1. Scope
RightsValet is building a business service designed to create and preserve private copyright-aware JPEG records from real-estate media platforms connected by an organization. In this Policy, “RightsValet,” “we,” “us,” and “our” refer to the operator of that service.
Current launch status. While RightsValet operates without paid subscriptions, it runs as a private, invitation-only beta; when paid subscriptions begin, the Terms of Service describe how subscriptions and access to Records apply. Invited organizations can connect a supported provider or upload images by hand, and RightsValet creates and retains private JPEG records for them under the controls described below. Copyright registration is AI assisted and human processed. Functions not yet available to invited organizations are described in this Policy as future or conditional.
This Policy applies to account holders, organization members, website visitors, people who contact us, and, if customer image processing is activated, people whose personal information appears in property media processed for an organization.
This Policy does not replace an organization's own privacy notice. A connected provider, an organization, and a payment provider may each handle information for their own purposes under their own terms and privacy notices.
2. Our roles depend on the information
The role split is central to this Policy. RightsValet is not the controller of every person or detail appearing in customer-connected property media. It is also not merely a processor for the account and operational information it uses to run its own service.
RightsValet as data controller or business
RightsValet acts as a data controller or business for information whose purposes and essential means we determine. This includes account, authentication, organization, billing, contact, privacy-request, security, and service-administration information.
An organization may separately act as a controller or business when it decides who may join its workspace, what role a member receives, and how it uses information available through the service.
RightsValet as processor or service provider
If customer image processing is activated, RightsValet will act as a processor or service provider for temporary source images and the content of image records processed on an organization's instructions. The organization will be the controller or business for that content.
The organization is responsible for having a lawful basis and appropriate rights to connect, process, and retain its property media. This responsibility includes people incidentally depicted in an image, identifying details visible in the pixels, property or listing information included in approved metadata, and any required notices or permissions.
Provider credential secret values are processed on the organization's instructions to operate its connection. RightsValet separately controls limited connection-status, rotation, revocation, security, and audit records needed to administer and protect the service.
Processing history that forms part of an organization's retained record follows the processor role. Separate security, billing, and compliance records that we independently need follow the controller role.
Some organizations and processing activities require additional contractual terms before covered data may be connected. RightsValet's Data Processing Addendum forms part of the Terms of Service and is provided on request at privacy@rightsvalet.com. An organization must not connect covered data until the required terms are executed. Use our privacy-request form to ask whether additional terms are available and required for the intended processing.
3. What we store
Account and authentication information
- Name and email address.
- A password hash rather than a readable password.
- Passkey credential records that a user chooses to enroll.
- TOTP and recovery information needed for two-factor authentication when enabled.
- Session records needed to authenticate, list, expire, and revoke sessions.
Organization information
- Organization name, immutable internal identifier, and mutable routing alias.
- Membership, roles, authorization assignments, and settings.
- Lifecycle and audit information needed to administer the organization.
Provider connections
Before provider connections may be activated, the service must support:
- Provider credentials stored only in an encrypted credential vault.
- Masked credential suffixes shown to authorized users.
- Connection, rotation, revocation, and security status.
When activated, provider credential values must never be placed in queue payloads, logs, traces, or support exports.
Image records
If image processing is activated, each accepted source revision will produce one private compact JPEG record for the organization. A record may include the retained pixels, normalized source or provider metadata, rights-related metadata, integrity information, and processing and publication history.
Records must remain private to one organization. The service must not compare, deduplicate, or share record content across organizations.
Usage and billing
While RightsValet operates without paid subscriptions, for new Record availability we store the organization, availability time, and operating-policy authority without creating a subscription-meter charge; when paid subscriptions begin, new availability is recorded as described in the Terms of Service. Historical subscription billing records retain their original billable events and UTC period attribution. Stripe processes supported saved-payment setup and applicable separately authorized payments and returns the payment, transaction, and subscription information needed to administer those functions and reconcile historical billing. Saving a payment method does not itself create a charge or authorize copyright registration fees.
Contact and privacy requests
When a person contacts us or submits a privacy request, we store the submitted name, email address, organization if supplied, request category, message, and a salted hash of the submitting IP address for abuse prevention. Stored contact and privacy-request identity and message fields are encrypted.
