Privacy notice
What personal data RFX processes, why, for how long, and who else sees it.
1. Who is responsible
[legal entity that operates RFX, registered address, registration number] is the controller for the account data of people who sign in. For content a company uploads or connects (documents, RFP data, its systems' data), [decide with counsel: RFX as processor for the company, under the data processing agreement, or as controller]. Contact for privacy questions: support@rfx.market [a dedicated privacy address, if wanted]. [data protection officer or representative, if required]
2. What RFX processes (from the code)
| Data | Why | Kept |
|---|---|---|
| Work email, name, title, company domain, roles, last sign-in | Your account: signing in, recording who took each decision | [while the account exists, then …] |
| Sign-in link and code (stored only as a hash) | Signing in | 15 minutes |
Session cookie rfx_session (stored only as a hash) | Keeping you signed in. The only cookie RFX sets; no analytics or tracking cookies | 12 hours |
| Decisions you take: NDA signatures, approvals, deal signatures, with your name, title and email | The record both companies rely on; the hash-chained trail | [retention of the trail and signed documents] |
| Activity log: each agent action and page decision, IP address, browser, time; secrets removed, document contents reduced to their length | Security, abuse prevention, showing a company what was done in its name | 365 days |
| Request log: time, path, status, IP address | Running and securing the service | Rotated by size: at most 50 MB per service, oldest lines first |
| Names and emails of NDA signers, sent to the e-signature provider | Signing the NDA | [retention of signed NDAs] |
| Messages to the RFX assistant | Answering them | In memory for 2 hours |
| A record of each language-model call: what for, for which company, model, tokens, time, hashes of what was read; not the content | Cost, reliability, and tracing what a claim was read from | 365 days, with the activity log |
| Introductions: when RFX revealed a buyer and a vendor to each other, and what each later reported | The non-circumvention in the NDA and the vendor agreement | [at least 24 months after each introduction] |
| Personal data inside documents vendors upload or connect | Building the vendor's context for buyers | Until the vendor removes them |
| Backups of all of the above | Recovery | 14 days |
3. Legal basis
[for each purpose: contract, legitimate interests, legal obligation, consent; under GDPR and the Swiss FADP as applicable]
4. Who else sees it
The other company in a transaction sees what the levels and the NDA open to it, and the names of the people who signed. These services process data for RFX:
| Service | For | Data | Where |
|---|---|---|---|
| Cloudflare | Network in front of the site (the tunnel), TLS; object storage (R2) for encrypted backups and signed NDAs | IP address and request metadata; encrypted backup files; signed NDA documents and their audit trail | [region and transfer basis, to confirm] |
| Resend | Sending email: sign-in links and codes, agent confirmations, notices of decisions waiting | Email address, the message | EU (eu-west-1, Ireland) |
| Yousign | Electronic signature of NDAs, when switched on | Signer name, email, the NDA document | [region, to confirm] |
| Anthropic | Language model: reads vendor documents into capability claims, transcribes images and scans, the RFX assistant | Content of vendor documents; messages typed to the assistant; names in them | [region and transfer basis, to confirm] |
| Sentry (only if switched on) | Reporting unexpected errors and missed backups | The error and its stack trace; nothing about the request | [region, if used] |
| Langfuse (only if switched on) | Tracing language-model calls | The RFX assistant's conversations: what a person writes, what the assistant reads and does for them, and its answers, with keys and tokens removed. For other model calls, metadata only: model, tokens, time, hashes, pseudonymous company ids | [region, if used] |
5. Transfers outside Switzerland and the EEA
[which transfers happen and on what basis (adequacy, standard contractual clauses)]
6. Your rights
An admin of your company downloads everything RFX holds about it (one file, without secrets) and can close the account, on the RFX page; closing removes the company's own data and its people's accounts, and keeps signed agreements, introductions, fees and the record of what happened, on which the other companies rely. You may also ask for access, correction, deletion, restriction, portability, and object to processing, by writing to support@rfx.market. [how requests are verified and answered; the right to complain to a supervisory authority (FDPIC, or the authority in the EU member state concerned)]
7. Security
- HTTPS only, through Cloudflare; the server opens no port to the internet.
- Agent keys and session tokens are stored only as SHA-256 hashes; sign-in codes are single-use and expire after 15 minutes.
- Sessions are HttpOnly, Secure, SameSite cookies valid 12 hours; signing and paying need a sign-in of the last 10 minutes.
- Roles per person (admin, approver, signer, viewer); agents cannot sign, approve or pay.
- Each company sees only its own data; level-2 and level-3 content opens to a buyer only after an NDA and a person's approval.
- The database runs on a private network with no route to the internet, under a role that owns only RFX's tables.
- Encryption at rest (AES-256-GCM) of the database, the activity log, signed documents and vendors' files, with a key held only by the RFX application: the database, its backups and the storage bucket hold nothing readable without it.
- Continuous write-ahead-log archiving, nightly base backups and dumps kept 14 days, point-in-time recovery; an encrypted off-site copy (file names and contents) every 5 minutes.
- An activity log of every agent action and every decision on the page, with secrets removed.
- Rate limits on sign-ins, mails, registrations and the assistant.
8. Changes
[how changes to this notice are announced]
Last updated: [date]