Privacy & Policy

1. Information We Collect

A. Personal Information

We may collect:

• Name
• Email address
• Phone number
• Mailing address
• Account credentials
• Business and licensing information

B. Payment Information

Payments are processed through third-party providers. RPZ Flow does not store full credit card data.

C. Automatically Collected Information

We may automatically collect:

• IP address
• Device and browser information
• Usage activity and system logs

D. Backflow & Compliance Data

We collect and process:

• Backflow assembly test reports
• Compliance records
• Location identifiers (LID)

This information is necessary to provide Platform services.

2. How We Use Information

We use information to:

• Provide and operate the Platform
• Process submissions and generate reports
• Send required compliance notifications
• Communicate with users
• Improve system performance
• Maintain security
• Comply with legal and regulatory obligations

3. Sharing of Information

We do not sell personal information.

We may share information with:

• Service providers (e.g., hosting, infrastructure, payment processing)
• Water systems and regulatory authorities
• Legal authorities when required by law
• Parties involved in a business transaction (e.g., merger, acquisition, or asset sale)

We may also share aggregated or de-identified data that does not identify individuals.

4. U.S. Privacy Rights (CCPA and State Laws)

Depending on your state of residence (including California, Colorado, Virginia, and Connecticut), you may have the right to:

• Access personal information we maintain about you
• Correct inaccurate personal information
• Request deletion of personal information
• Opt out of the sale or sharing of personal data (RPZ Flow does not sell personal data)
• Limit use of sensitive personal information (where applicable)
• Receive non-discriminatory treatment for exercising your rights

How to Exercise Your Rights

Requests may be submitted to: Info@rpzflow.com

We may require verification of your identity before fulfilling requests and will respond within applicable legal timeframes.

Authorized agents may submit requests where permitted by law.

5. Government & Municipal Data Handling

When RPZ Flow provides services to water systems or municipalities:

• RPZ Flow acts as a data processor / service provider
• The governmental entity acts as the data controller
• Data may be subject to public records laws, including applicable state open records laws

6. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect information.

However:

• No system is completely secure
• Absolute security cannot be guaranteed

Users are responsible for maintaining the confidentiality of their login credentials.

7. Data Retention

We retain data:

• As necessary to provide services
• To comply with legal or regulatory obligations
• For legitimate business purposes

We may retain certain information after account termination where required or permitted by law.

8. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Maintain sessions
• Improve functionality
• Analyze usage

Disabling cookies may impact the functionality of the Platform.

9. User Choices

Users may:

• Update account information
• Opt out of non-essential communications
• Request access to or deletion of personal information

Certain communications (such as compliance-related notices) may still be required.

10. Third-Party Links

The Platform may contain links to third-party websites. RPZ Flow is not responsible for the privacy practices of those sites.

11. Children’s Privacy

The Platform is not intended for individuals under 18 years of age, and we do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be effective upon posting.

Continued use of the Platform constitutes acceptance of the updated Policy.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Illinois.

14. Contact Information

RPZ Flow, LLC
Email: Info@rpzflow.com

15. Data Processing Summary

RPZ Flow acts as a data processor for its customers.

• Customers (e.g., municipalities) control their data
• RPZ Flow processes data solely to provide services
• Data includes user information, compliance records, and system logs
• Data remains owned by the customer or governing authority

We use trusted subprocessors and implement commercially reasonable safeguards.

We assist customers with lawful data requests and notify them of confirmed data breaches as required by law.

16. Security & Compliance Overview

RPZ Flow maintains a security program aligned with industry best practices, including principles commonly associated with SOC 2 (Security, Availability, and Confidentiality).

Controls include:

• Role-based access controls
• Encryption in transit (TLS)
• Secure infrastructure environments
• System monitoring and logging
• Vulnerability management and patching
• Incident response procedures

While RPZ Flow maintains strong safeguards, no system can guarantee absolute security.

17. Public Records & FOIA Compliance

When serving governmental entities:

• The customer (municipality) is responsible for determining public records disclosure obligations
• RPZ Flow does not independently determine disclosure requirements
• RPZ Flow will assist, upon reasonable request, with access to data needed to respond to lawful public records requests

RPZ Flow may identify information it considers confidential or proprietary; however, final disclosure decisions remain with the customer.

RPZ Flow may disclose information if required to comply with applicable law, subpoena, or court order.

Reasonable costs associated with data retrieval or production may apply where permitted by law.