Privacy notice

EFFICIENCY HQ — PRIVACY POLICY Version: 2026-11-04-v3 Effective date: 4 November 2026 1. Scope and responsibility This policy explains how the operator of Efficiency HQ handles personal information through https://app.rishabhbairwal.com and its workspace services. Our privacy and support contact is https://efficiency-hq.com/contact/. Select Other and identify your message as an Efficiency HQ application privacy request. You do not need an application login to open that contact page. For platform accounts, security, administration and the platform's own billing, the operator determines the purposes described below. For staff or customer information supplied by an independent workspace business, that business generally determines why the information is used and who should have access. We process it to provide the workspace service and as required for security, financial integrity and applicable obligations. Contact the workspace owner about its own records and practices; you can also contact us for help identifying the appropriate route. This policy covers this application. The public contact website and third-party services may have additional notices for their own processing. A workspace's own customer-facing privacy notice does not automatically become this platform's notice. 2. Information we collect Account information: name, email address, password hash, company or workspace name, verification status, recorded included access or selected paid plan and seats, accepted policy versions, account preferences and information you choose to add to your profile. Passwords are verified using a password-hashing system; they are not intentionally stored as readable account passwords. Workspace information: staff and customer profiles, invitations, roles, tasks, assignments, notes, messages, time and usage records, reports, uploaded files, business branding and domain configuration. The information present depends on the features used and what the workspace supplies. Avoid uploading information that the service does not need. Billing information, where an optional payment feature is used: accepted quotes, plans, seat quantities, subscriptions, invoices, payment and refund status, amounts, currencies, relevant business details and payment-provider references. The current Stripe sandbox does not enable real-money billing. Stripe is an optional payment provider for configured payment functions and retained payment records; it is not required for existing complimentary workspace access. Hosted payment entry, when separately enabled, is handled by the payment provider. The application does not ask you to put full card numbers or card security codes in ordinary forms, notes or support messages. A workspace may provide protected integration credentials when configuring its own authorized account; those are treated as secrets rather than ordinary profile data. Security and technical information: session and browser-recognition records, IP or derived network identifiers, browser information, access timestamps, authentication and authorization events, rate-limit records, audit events, error diagnostics, request metadata and records needed to detect abuse or investigate failures. Communications: verification and password-recovery requests, security notices, service and billing messages, and delivery or provider-result records. When you contact support, we receive the information you submit through the contact channel. 3. Why we use it We use this information to create and verify accounts; provide the workspace features you request; enforce roles, tenant boundaries and purchased capacity; manage subscriptions and accepted financial operations; deliver requested account and service messages; produce reports; maintain service reliability; prevent misuse; answer support and privacy requests; resolve disputes; and comply with applicable legal obligations. Where a legal basis is required, the relevant basis depends on the purpose and applicable law. It may include providing a requested service or performing an agreement, complying with a legal obligation, proportionate security and operational interests where permitted, or consent where required. A workspace business is responsible for the permissions and legal basis for information it supplies about others. We do not treat accepting this policy as unlimited consent to unrelated uses. 4. Who may access information Your workspace owner and authorized administrators can access information within the permissions applicable to their roles. Staff and customers have narrower access. A customer portal is not intended to expose another customer's records. Authorized platform personnel may access information where needed to operate, support or secure the service, administer platform accounts or meet an obligation; technical tenant separation does not mean that no authorized operator can ever access stored information. Service providers process information needed for their functions. The current service uses hosting infrastructure provided through Contabo, Cloudflare for the public network edge and applicable domain services, Mailgun through SMTP for configured platform email, and Stripe for configured payment services. A workspace may separately configure supported email, SMS or other payment providers, including Twilio or Square where those integrations are available. Provider involvement depends on the actual feature and connection used; this list is not a claim that every integration is active. We may disclose relevant information when required by law, to protect legal rights and service security, or in connection with a genuine business transfer subject to applicable protections and notice requirements. We do not sell personal information or operate a targeted-advertising marketplace through this application. No AI feature or model-training use is part of the application's current functionality. 5. Cookies and browser storage The application uses cookies and browser storage for functions such as authentication, selecting the active workspace, recognizing a browser for security, remembering theme preferences and retaining a form draft during a session. A draft stored in your browser can remain available to someone with access to that browser. Sign out on shared devices and avoid saving sensitive drafts there. Security and network providers may process connection and performance information to serve traffic, prevent abuse and diagnose problems. Your browser and security settings may restrict some of these requests. The application does not require consent to unrelated advertising in order to create an account. If optional tracking is introduced, the applicable notice and controls will need to be updated. You can control cookies and local storage through your browser. Blocking required authentication storage can prevent login or workspace selection. Clearing browser data does not itself cancel billing, close an account or erase server records. 