Privacy Policy

1Who We Are and Our Role

For purposes of this Privacy Policy:

• RCRAReady, we, us, and our mean RCRAReady LLC, a Colorado limited liability company.
• Website means https://rcraready.com.
• Service includes our website, free tools, guides, forms, the RCRAReady web app, account and trial access, and any related hosted services we provide.
• Customer Data means the facility, container, shipment, manifest, inspection, and audit records that you or your colleagues enter, upload, or import into the web app.
• You means the individual or organization interacting with the Service.

Our role depends on the information:

• For our own purposes. We decide how to use information about website visitors, free-tool users, people who contact us, and the sign-in and billing details of account holders.
• On behalf of your organization. We process Customer Data for the organization that holds the account, as its service provider, to deliver the Service. That organization decides what to enter and who can see it. If your request is about Customer Data, we may refer you to your organization.

2Information We Collect

We collect information in a few different ways.

Information You Provide

When you use our forms, create or use an account, or contact us, we may collect:

• name and work email address;
• organization and facility details, such as names, addresses, EPA ID numbers, and generator status;
• the waste, container, shipment, manifest, inspection, and audit records you enter or upload, including photos and documents;
• mobile phone numbers and email addresses for alert recipients;
• the role you select when you sign up;
• subscription, plan, facility-count, invoice, and billing-contact information;
• payment and transaction information associated with a subscription, such as payment status, invoice identifiers, refunds, and chargebacks;
• credentials for integrations you choose to connect, such as RCRAInfo;
• waste descriptions and documents you submit to AI-assisted features (see Section 6);
• message content and support requests you send us; and
• the source of the signup or inquiry, if available.

When you pay for the Service, payment method details are collected and processed by Stripe through its payment infrastructure. We receive the payment and transaction metadata we need to manage subscriptions, invoices, refunds, disputes, and account support.

We do not ask for Social Security numbers, government-issued IDs, or health information.

Information About Other People

Administrators and users may enter information about colleagues, contractors, and vendors, such as an invitee’s email address, an alert recipient’s phone number or email address, or a shipment contact’s name and phone number. If you add someone, you confirm that you have the right to share their information with us. If someone adds your mobile number for text alerts, we send you a message first, and alerts begin only after you reply YES.

Information From Other Sources

• Sign-in providers. If you sign in with Google or Microsoft, we receive your name and email address, and a profile picture if the provider shares one.
• Payments. Stripe tells us the status of payments and invoices.
• Services you connect. If you connect a service such as EPA’s RCRAInfo, we retrieve the records you authorize.
• Public EPA data. We use public EPA data about regulated facilities to power our lookups and tools. It can include business contact details that EPA publishes.

Information Collected Automatically

When you visit the Website, we may automatically collect limited technical and usage information such as:

• IP address;
• browser type and version;
• device type;
• pages viewed;
• referring site or source category;
• approximate country or state/region;
• aggregate page engagement signals, such as active time on page, scroll depth, page exits, and pages viewed in a session;
• aggregate product interest signals, such as whether a visitor clicked a call-to-action, viewed pricing, started a form, submitted a form successfully, or interacted with a free tool;
• approximate timestamps of visits; and
• similar diagnostic or analytics information.

When you use a free tool, such as the facility search, your search terms are sent to us to return results. We also keep a cleaned-up record of searches, with personal details removed, to see which tools are useful.

When you use the web app, we also collect:

• sign-in and security information, such as the IP address and browser details of your sessions;
• the actions you take, recorded in the audit trail with your name and the time; and
• diagnostic and error information, and data stored on your device so the app can work with a poor connection (see Section 3).

3Cookies, Tracking, and Session Replay

We use cookies and similar technologies, such as local storage and scripts, in three broad categories:

• Essential: keep you signed in, protect your account and our forms, and make the Service work. Blocking them can stop parts of the Service from working.
• Preferences and functionality: remember choices such as your display settings and recent searches, and let the web app work with a poor connection by storing some data on your device.
• Analytics and performance: help us understand how the Website and web app are used and find problems, including through the session replay described below.

You can usually control cookies and stored data through your browser settings. Some data the web app stores on your device can remain after you sign out, so on a shared computer, clear the site’s data in your browser.

Website Analytics

For our first-party website engagement analytics, we do not store form field values, full referring URLs, URL query strings, raw user-agent strings, or persistent visitor identifiers. We use this aggregate analytics data to understand which guides, tools, and pages are useful and where visitors show product interest.

Session Replay (Microsoft Clarity)

Our web app uses Microsoft Clarity to capture how you use and interact with the app through behavioral metrics, heatmaps, and session replay. We use it primarily to debug problems and improve the user experience. Clarity collects this data using first- and third-party cookies and other tracking technologies. It masks text entered into form fields and content it classifies as sensitive, but other on-screen content may still appear in recordings. Microsoft acts as a data controller for Clarity data, so its use of that data is governed by the Microsoft Privacy Statement.