Optional copyright-win testimony
RightsValet may invite one person to give optional copyright-win testimony about a resolved matter, even if they did not use our service. We store the selected recipient's name and email and a private per-recipient invitation link. No account is required. The form voluntarily collects identity and attribution choices, answers about the resolved matter, optional outcome and amount information, story, consented publicity channels, and signed publicity permission. We keep the form and release version, typed signature, signing intent, selected permissions, and server submission time as encrypted response evidence; only authorized platform staff may access the invitation or signed response.
This is RightsValet's own optional marketing collection, not an organization's image archive or a service review. A signed form does not cause automatic publication.
Owner signature evidence
When the owner of an organization signs a certification on RightsValet, to authorize a registration and the related charge, we record the evidence needed to show who signed, what they agreed to, and that the signed document has not changed. We store the typed legal name the owner entered, the time of signing, the sign-in and verification steps the owner completed (sign-in, verified email, recent re-authentication, and two-factor confirmation when enabled), the IP address and browser or device identifier (user agent) used at signing, a one-way fingerprint of the owner's verified email address, which of the required consent boxes the owner checked, the exact total the owner agreed to, and fingerprints of the signed text and of the registration package. We do not store the email address itself in this record, and we do not store card data in it.
We keep the IP address and browser or device identifier only in the signature record. The sealed, signed copy of the certification contains one-way fingerprints of them, which let us prove the stored values match the signed copy without disclosing them. The typed legal name appears in the signed copy because it is the signature.
Technical diagnostics
The application integrates with Sentry for error monitoring and transmits events only when an approved Sentry project is configured. Sentry may then receive an exception type, stack trace, application version, environment, route or transaction name, and limited technical diagnostics needed to identify and repair errors.
We configure Sentry to remove request data, cookies, query strings, signed URL parameters, default user information, IP addresses, breadcrumbs, tags, extra event payloads, and exception-message values before an event is transmitted. Sentry logging, cache, Livewire, SQL, queue, notification, and outbound-request breadcrumbs are disabled. SQL bindings and outbound-request tracing are also disabled.
4. Required stripping and deletion controls
Before customer image processing may be activated, the service must enforce all of the following:
- GPS coordinates and sensitive location metadata must be removed from every retained image record.
- Downloaded source images must remain only in private staging and be deleted after the retained record, checksum, database state, and deletion intent have been verified.
- Provider originals must not be retained as part of the archive.
- Provider credential values must be excluded from queues, logs, traces, and support exports.
- Signed URL values must not be written to logs or analytics.
Removing metadata does not necessarily make an image anonymous. Recognizable people, property details, signs, family photographs, reflections, or other identifying details may remain visible in the pixels. The organization remains responsible for that content.
5. Why we use personal information
We use personal information only for the service, security, billing, communication, and legal purposes described below.
| Purpose | Information | GDPR legal basis when applicable |
|---|---|---|
| Create and administer a contracting user's account | Account, authentication, and session information | Contract performance or requested pre-contract steps, Article 6(1)(b) |
| Administer invited organization members | Identity, membership, role, and settings | Legitimate interests in providing secure organization workspaces, Article 6(1)(f) |
| Authenticate users and protect the service | Authentication, session, security, connection, and salted abuse-prevention information | Legitimate interests in security, fraud prevention, and service integrity, Article 6(1)(f) |
| Provide the image-record and archive service | Temporary sources, retained pixels, approved metadata, and processing history | The organization determines its legal basis; RightsValet processes under documented instructions |
| Administer subscriptions and billing | Billable events, UTC attribution, subscription status, and payment references | Contract performance, Article 6(1)(b), and legal obligations such as applicable accounting requirements, Article 6(1)(c) |
| Answer inquiries and privacy requests | Contact details, request details, and response history | Pre-contract steps, Article 6(1)(b), or legitimate interests in communications and compliance, Article 6(1)(f) |
| Request optional testimony and use signed publicity permission | Recipient contact details, voluntary answers, selected publicity permissions, and signed release evidence | Consent for the optional publicity use, Article 6(1)(a); legitimate interests in inviting recipients and keeping bounded evidence of permission and legal claims, Article 6(1)(f) |
| Comply with law and manage legal claims | Only information relevant to the obligation, claim, or legal hold | Legal obligation, Article 6(1)(c), or legitimate interests in establishing, exercising, or defending legal claims, Article 6(1)(f) |
We use owner signature evidence to confirm that a certification and the related charge were authorized by the organization's owner, to make the signed document tamper-evident, to support the organization's registration and any later question about the charge or the registration, and to meet legal and record-keeping obligations. We do not use it for advertising or sell it.