6. Payments, email and independent workspace services The platform's current Stripe connection is in TEST mode. Payment-provider records can still contain the information submitted in a test flow; a sandbox is not permission to enter unnecessary personal information or real card details. A test payment does not represent a real-money charge. An independent workspace business remains responsible for the information it sends through its own merchant connection and its own customer communications. Account emails may contain your name, workspace information, an action link or a short-lived verification code. We retain appropriate submission and delivery evidence to investigate errors and avoid duplicate or uncertain sends. SMTP acceptance is not a guarantee of inbox placement. Workspace messages may use that workspace's own sender and provider. Contact the sender or workspace owner about its communication preferences; account-security messages are handled separately from optional messages. 7. Storage, location and safeguards Information is processed on the application's server and storage systems and by the service providers involved in a request. Depending on the workspace, provider and infrastructure arrangement, processing may occur outside your country. We do not promise that all information remains in a particular country. Applicable transfer restrictions and required safeguards must be considered for the service or workspace concerned; this policy does not claim a certification or a particular cross-border transfer agreement that has not been established. The application uses controls including encrypted transport, password hashing, protected integration secrets, server-side authorization, tenant-scoped database access, private-file controls, audit records and backup/recovery mechanisms. No internet service or security measure can guarantee absolute security. Keep account credentials private and report suspected compromise through the contact channel. We will assess incidents and provide notices where required by applicable law. 8. Retention and deletion We retain information for the purposes for which it is needed, including providing an active workspace, resolving transactions and disputes, preventing abuse and satisfying applicable recordkeeping duties. Different records have different lifecycles. Verification and recovery material has expiry controls; reports and operational artifacts may have their own retention settings. Expiry of a login or code does not necessarily erase the audit evidence that it was issued or used. Financial and audit history, accepted operations and uncertain provider outcomes may need to remain available after a workspace stops using the service. A deletion request is assessed against those obligations and the rights and instructions of the relevant workspace. Backups may retain information until the applicable backup cycle or lawful retention requirement permits removal. We do not promise automatic erasure of every record immediately on logout, cancellation or account closure. If you want to close an account, obtain available reports or exports, or request deletion, contact us and, where appropriate, your workspace owner. We will explain the applicable process and any information that must be retained. Do not assume that a workspace administrator's removal of your access has deleted all business records about you. 9. Your choices and requests You can update the profile information and preferences available to your role. Depending on applicable law and our role in the processing, you may have rights to access information, correct it, request deletion or a copy, object to or restrict certain processing, withdraw consent, or raise a grievance. Withdrawal does not invalidate processing that was lawful before withdrawal and may affect features that need the information. Legal and financial retention obligations can limit a deletion request. Use https://efficiency-hq.com/contact/, select Other, and put “Privacy request — Efficiency HQ application” at the beginning of your message. State the account email or workspace concerned and what you are requesting. You do not need to supply passwords, codes, payment-card details or an API key. We may request proportionate identity or authority verification before disclosing or changing protected information. For a workspace's own business records, we may coordinate with its owner rather than bypass its lawful authority. We will assess and respond under the applicable requirements. If you are not satisfied with our response, you may contact the competent data-protection or other authority where the law provides that right. This policy does not require you to waive a statutory right or promise a regulatory process that is not yet applicable. 10. Children and sensitive information This is a business service intended for adults aged 18 or older. It is not directed at children. Do not create an account for a child or knowingly submit a child's personal information without an expressly supported lawful arrangement. Contact us if you believe such information has been submitted so we can assess the appropriate action. Do not put highly sensitive regulated information, full payment-card details or account secrets into ordinary workspace notes, uploads or support messages unless an appropriate supported arrangement specifically requires and protects it. 11. Updates and contact We may update this policy when the service, providers or applicable requirements change. The version and effective date identify the published policy. We will provide appropriate notice of material changes and seek a new choice or consent where required. A new notice does not authorize an undisclosed incompatible use of information already collected. Privacy and application support: https://efficiency-hq.com/contact/. Application: https://app.rishabhbairwal.com. Terms of Service: https://app.rishabhbairwal.com/terms. Included access and service communications Included access, manual minute records and the related access and audit history are stored in the application database. A complimentary grant is not a Stripe subscription or a payment. Verification, password recovery, sign-in alerts and supported access/service notices are transactional messages sent for account and service operation. Acknowledging this notice does not subscribe you to marketing. Optional nurturing or marketing requires the applicable separately recorded consent and remains off without it. See https://app.rishabhbairwal.com/cookies for the implemented cookie and browser-storage categories. The application does not enable nonessential advertising or analytics tracking by default. Our public Support page at https://app.rishabhbairwal.com/support links to the existing support/privacy contact form. That separate website has its own notices.