Raterflow Privacy Notice

The Energy Network Worldwide LLC, doing business as Raterflow ("Raterflow," "we," "us," or "our"), provides software for managing property inspections, field workflows, supporting records, and reports. This Privacy Notice explains how we collect, use, disclose, retain, and protect information when you use the Raterflow mobile application, web application, websites, and related services that link to this notice (collectively, the "Services").

If you use Raterflow through a company or other organization, that organization may control the property, inspection, report, and business-contact information processed through the Services. In those circumstances, the organization may be the data controller or business responsible for that information, and Raterflow may process it on the organization's behalf.

1. Information we collect

Account and organization information

We collect information needed to create, authenticate, secure, and administer accounts, including name, and email address.

We also process organization information such as organization name, address, and contact.

Raterflow is offered to business customers through separately executed customer agreements. The mobile application is limited to sign-in for existing, pre-provisioned accounts and does not allow a user to register, create an organization, invite users, or open an account-creation flow. After a customer agreement is in place, Raterflow provisions the initial organization and user; authorized organization administrators may invite additional users through the web application.

Property, inspection, and report information

The Services process information used for inspection and reporting workflows, including property identifiers and addresses; builder and development information, inspection responses, inspection results, comments, and related business records.

Users and organizations decide what information to enter into configurable inspection fields. That information may include personal information about property owners, occupants, contractors, business contacts, or other individuals. Users and organizations are responsible for ensuring that they have authority to provide that information to the Services.

Photos, files, comments, and other submitted content

We collect content that users upload or create, including inspection photos, documents, filenames, image or file comments, inspection comments, and inspection report content. The current mobile app requests camera, photo-library, and document-picker access only when needed for a user-selected upload.

Feedback and support information

When you submit feedback or request support, we collect the message, name, email address, user identifier, active organization identifier, and other information you choose to include in the message. Do not include sensitive personal information that is not necessary for us to respond.

Device, application, and notification information

We may collect technical information needed to operate and secure the Services, including IP address; device type, model, and manufacturer; operating-system and app version; browser information; locale and time zone; network status; request and event timestamps; and security or diagnostic metadata.

If you enable push notifications, we collect device platform, notification preferences, and related delivery information. You can change notification permissions in your device settings and applicable preferences in Raterflow.

Analytics and diagnostics

We use PostHog for product analytics. Raterflow records specific workflow events, automatically capture mobile app lifecycle events, mobile errors, web page views, and web clicks. Events may include user, organization, app-installation, inspection, report, or template identifiers, event names; actions; counts; durations; failure categories; network state; app and build version; device type, model, and manufacturer; operating-system version; locale and time zone; and screen dimensions. Mobile PostHog events are configured to disable IP-based GeoIP enrichment.

For authenticated web users, Raterflow may use masked PostHog session recordings to diagnose workflow and usability problems. We use Sentry for error monitoring, performance diagnostics, browser session replay, and feedback handling. Depending on the affected surface, Sentry may receive error, stack, route, request, performance, browser-session, or feedback context. Some of these may include user identifier, cookies, network data, operating-system version, browser version, and device type, model, and manufacturer from captured error events.

Raterflow's web replay configuration masks text and form inputs and blocks images, video, canvases, file inputs, request headers, and request bodies. PostHog and Sentry may capture masked replay on those pages when the visitor is an authenticated Raterflow user. Feedback submitted through Raterflow may include the submitter's name, email, and message.

Raterflow does not use PostHog, Sentry, or another third-party service for advertising or to track activity across other companies' applications or websites.

Cookies and local storage

The web Services use cookies and similar storage for authentication, security, preferences, and, when enabled, analytics. The mobile app uses secure device storage for authentication and an encrypted local database and local files to support offline work and reliable synchronization.

Location and maps

Property or development records may contain an address or coordinates supplied by an organization. When a user chooses to open directions, Raterflow may pass that stored destination to the maps application or website selected by the device. The maps provider processes that request under its own privacy terms.

2. How we collect information

We collect information:

• Directly from users when they sign in, complete inspections, upload content, configure notifications, or contact support.
• From the user's organization and other authorized users who create accounts, invitations, assignments, property records, templates, and reports.
• Automatically from devices, browsers, servers, and integrated services when needed to authenticate users, operate the Services, prevent abuse, deliver notifications, synchronize data, and collect approved analytics or diagnostics.
• From service providers that support hosting, authentication, storage, communications, monitoring, and delivery of the Services.

3. How we use information

We use information to:

• Authenticate users and administer accounts, organizations, roles, and permissions.
• Provide property, inspection, offline-sync, photo/file, report, and notification functionality.
• Deliver service, and account notifications.
• Respond to support requests and product feedback.
• Monitor availability, diagnose errors, measure reliability, and improve the Services.
• Prevent fraud, abuse, unauthorized access, and other security incidents.
• Enforce applicable agreements and protect the rights, safety, and property of Raterflow, our customers, users, and others.
• Comply with legal, regulatory, tax, accounting, and law-enforcement obligations.