We do not use consent as the general basis for the core service. If we specifically ask for consent for an optional activity, it may be withdrawn without affecting processing that was lawful before withdrawal.
7. How information is protected
Controls active at this launch stage
- Passwords are stored as hashes rather than readable passwords.
- Signing out invalidates the current authentication session.
- Privacy-request identity and message fields are encrypted in the database.
Controls required before image processing is activated
- Provider credentials must be held in an encrypted vault and displayed only as masked suffixes.
- Image records and temporary sources must use private object storage and must not be publicly listable.
- Every individual Record download must require authorization and stream verified JPEG bytes. Whole-Batch ZIP downloads use an empty-body 303 whose Location is a signed URL that expires in at most 300 seconds. Signed URLs never appear in HTML, JSON, or download-url responses.
- Organization boundaries must prevent records from being compared or shared across organizations.
- Primary retained records, legal holds, tombstones, and checksum evidence must remain protected and auditable.
No security control can guarantee that unauthorized access will never occur. Users must protect their account credentials and promptly revoke sessions or provider connections they no longer recognize or authorize.
8. Retention, cancellation, and deletion
The account, contact, and privacy-request rules below apply now. The provider and image-record rules apply only if those functions are activated and state the required retention instructions for that future processing.
| Information | Retention rule |
|---|---|
| Account and organization information | Kept while needed to provide the account or organization, then handled through verified deletion except for narrowly retained billing, security, legal, or legal-hold records. |
| Authentication and sessions | Kept while the credential or session remains active and for the limited security period needed after expiration or revocation. |
| Provider credential values | Kept while the connection is authorized. Replaced or deleted when rotated, revoked, disconnected, or included in verified organization deletion. |
| Temporary source images | Kept only until verified publication of the retained record, then deleted from staging. |
| Retained image records | Retained indefinitely, including after subscription cancellation, until the organization authorizes verified deletion or a lawful legal hold requires retention. Without a subscription, Records of Batches submitted for copyright registration stay retained and private but are locked from browsing and download; the lock never deletes a Record. |
| Usage and billing records | UTC attribution remains immutable for ledger integrity. Related identifiable information is kept only as needed for billing, accounting, tax, reconciliation, fraud prevention, and legal claims. |
| Contact and privacy-request IP hashes | Kept for 90 days for abuse prevention, then removed unless the request is under a lawful legal hold. |
| Contact and privacy requests | Encrypted request records are kept for three years from receipt to respond, document compliance, and protect legal rights, then deleted unless a lawful legal hold applies. |
| Optional testimony invitations and signed submissions | Unused links expire after 14 days; unsubmitted invitations are removed 30 days after expiry. Unused signed responses are removed no later than three years after submission. After documented public use, encrypted response and signature evidence is retained until three years after the latest documented use or dated reconfirmation, retirement, or withdrawal. Continuing public use requires an annual staff review; overdue review blocks new use rather than extending retention indefinitely. A lawful hold delays deletion only while active; overdue items are pruned after the hold is released. Testimony does not inherit the image archive's indefinite retention. |
| Sentry diagnostics | Kept for the limited period configured in the approved Sentry project to investigate and remedy errors. |
Subscription cancellation, payment readiness, and retained Records
If image records are activated and created, they will be retained indefinitely, including after subscription cancellation, until the organization authorizes verified deletion or a lawful legal hold requires retention. Without a subscription, a free trial, or a payment grace period, Records of Batches submitted for copyright registration are locked from browsing, previewing, and downloading. They stay stored and private, and subscribing again restores access.