Do Not Track and Global Privacy Control

Our website’s first-party analytics do not run when your browser sends a Global Privacy Control or Do Not Track signal. The web app’s session replay does not read those signals. To opt out of it, email hello@rcraready.com.

4How We Use Information

We may use information we collect to:

• operate, maintain, and improve the Website and Service, including sign-in, account management, and the records, exports, and audit trail you ask for;
• support account creation and trial access, and process contact form submissions;
• respond to questions, product inquiries, and support requests;
• create and manage subscriptions, process payments and invoices, handle refunds and payment disputes, and detect payment fraud or abuse;
• send sign-in codes and links, invitations, security notices, and other messages about your account or inquiry;
• send automated email and SMS text messages regarding facility compliance alerts, storage deadlines, and system notifications (SMS only if you have opted in);
• send product and onboarding emails, such as setup help and trial reminders, which you can unsubscribe from;
• provide AI-assisted features, such as drafting a waste profile for your review;
• understand how visitors use the Website and app, find usability problems, and improve content, tools, and conversion flows;
• create aggregated or de-identified information, which we keep de-identified and do not try to re-identify;
• detect, prevent, and investigate fraud, abuse, spam, security incidents, or other misuse; and
• comply with legal obligations and enforce our terms.

We will tell you before using personal information for a materially different purpose, and will ask for your consent where the law requires it.

5How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Furthermore, no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of sharing exclude text messaging originator opt-in data and consent; this opt-in information will not be shared with any third parties.

We may share information in the following circumstances:

• Service providers: We use vendors and infrastructure providers to host data, deliver emails and text messages, process website requests, support analytics, process payments, and provide AI-assisted features. They are described in Section 6.
• People in your organization: Administrators and other users in your account can see account activity, user names and roles, and the records you create. The audit trail shows who did what. Alert recipients receive the alerts sent to them.
• Services you connect: If you connect RCRAInfo or sign in with Google or Microsoft, information moves between us and that service at your direction.
• Operational notifications: Form submissions and new account activity are forwarded internally so our team can review and respond.
• Legal or compliance reasons: We may disclose information if required by law, legal process, or a valid governmental request, or if reasonably necessary to protect rights, safety, or the Service, or to enforce our terms.
• Business transfer: If RCRAReady is involved in a merger, acquisition, financing, restructuring, or asset sale, information may be transferred as part of that transaction. We will make reasonable efforts to notify you.
• Aggregated or de-identified information: We may share information that cannot reasonably identify you.

Our staff may access Customer Data when needed to support you, keep the Service secure, or fix a problem. Access to production systems is limited and protected by multi-factor authentication, as the Trust Center describes.

6Service Providers and AI Features

We use service providers to operate the Website and Service. They fall into these categories:

• Hosting and infrastructure: hosting, databases, file storage, content delivery, and security.
• Communications: delivering email and text messages, including alerts and notifications.
• Payments: subscriptions, invoices, and payments through Stripe. See Stripe’s Privacy Center.
• Analytics and performance: understanding how the Website and web app are used, including session replay through Microsoft Clarity (Section 3).
• Sign-in: letting you sign in with a Google or Microsoft account if you choose.
• AI model providers: described below.

Information you submit through our forms is stored in our hosted database and emailed to our team. Our Trust Center lists the providers that handle customer data in the web app and what each one does. These providers may change as we evolve the Service.

AI Model Providers

Some features, such as drafting a waste profile from a description or an uploaded document, send that information to AI model providers. That can include documents you upload, descriptions you type, and related waste profile and public EPA records. AI-generated results can contain errors, so review them before you rely on them. We do not use it to train AI models, and our AI model providers are not allowed to use it to train their models. We maintain zero-data-retention agreements with them whenever feasible. The Trust Center lists the AI model providers we use.

7Text Messages

We send text messages only for compliance alerts, deadline reminders, and system notifications, never for marketing.

• Opt-in: When a mobile number is added for a facility, we text the recipient and ask them to reply YES. Alerts begin only after they do. Consent is not a condition of using the Service.
• Opt-out: Reply STOP at any time to stop receiving texts. Reply HELP or email hello@rcraready.com for help.
• Cost and frequency: Message and data rates may apply. Message frequency varies based on your facility’s container and manifest activity.
• Records: We keep a record of consent and of any opt-out.

Section 5 explains how we handle mobile information. Twilio delivers the messages for us.

8Data Retention and Deletion

We keep information for as long as reasonably necessary to provide the Service, respond to your inquiry, maintain account and business records, comply with legal obligations, resolve disputes, and enforce our agreements. In general:

• Account and Customer Data stays while the account is active. The audit trail is designed to be append-only, so its entries cannot be edited or removed through the Service. After a subscription ends, we may delete or de-identify Customer Data, subject to legal obligations, dispute preservation, security records, and backup cycles. You can ask us to delete it sooner.
• Sign-in and session data is kept only as long as needed to keep you signed in and protect your account. Sign-in codes, links, and invitations expire quickly.
• Temporary files, such as uploads that are never attached to a record, are deleted automatically after a short period.
• Security logs, server logs, and website analytics are kept for limited periods, as long as needed for security, troubleshooting, and understanding usage.
• Contact and demo requests are kept as long as needed to respond and maintain business records.

