclosures presented through the Services.

If a Task requires information or data processing that is materially different from the practices described in this Privacy Policy, Rraft may provide an additional disclosure before that feature is used.

19. Contact Us

Questions, privacy requests, correction requests, deletion requests, complaints, or other inquiries regarding this Privacy Policy or Rraft's privacy practices may be sent to:

Email: info@rraft.io

Rraft may request information reasonably necessary to verify your identity or authority before acting on a request involving personal information.