While RightsValet operates without paid subscriptions, manual use and provider collection do not require a subscription, and manual use does not require a payment method; when paid subscriptions begin, manual use and submitting a Batch for copyright registration still require no subscription, and the Terms of Service describe how subscriptions and access to Records apply. Subscription cancellation alone does not stop otherwise authorized use or delete existing Records. Provider connections require a supported saved payment method verified by Stripe. For existing enabled connections, confirmed loss of that readiness starts a fixed 168-hour grace period; at its deadline no new provider collection is admitted. Manual use, retained-archive access as described in the Terms of Service, and safe completion of previously admitted work remain available subject to existing rights, security, and deletion controls. Restoration before the deadline preserves the collection period; restoration at or after the deadline resumes eligible collection at the next 1:00 a.m. Pacific nightly run with a fresh rolling 48-hour window and no automatic backfill of the paused gap. The organization's retention instruction remains in force, and historical subscription and billing records are not rewritten by this policy.
This continued retention is a core product promise to the organization. It will remain bounded by the organization's right to export and request verified deletion and by any lawful legal hold.
Owner signature evidence is kept as a business record of authority and consent for as long as the law requires and for as long as we hold the related registration records. A legal hold suspends deletion. If the owner's user account is deleted or anonymized, the signature record is kept, because the charge and the registration depend on it, and it is not shown in any list of people or accounts. If the organization is deleted, the signature record is deleted when the organization's data is deleted.
Verified deletion and legal holds
For account, contact, and privacy-request records, a legal hold delays deletion only for information within the lawful scope and duration of the hold, and deletion resumes after release when the retention period has expired. For a future image archive, verified deletion must confirm removal through the applicable active systems rather than merely hiding information from the interface. Residual backups expire as described in the Data Processing Addendum.
10. Your rights and controls
Depending on applicable law, a person may have rights to know, access, correct, delete, restrict, object, obtain portable information, withdraw consent where consent applies, and receive equal service without unlawful discrimination for exercising a privacy right.
You can update available account information and sign out to invalidate the current session. Use the privacy-request form to request access, correction, export, restriction, provider-connection action, or verified deletion when the related in-application control is not yet available.
Rights are not absolute. We may retain narrowly scoped information where law permits or requires it, including information needed for security, billing, legal claims, or a lawful legal hold.
Submit a request through the privacy-request form. We verify identity and authority using information reasonably necessary for the request. An authorized agent may submit a request, but we may require proof of authority and direct verification with the person concerned.
If you signed an optional testimony release, use that form or email privacy@rightsvalet.com with withdrawal or questions. After identity verification, you may withdraw permission for future uses; printed pieces already produced under your signed release are the exception. Withdrawal stops new use but does not immediately erase signed permission evidence, which remains only for its bounded retention period or an active lawful hold.
We respond within the period required by applicable law. If applicable state law provides an appeal right, use the same form and select “Another privacy question” to appeal a prior decision.
11. Requests concerning image-record content
While RightsValet operates without paid subscriptions, customer image processing is active for invited organizations in the private beta; when paid subscriptions begin, the Terms of Service describe how subscriptions and access to Records apply to that processing. The organization that connects property media controls the content and ordinarily decides requests involving a person or identifying detail visible in an image.
If a request concerns media controlled by an organization, submit it directly to that organization when possible. If the controlling organization is unknown, use our privacy-request form and select “Request about a person depicted in an image.” Provide only enough information to identify the relevant organization or future record, such as an approximate date, property or project reference, and description of the relevant image.
We do not confirm that a private record exists or disclose its content before appropriate authorization and verification. If future processing allows us to identify the controlling organization, we will route the request and assist it as required by applicable law and the governing agreement.
The organization will decide whether access, correction, restriction, or deletion is legally required. We will implement its valid instruction unless a lawful legal hold or other legal requirement prevents it.
12. GDPR and similar European disclosures
Where the GDPR, UK GDPR, or a similar law applies, RightsValet is the controller for the operational information identified in Section 2. If organization-controlled image processing is activated, RightsValet will act as the processor for that content.
Applicable rights may include access, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent where consent is the basis.
A person may complain to the competent supervisory authority in the place where they live or work or where the alleged infringement occurred. Contacting us first is welcome but is not required.
For organization-controlled image content, the organization is responsible for selecting and documenting its legal basis, providing required notices, and deciding data-subject requests. We provide processor assistance as required by law and contract.