The Trust Center has more detail on how long files and records are kept. Deleted information can remain in backups until they are overwritten.

Deleting Your Account

Account settings let you delete your own account. That removes your sign-in and personal profile, but not records that belong to your organization. Some information stays where needed for record integrity, security, or legal reasons, such as audit trail entries that show who took an action, security logs, and records of text-message consent and opt-outs.

To have an organization’s data deleted, or to request deletion of other personal information, email hello@rcraready.com.

9Data Security

Protecting the records and personal information you share with us is a core part of how we build RCRAReady. We use reasonable administrative, technical, and organizational measures to protect information we process. These include encryption, access controls, and audit logging. The Trust Center describes them in more detail.

You can help by keeping your sign-in methods and email account secure, by signing out on shared devices, and by telling us promptly at hello@rcraready.com if you suspect unauthorized access.

No website, database, email system, or internet transmission is completely secure, and we cannot guarantee absolute security. If we confirm a security incident that affects personal information we hold, we will notify affected customers within 72 hours of confirming it, and as applicable law requires.

10Your Choices

You stay in control of your information. You may:

• choose not to submit forms or provide optional information;
• manage your account and sign-in settings;
• unsubscribe from product and onboarding emails with the link in each message, though we will still send account, security, and alert messages;
• reply STOP to a text message to stop SMS alerts;
• use browser settings to limit cookies or similar technologies, and send a Global Privacy Control signal;
• ask us to opt out of Microsoft Clarity session replay; and
• ask us to access, correct, or delete personal information you provided, subject to legal and operational limits.

To make a privacy-related request, see Section 11 or email hello@rcraready.com.

11U.S. State Privacy Rights

Privacy laws in California and a growing number of other states give residents rights over their personal information. We offer the rights below to all U.S. users, whether or not those laws apply to us.

Your Rights

• Know and access: the categories and specific pieces of personal information we hold about you, where it came from, why we use it, and who receives it.
• Correct inaccurate personal information.
• Delete your personal information.
• Portability: a copy of your information in a portable format.
• Opt out of the sale or sharing of your personal information, and of targeted advertising. We do neither, so there is nothing to opt out of.
• Limit the use of sensitive personal information. We use it only to provide the Service.
• No retaliation: we will not deny you the Service or charge you more for using these rights.

We may decline or limit a request where the law allows, for example to keep the audit trail intact, meet a legal obligation, or protect security. If your request concerns Customer Data, we may refer it to your organization, because it decides how we use that data.

Information We Collected in the Past 12 Months

We disclose this information to the recipients above for the business purposes in Section 4. We have not sold or shared personal information in the past 12 months.

How to Make a Request

Email hello@rcraready.com with the subject “Privacy Request,” and tell us what you would like us to do. If you are not sure how to phrase a request, tell us what you need and we will help. We will confirm it is you, usually by matching your account email address or asking you to confirm by email. An authorized agent can make a request for you with your written permission. We respond within 45 days and tell you if we need more time, and there is ordinarily no charge.

If we deny your request, you can appeal by replying to our response with the word “Appeal.” We reply within 45 days. If you are still not satisfied, you can contact your state attorney general.

California and Nevada

California Civil Code Sections 1798.83 through 1798.84 let California residents ask which personal information a business disclosed to third parties for their direct marketing. We make no such disclosures.

Nevada residents may opt out of the sale of certain information. We do not sell it. To ask a question, email hello@rcraready.com with the subject “Nevada Do Not Sell Request.”

12Where We Operate

RCRAReady is built for U.S. hazardous waste generators and is offered only in the United States. We store web app data in the United States. Our website and web app are delivered through a global network, so traffic can pass through other countries. The Service is not intended for use outside the United States, and we do not offer it in the European Economic Area, the United Kingdom, or Switzerland.

13Children’s Privacy

The Service is intended for business and professional use and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you believe a child has given us personal information, email hello@rcraready.com.

14Third-Party Links

The Website may contain links to third-party sites or services. We are not responsible for the privacy practices, content, or security of third-party services. We encourage you to review their policies before providing information.

15Changes to This Policy

We may update this Privacy Policy from time to time. If we make changes, we will update the “Last updated” date above. If we make a material change, we will provide additional notice, such as by email or a notice in the web app. Your continued use of the Service after changes become effective indicates acceptance of the revised Privacy Policy for information we collect after that date. Where the law requires your consent to a material change in how we use information we already hold, we will ask for it.

16Contact

Questions and requests are welcome. If you have questions about this Privacy Policy, want to submit a privacy request, or need this policy in another format, contact RCRAReady LLC at:

• hello@rcraready.com
• Registered address: 110 16th St Ste 1460, Denver, CO 80202, US