Privacy Policy

Effective November 11, 2026

Rainmaker Reporting Dashboard (the “Service”) is a marketing-reporting dashboard operated by Rainmaker for Contractors (“we”, “us”). It lets a marketing agency and its clients see leads, ad spend and results from the accounts they connect. This policy explains what information the Service collects, how it is used and shared, and the choices you have.

1. Information we collect

Account information

Your name, email address, password (stored hashed by our authentication provider) and the role and clients your agency gives you access to.

Data from GoHighLevel (HighLevel)

When an agency connects its HighLevel account, we receive the client sub-accounts it installs the Service on and, for those clients: contacts (name, phone, email, source and tags), conversations and messages, call details and recordings, phone numbers, and advertising reports HighLevel provides.

Google user data

If you choose to connect a Google account, we request only the access needed for the reports you see:

• Google Analytics (read-only): the properties you can access and their traffic and conversion reports.
• Google Ads / Local Services Ads: the Local Services accounts under your manager account, their spend and performance reports, and lead reports (lead type, category, charge status and the consumer phone number Google provides).
• Google Business Profile: the business locations you manage and their performance metrics.
• Google Search Console (read-only): the sites you have verified and their search performance.

We also store the OAuth tokens Google issues so reports can refresh without you signing in each time.

Technical information

Session cookies needed to keep you signed in, and server logs (IP address, time, request path) kept for security and troubleshooting. We do not use advertising or cross-site tracking cookies.

2. How we use information

• To show your agency and its clients dashboards of leads, spend, cost per lead and other results.
• To attribute leads to the channel they came from and check whether each lead is genuine (“lead verification”).
• To keep connected accounts in sync on a schedule, and to run data-quality checks.
• To secure the Service, prevent abuse and fix problems.

We do not sell personal information, use it for advertising, or use it for any purpose unrelated to providing the Service.

3. Google API Services: Limited Use

Rainmaker Reporting Dashboard’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the reporting features you see in the Service.
• It is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you.
• It is not used for advertising, and it is not sold.
• No person reads it unless you ask us to (for example, for support), it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.
• It is not used to develop, improve or train generalized AI or machine-learning models.

4. AI-assisted lead verification

To decide whether a lead is genuine, the Service sends the relevant lead details (for example, a message, a call transcript, or a Local Services lead’s type and category) to Google’s Gemini API and stores the resulting score and reasons. This happens only to provide the verification feature to the agency that owns the data. We use Gemini under its paid API terms, which do not allow the data to be used to train Google’s models, and we do not use it to train any models of our own.

5. How information is shared

We share information only with service providers that run the Service on our behalf, under confidentiality and security obligations:

• Supabase: database and authentication hosting.
• Our cloud server provider: application hosting.
• Google (Gemini API): lead verification, as described above.
• HighLevel and Google: we send requests to their APIs to read the data you connected and, only where an agency admin turns it on, to create or tag contacts in HighLevel.

Within an agency, information is visible only to users the agency grants access to. We may also disclose information if required by law or to protect rights and safety.

6. Storage and security

Data is stored in a managed Postgres database. Connected-account tokens are encrypted at rest (AES-256-GCM); all traffic uses HTTPS; database row-level security keeps each agency’s data separate. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.

7. Retention and deletion

• Data is kept while the agency’s account is active and as needed to provide reporting history.
• Revoking a connection stops further collection. You can revoke our Google access at any time at myaccount.google.com/permissions, and uninstall the app from a HighLevel sub-account to stop HighLevel access.
• To have your data, including Google user data, deleted, email stmreputationmktgpro@gmail.com. We delete it within 30 days, except where we must keep it by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to its processing. Email stmreputationmktgpro@gmail.com and we will respond within 30 days. If the information was provided by an agency you work with, we may refer your request to that agency.

9. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information.

10. Changes

We may update this policy. We will change the effective date above and, for material changes, notify account holders before they take effect.

11. Contact

Rainmaker for Contractors — stmreputationmktgpro@gmail.com