13. California privacy disclosures
This section applies where the CCPA or CPRA applies to RightsValet's handling of a California resident's personal information.
Categories handled at this launch stage
- Identifiers: names, email addresses, account and organization identifiers, session identifiers, and salted IP hashes.
- Customer records information: names and contact details.
- Internet or electronic activity: sessions, security events, and first-party cookies, and email delivery, open, and click events.
- Professional information: organization membership, business affiliation, and role.
- Identifiers and internet or network activity (IP address, browser or device identifier, and sign-in events) collected at signing, and the typed legal name used as an electronic signature, for the purposes and retention described in "Owner signature evidence".
- Sensitive personal information: account authentication data.
Categories for provider connections, billing, and image processing
When an organization uses provider connections, billing, or image processing, additional categories may include provider-connection identifiers and credential values, subscription and transaction information, billable-record information, temporary source images, retained JPEG records, and precise GPS metadata received transiently for required removal.
Sources and purposes
Current information comes from users, organization administrators, and browsers or devices during security processing. If planned functions are activated, information may also come from connected providers acting on an organization's instruction and Stripe for billing administration. We use information only for the applicable purposes stated in Section 5.
Sale, sharing, and sensitive information
We do not sell or rent personal information. We do not share it for cross-context behavioral advertising. During the 12 months before this Policy's effective date, the categories sold were none and the categories shared for cross-context behavioral advertising were none.
We use current sensitive personal information only as reasonably necessary to authenticate users, secure accounts, and prevent abuse. If provider connections or image processing are activated, sensitive information will be limited to securing connections, providing the requested service, and removing precise location metadata. We do not use sensitive personal information to infer characteristics or for advertising.
Because we do not sell or share personal information for cross-context behavioral advertising, a Global Privacy Control signal does not change an advertising activity on our service. We honor legally applicable browser preference signals if our practices change.
California rights
Subject to applicable law, California residents may request the categories and specific pieces collected, sources, purposes, recipients, correction, deletion, portability, and information about any sale or qualifying share. We do not unlawfully discriminate for exercising these rights and do not offer a financial incentive in exchange for personal information.
14. International transfers
The location of a production environment and each service provider must be confirmed in the applicable deployment and customer records before personal information is admitted to that environment.
RightsValet does not rely on this Privacy Policy as an international-transfer mechanism. If a proposed transfer requires a legal safeguard that is not yet approved and executed, the covered processing must not begin. An organization may use the privacy-request form to ask which locations and safeguards apply to its environment.
15. Children's information
The account service is intended for adults acting for businesses and is not directed to children. A person must be at least 18 years old, or the age of legal majority where they live, to create an account.
Customer-connected property media may incidentally depict a minor. The organization remains responsible for the lawful basis, notices, permissions, and retention decision for that imagery. A parent or guardian may use the privacy-request form if the controlling organization is unknown.
We do not sell or share personal information of people under 16 for cross-context behavioral advertising.
16. Security incidents and breach notification
We maintain procedures to investigate, contain, remediate, and document suspected personal-data breaches.
If future image processing is activated and we become aware of a breach affecting image content processed for an organization, we will notify the organization without undue delay and provide available information reasonably needed for its legal duties. For information RightsValet controls, we notify affected people and competent authorities when applicable law requires it.
Notice may be delivered to an organization's designated account contact, through the application, by email, or by another legally permitted method appropriate to the incident.
17. Changes to this Policy
We update this Policy when our service, providers, data practices, or legal obligations materially change. We post the revised Policy with a new effective date. When required, we also notify affected organization owners through the application or by email before the change takes effect.
A policy update does not by itself change an organization's processing instruction where a contract or data processing agreement requires a separate instruction or amendment.
18. Questions and privacy requests
Use the privacy-request form for questions, rights requests, complaints, authorized-agent requests, guardian requests, or questions about additional contractual terms.
The form creates a durable request record. A scheduled process sends the internal notification by email and retries temporary delivery failures without discarding the stored request.
Requests concerning image content should normally be directed to the organization that connected and controls the imagery. If that organization is unknown, select the image-content option and provide only the information reasonably needed to route the request.