Rincon AI

Privacy Policy

Last updated: October 2026

Introduction

Rincon AI (“we,” “our,” or “us”) builds AI-powered operating systems for small and medium businesses. This Privacy Policy explains how we collect, use, store, and protect information when you visit rinconai.com, use our client portal at portal.rinconai.com, or connect third-party services (such as Google, Instagram, TrainingPeaks, or Klaviyo) to our platform.

We believe in the minimum data principle: we only request access to the data we actually need to deliver the agreed-upon service, and we do not resell, rent, or otherwise commercialize your data.

Information We Collect

Information you provide directly

  • Contact form submissions: name, email, phone number, business name, message content.
  • Portal account details: name, email, and any organization or role information you add.
  • Content you upload or configure inside the portal, including campaign copy, workout comments, promotion settings, and notes you record about contacts or athletes.

Information from connected third-party services (with your consent)

When you authorize Rincon AI to connect to a third-party service on your behalf, we receive and process only the data covered by the scopes you approve:

  • Google / Gmail API. If you connect a Gmail mailbox, we request the gmail.readonly and gmail.modify scopes to list, read, and mark-as-read messages from specific senders (for example, TrainingPeaks coach-comment notifications). We do not read, index, or retain any messages outside the narrow filter you configure.
  • Instagram / Meta Graph API. If you connect an Instagram business account, we receive public profile information, comment events, and direct-message events for that account only, limited to the permissions you approve.
  • TrainingPeaks Partner API. If you connect a TrainingPeaks coach or athlete account, we receive athlete profile, workout, and metric data that your scopes cover. We post coach comments back to TrainingPeaks only when you explicitly approve a draft.
  • Klaviyo API. If you connect a Klaviyo account, we read list and profile data you designate and write new profiles, list memberships, and email campaigns on your behalf.

Information collected automatically

  • Standard web server logs: IP address, browser type, pages visited, timestamps.
  • Error and performance diagnostics used to maintain service reliability.

Google API Services User Data Policy (Limited Use)

Rincon AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use Google user data to provide or improve user-facing features that are prominent in the application’s user interface.
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
  • We do not use Google user data for serving advertisements, and we never sell Google user data.
  • We do not allow humans to read Google user data except with your explicit consent, when necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.

How We Use Your Information

  • To respond to your inquiries and provide the services you request.
  • To authenticate you and keep your portal session secure.
  • To process the operational tasks you configure: ingesting comments and messages, drafting replies, routing leads, staging newsletters, and similar automation inside your own accounts.
  • To generate AI-assisted drafts and suggestions inside the portal. We send the minimum context required for each request to our AI model providers and never use your data to train foundation models.
  • To book the call you pick on our booking page: we put it on our Google Calendar and send you the invite with a Zoom link.
  • To send transactional emails related to your use of the service.
  • To improve the reliability and security of our platform.
  • To comply with legal obligations.

Third-Party Processors

We rely on a small set of vetted service providers to operate the platform. Each receives only the data necessary to perform its function:

  • Amazon Web Services (AWS). Hosting, compute, and storage.
  • Supabase. Managed Postgres and authentication backend.
  • Anthropic. Large language model inference for drafts and analysis. No training on your data.
  • OpenAI. Embeddings and supporting language model inference. No training on your data.
  • Google Analytics. Visit counts on our marketing website, unless you choose No thanks or your browser sends Global Privacy Control.
  • Google (Gmail API, OAuth). Mailbox access for inbound ingestion, only under the scopes you authorize.
  • Meta (Instagram / Facebook Graph API). Social account access, only under the scopes you authorize.
  • TrainingPeaks. Athlete and workout data, only under the scopes you authorize.
  • Klaviyo. Email list and campaign management, only under the API keys you provide.
  • Resend. Outbound transactional email delivery.
  • OpenAI (ChatGPT ads). If you reach our website from one of our ads in ChatGPT and send the booking form, we tell OpenAI the ad led to an inquiry, so we can see which ads work.
  • Meta (Facebook and Instagram ads). The Meta Pixel on our marketing website, only if you choose Allow ads too, so we can show our ads to past visitors.
  • Cloudflare Turnstile. A bot check on our booking page when you pick a time. It reads signals from your browser to tell people from bots and does not set advertising cookies.
  • Zoom. The video call for a booked consultation.
  • GitHub. Source control for our platform code. No customer data stored in repositories.

