Privacy Policy

Last updated: October 14, 2026

R5 Industries (“R5 Industries,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains our practices regarding the collection, use, disclosure, storage, and protection of personal, financial, and technical data when you visit https://www.r5.industries, order automated website audits, schedule remote or on-site technical support, access your client account portal, use our cross-platform mobile applications, interact with our communications, or engage our professional technology services.

1. Information We Collect

We collect information across several categories depending on how you interact with our platform and services:

A. Information You Provide Voluntarily

• Contact & Intake Information: Full name, business email address, phone number, company name, physical business address, billing address, and project requirements submitted through our contact forms, service inquiry intakes, consultation scheduling, or quote requests.
• Client Account & Authentication Data: Email addresses and verification requests used for passwordless magic link and one-time passcode (OTP) sign-ins.
• Audit Target Information: Website URLs, domain names, target paths, and scan parameters provided when purchasing or configuring express diagnostic website audits.
• Remote & On-Site Support Inputs: Hardware specifications, operating system versions, error logs, configuration files, and situational descriptions provided during technical troubleshooting sessions.
• Business Profile Data: For digital marketing and presence clients, public business details (Name, Address, Phone / NAP citations, opening hours, service areas) and customer review metadata managed via Google Business Profile and local directories.

B. Transaction & Financial Information

• Billing & Order Records: Purchase history, invoice identifiers, quote acceptance records, subscription statuses, and payment transaction metadata.
• Customer Identification for Website Plans: When you order a website plan, we collect your business legal name, trade name, entity type, business address, your name and title, email address, phone number, and the domain you want or already own. If you choose a different domain registrant, we also collect that contact’s name, organization, address, email, and phone. We use this to identify the contracting party, register and manage your domain, and meet legal requirements. Domain registrars and registries may require this information, and some of it may be shared with them. We do not collect Social Security numbers, tax ID numbers, or bank or government ID numbers for this purpose.
• Agreement Signature Records: When you accept a website services agreement at checkout, we record your typed legal name, the agreement version, the date and time, your IP address, and your browser type and version (User-Agent) as evidence of your acceptance.
• Payment Processing: Payment card data (card number, expiration, CVV) and bank account details are collected and processed directly by our PCI-DSS Level 1 certified payment gateways (Stripe and Square). R5 Industries never stores, processes, or transmits raw credit card numbers on its own servers.
• Accounting Synchronization: Invoice records, customer ledger IDs, and transaction amounts may be synchronized with Xero for accounting and financial compliance.

C. Mobile Application Data (Flutter Companion App)

• Local Device Storage: Preferences, authentication session tokens, and local cache databases stored on the client device using secure OS keychains and encrypted local storage.
• Device Identifiers & Telemetry: Operating system version, device model, app version, network connectivity status, and crash diagnostics.

D. Information Collected Automatically

• Technical & Device Telemetry: IP address, geographical region (country/city level), browser type and version, operating system, referrer URL, request timestamps, pages visited, time spent per page, and performance vitals.
• Security & Bot Detection Data: Turnstile verification tokens and device interaction signals evaluated to differentiate human visitors from automated abuse bots.

2. How We Use Your Information

We process personal and operational data for legitimate business interests, contract fulfillment, and statutory compliance, including to:

• Deliver, maintain, and optimize our websites, client account portals, mobile applications, and professional services.
• Execute automated website scans, compile diagnostic scores, and generate confidential audit reports.
• Facilitate live remote technical support sessions and on-site repair dispatches in the Phoenix metropolitan area.
• Synchronize consultation appointments and discovery calls with Google Calendar scheduling systems.
• Process financial transactions, generate quotes and invoices, synchronize ledgers with Xero, manage active subscriptions, and prevent fraud.
• Dispatch critical transactional emails, audit report download links, authentication magic links, and operational notices via our email delivery infrastructure (Resend).
• Manage and optimize Google Business Profile listings and Google Ads campaigns for contracted digital clients.
• Protect platform infrastructure against distributed denial-of-service (DDoS) attacks, brute-force intrusions, spam submissions, and unauthorized automated scanning.
• Comply with tax, accounting, statutory retention, and regulatory requirements.

3. Email Communications & Resend Integration

We use Resend as our primary cloud communications and transactional email service provider.

• Transactional Emails: When you submit a form, request an audit, authenticate into your client portal, schedule an appointment, or receive an invoice, transactional emails are dispatched via Resend. These messages contain essential operational data, including magic sign-in links, PDF invoices, booking confirmations, and cryptographically signed audit report links.
• Delivery Telemetry & Security: Resend processes recipient email addresses, dispatch timestamps, and delivery/bounce statuses solely to fulfill delivery on our behalf. Resend does not sell or repurpose your email address. All email communication is secured with TLS encryption, SPF, DKIM, and DMARC authentication protocols.
• Marketing Communications: If you opt in to receive marketing advisories or newsletters, you may unsubscribe at any time using the “Unsubscribe” link in the email footer or by submitting a request via our contact form.