4. How we disclose information

To service providers

We use the following providers to operate the Services:

• Cloudflare hosts the API, routes network traffic, verifies supported authentication and account forms with Turnstile, connects the API to the database, stores uploaded photos, documents, and generated report files, stores authentication-session and operational cache data, processes report, notification, and email jobs through queues, sends transactional and support email, and provides security, rate-limiting, logging, and delivery infrastructure. Cloudflare may process API and web request metadata, IP addresses, security tokens, session and cache identifiers, organization and workflow identifiers used in queued jobs, uploaded files, email addresses, message content, and delivery metadata.
• Supabase hosts the database containing account, organization, property, inspection, report, file-metadata, notification, and related business records.
• Vercel hosts and delivers the web application and proxies browser requests from the web application to the API. Vercel may process browser and network request metadata, cookies and session traffic, and information submitted through web workflows while delivering those requests.
• Expo and Apple support mobile application builds, distribution, over-the-air updates, and push notifications. Expo and Apple may process application, build, device, update-request, and delivery information. When notifications are enabled, Expo receives the Expo push token and notification payload, and Apple receives the device push-routing token, notification title and message, delivery settings, and related routing data.
• PostHog provides identified product analytics and masked web session recording as described above. It may process user and organization identifiers, workflow identifiers, named event properties, counts, durations, failure categories, network state, platform, and masked browser-session data.
• Sentry provides web and API error monitoring, performance diagnostics, web session replay, and feedback handling as described above. It may process technical error and performance context, masked browser-session data, and feedback details.

These providers may process information only to provide services to Raterflow and are expected to protect it under their contracts, privacy terms, and applicable law.

At the user's direction

We disclose information when a user intentionally requests an action, such as opening a property destination in an external maps provider, sending a report, or sharing content with an authorized recipient.

For legal and safety reasons

We may disclose information when reasonably necessary to comply with law, legal process, or governmental requests; enforce agreements; investigate fraud or security incidents; or protect rights, safety, and property.

In a business transaction

Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable confidentiality and privacy requirements.

Raterflow does not sell personal information, use personal information for advertising, or track users across other companies' applications or websites.

5. Legal bases and consent

Where applicable, we process information to perform contracts with customers and users, pursue legitimate interests in operating and securing the Services, comply with legal obligations, and act with consent where consent is required. You may withdraw consent for consent-based processing, but withdrawal does not affect processing completed before withdrawal and may limit optional features that rely on the information.

6. Retention and deletion

We retain information only for as long as reasonably necessary for the purposes described in this notice, including providing the Services, honoring customer instructions, maintaining security and audit records, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, and regulatory obligations.

Retention depends on the information and context:

• Account and authentication information is generally retained while the account is active and for a limited period afterward when needed for security, dispute resolution, fraud prevention, or legal compliance.
• Organization-controlled property, inspection, report, file, and business records are retained according to the organization's instructions, applicable customer agreements, operational needs, and legal obligations. Deleting an individual user's account may remove or deidentify the user's personal account information without terminating the customer agreement, closing the organization, or deleting organization-owned records that other authorized users must retain.
• Push tokens are retained while registered and are removed when the user unregisters the token, the token becomes invalid, or applicable account data is deleted.
• Feedback, communications, analytics, and diagnostic information is retained according to operational need, provider configuration, and applicable law.
• Mobile offline records and app-owned local files are intended to be cleared on successful sign-out or another authenticated-data reset. Operating-system caches may also remain until the system or user removes them.
• Backups may retain information for a limited rotation period before deletion or overwriting.

Raterflow does not automatically delete information after a fixed period of account inactivity. We may delete or deidentify information when it is no longer reasonably necessary for the purposes described in this notice, subject to applicable customer agreements, operational requirements, and legal obligations.

An authorized representative of a customer organization may request termination or closure of the organization by contacting Support. The applicable customer agreement governs organization termination and any related data export, retention, and deletion obligations.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, access controls, role-based authorization, secure authentication, encrypted mobile local storage, monitoring, and storage controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Depending on your location and relationship with Raterflow, you may have rights to access, correct, export, restrict, object to processing of, or delete personal information.

You can:

• Change camera, photo-library, document, and notification permissions in device settings.
• Change available notification preferences in Raterflow.
• Visit Raterflow Support to request deletion of your individual user account or, if you are an authorized representative, termination or closure of a customer organization.
• Email its@tenww.com to request access, correction, or export of personal information.

Individual user-account deletion is not currently available as a self-service action in the mobile or web application. Support may verify a deletion request using the email address or other information already associated with the account.

Deleting an individual user account is permanent but does not terminate the customer agreement, close the organization, or automatically delete organization-controlled records. Support will explain which account information will be deleted and which organization-controlled or legally required records may be retained, then confirm when the request has been completed or explain any permitted delay.

If your organization controls the information, we may direct your request to that organization or act on its instructions.

9. International transfers

Raterflow and our providers may process information in the United States and other countries where privacy laws may differ. Where required, we use approved contractual or legal safeguards for international transfers.

10. Children

The Services are intended for business users and are not directed to children under 18. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

11. Regional privacy rights

Residents of California and other U.S. states may have rights to know, access, correct, delete, or obtain a copy of personal information and to appeal certain decisions. Residents of the EEA, United Kingdom, and Switzerland may have rights to access, correct, erase, restrict, object, obtain portability, withdraw consent, and complain to a supervisory authority.

We will not discriminate against a user for exercising an applicable privacy right. Authorized agents may submit requests where permitted by law, subject to verification.

To exercise an applicable privacy right, email its@tenww.com. We may ask for information reasonably necessary to verify the request and protect the account and organization data. If we deny a request in whole or in part, you may appeal by replying to our response or emailing the same address with the subject line "Privacy Appeal." We will review and respond to the appeal as required by applicable law. Available rights, response periods, and exceptions vary by location.

12. Changes to this notice

We may update this notice as the Services or legal requirements change. The revised notice will show an updated date. When required, we will provide additional notice of material changes.

13. Contact us

For privacy questions or requests:

Raterflow Support

its@tenww.com

The Energy Network Worldwide LLC, 18140 56th Ct N, Plymouth, MN 55446, United States

You may also visit Raterflow Support.