SMS / Text Messaging

Rincon AI operates one-to-one conversational SMS through Twilio. If you text a Rincon AI phone number, we use your mobile number solely to respond to your inquiry and continue the conversation you initiated.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and phone numbers collected for the purpose of SMS communications are not sold, rented, or otherwise transferred to third parties for their independent use. Information sharing with subprocessors that strictly support the operation of our SMS service (for example, Twilio for message delivery) is limited to what is necessary to deliver the message.

Message frequency. Messages are sent only in direct response to messages you send us. Frequency varies based on the conversation; you control the cadence by choosing when and whether to reply. Typical volume is fewer than a handful of messages per inbound contact per week.

Message and data rates may apply. Standard message and data rates from your wireless carrier may apply to messages you send and receive.

Opt out. Reply STOP to any message at any time to unsubscribe and stop receiving SMS from that number. Reply HELP for help, or contact cav@rinconai.com.

Data Storage and Security

All data is transmitted over HTTPS and stored in managed databases with encryption at rest. Access tokens for connected third-party services are stored server-side and never exposed to the client browser. Portal access is gated by single sign-on and role-based authorization. We maintain audit logs of privileged actions.

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you without undue delay and cooperate with applicable regulatory authorities.

Data Retention and Deletion

We retain operational data (contacts, comments, drafts, logs) for as long as you maintain an active relationship with us, plus a reasonable archival period for backups and recovery.

You may request deletion of your account data at any time by emailing cav@rinconai.com. We will confirm deletion within 30 days. You may also revoke any third-party integration grant (Google, Meta, TrainingPeaks, etc.) directly from that provider’s account settings; doing so immediately ends our ability to access further data from that account.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion or export of your personal information.
  • Object to or restrict certain processing activities.
  • Withdraw consent for any connected third-party integration at any time.
  • Opt out of any marketing communications.

To exercise any of these rights, contact cav@rinconai.com.

Blog Email List

If you sign up for our blog, we email you a link to confirm, and only add your address once you click it. Confirmed addresses are kept in our email provider, Resend, to send new posts, and in our own customer records as a contact, so we know who has asked to hear from us. Every email has an unsubscribe link, and you can ask us to delete your details at cav@rinconai.com.

Cookies and Tracking

Our marketing website uses Google Analytics, and a notice bar says so on your first visit. Google Analytics sets cookies (named _ga) to count visits and see which pages are read, and Google processes that data for us as a service provider. Google’s advertising features and Google signals are turned off. If you choose No thanks, or your browser sends Global Privacy Control, analytics stops and its cookies are removed. You can change your choice at any time with Cookie settings at the bottom of every page.

Only if you choose Allow ads too, our marketing website also loads the Meta Pixel. It sets cookies (named _fbp) and tells Meta which of our pages you visited and whether you sent the booking form, so we can show our ads to past visitors on Facebook and Instagram and see which ads lead to inquiries. Meta processes that data under its own terms. Under some state laws, including California’s, this counts as “sharing” personal information for advertising. Analytics only, No thanks, or Global Privacy Control keeps the Meta Pixel off, and choosing one of those later turns it off and removes its cookies.

When you arrive from one of our ads in ChatGPT, the address carries an ad reference. We keep it in your browser for that visit only, with no cookie. If you send the booking form, we pass it to OpenAI with a one-way hash of your email address, so OpenAI can count the inquiry for that ad. It is marked so OpenAI does not use it to personalize ads. If you chose No thanks in the cookie bar, or your browser sends Global Privacy Control, we do not send it.

To know which of our posts, emails and pages bring people to us, our marketing website notes how you first arrived on a visit: the tracking tags in the address (for example from our newsletter or a social post), the site that linked you, and the first page you saw. It stays in your browser for that visit only, with no cookie, and reaches us only if you send the booking form, where it is added to your inquiry.

The portal uses only essential cookies required for authenticated sessions.

On our home page, the task you type into “What eats your week?” is sent to Anthropic, our AI provider, to draft the plan shown on screen. We do not keep a copy of it unless you send it to us with the booking form.

When you send the booking form, your name, business name, email domain and message also go to Anthropic so we can sort new inquiries from sales offers before we read them.

Children’s Privacy

Our services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from children. If you believe we have inadvertently done so, contact us and we will delete the data.

International Users

Rincon AI operates from the United States. If you access our services from outside the United States, your information may be processed in the United States, where data protection laws may differ from those in your country.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be flagged on this page with an updated revision date, and where required by law we will notify you directly before the change takes effect.

Contact Us

Questions about this Privacy Policy, your personal data, or connected integrations can be directed to cav@rinconai.com.

Rincon AI · Tucson, Arizona