4. Website Audits & Diagnostic Data Handling

When you request an automated website audit (Cybersecurity, Technical SEO, Accessibility, or Performance):

• Public Endpoint Inspection: Our diagnostic crawlers inspect publicly accessible assets of the designated URL, evaluating TLS cipher suites, HTTP security defense headers, DNS records (SPF, DKIM, DMARC), markup accessibility semantics (Pa11y, axe-core), and browser rendering lab metrics (Lighthouse).
• Report Generation & Storage: Findings, scores, and remediation recommendations are assembled into interactive web reports and downloadable ZIP archives stored securely in Cloudflare object storage.
• Confidential Token Protection: Audit reports and download bundles are accessible only via cryptographically signed, time-limited token links. Reports fail closed against unauthorized crawlers and indexing engines via strict noindex, nofollow, noarchive robot tags.

5. Remote & On-Site Technical Support Privacy

• On-Demand Access: Technicians only access your device with your active authorization and supervision via secure session PINs (e.g., RustDesk or Quick Assist).
• No Background Recording: We do not record video of your screen or copy private files without your express verbal or written permission.
• Temporary Session Cleanup: Remote connection software and temporary diagnostic artifacts are removed or invalidated upon session termination.

6. Third-Party Service Providers & Subprocessors

We do not sell, rent, or monetize your personal data. We share information only with authorized third-party service providers bound by strict data protection agreements:

Service Provider	Purpose / Role	Data Processed
Cloudflare	Edge Hosting, CDN, D1/KV Storage, R2 Object Storage, DNS, Turnstile Bot Protection	IP address, connection telemetry, bot verification signals, static & dynamic assets
Resend	Transactional & Operational Email Delivery	Recipient email address, name, transactional message content, delivery status
Stripe	Payment Gateway, Customer Portal, Recurring Subscriptions, Invoicing	Name, billing address, payment token, transaction history
Square	Payment Processing, Point-of-Sale Invoicing	Name, billing details, payment token, transaction history
Xero	Accounting Synchronization & Ledger Management	Invoice records, line items, customer names, payment reconciliation status
Google APIs	Calendar Scheduling, Google Business Profile Management, Ads Telemetry	Appointment timestamps, business profile interaction telemetry, local citation details

7. Cookies, Local Storage & Anti-Abuse Controls

• Essential Storage: We use essential browser local storage and session tokens to preserve authentication sessions, maintain theme settings, and protect against CSRF attacks.
• Bot Mitigation (Turnstile): Cloudflare Turnstile evaluates browser telemetry on public form submissions without setting cross-site advertising tracking cookies.
• Privacy-Preserving Analytics: We monitor platform traffic trends and system performance using privacy-focused analytics that do not track users across third-party websites.
• For additional details, please see our Cookie Notice.

8. Data Retention & Archival

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Audit Reports & Scans: Audit scorecards and diagnostic bundles are retained for a designated access period (typically 90 days) to allow customer review and verification before automatic deletion.
• Client Accounts & Invoices: Billing history, payment receipts, and tax records are retained for statutory retention periods (typically 7 years) as required by applicable tax and commercial laws.
• Customer Identification Records: Business and owner details collected for website plans are retained for the life of the agreement plus the applicable statute of limitations. Registrant contact details must stay accurate and may be retained by the registrar as its rules require.
• Agreement Signature Records: Signed agreements and their acceptance evidence (including IP address and browser details) are retained for the life of the agreement plus the applicable statute of limitations. After that period, the IP address and browser details are deleted.
• Inquiry & Support Communications: Contact submissions, booking records, and support tickets are retained for up to 3 years to support customer relationships and technical reference.

9. Information Security Safeguards

We maintain rigorous administrative, technical, and physical safeguards to protect your personal information:

• Encryption in Transit & at Rest: All web traffic is encrypted via TLS 1.3. Database records, R2 storage objects, and stored audit artifacts are encrypted at rest using industry-standard AES-256 encryption.
• Least-Privilege Access Controls: Access to client data and internal systems is restricted to authorized personnel requiring access for operational fulfillment.
• Fail-Closed Confidentiality: Confidential report endpoints enforce token verification, signature validation, and restrictive caching headers (no-store, noindex).

10. Your Privacy Rights & Choices

Depending on your jurisdiction (including under the California Consumer Privacy Act / CPRA, GDPR, and other applicable state and international privacy laws), you may have the following rights:

• Access & Portability: Request a copy of the personal data we hold about you.
• Correction / Rectification: Request correction of inaccurate or incomplete personal records.
• Deletion / Erasure: Request deletion of your personal data, subject to statutory recordkeeping exemptions.
• Restriction & Objection: Object to or request restriction of certain processing activities.
• Opt-Out of Marketing: Unsubscribe from promotional communications at any time.

To exercise any of these rights, please submit a request through our secure contact form. We will verify your identity and respond within the timeframes required by applicable law.

11. Children’s Privacy

Our websites, applications, audits, and services are intended exclusively for commercial and professional audiences and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may periodically revise this Privacy Policy to reflect advancements in our technology, changes in our service offerings, or evolving legal standards. When modifications occur, we will update the “Last updated” date at the top of this document. We encourage you to review this policy periodically.

13. Contact & Privacy Inquiries

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us via our contact form or write to:

R5 Industries
Attn: Privacy & Data Protection
Website: https://www.r5.industries
Contact: https://www.r5.industries/contact