Privacy Policy

Response and Escalation Assistant (REA) · Effective October 11, 2026

This policy explains how REA and the REA Chrome extension collect, use, store, and share information. REA is a support-work tool for organizations. Organization administrators configure the workspace and manage agent profiles.

Information handled by REA

• Agent and organization records: organization name and settings; agent names, initials, role and active status; and administrator credentials. Administrator PINs are stored as salted hashes, not as readable PINs.
• Workspace content: response templates and reusable variables, suggestions, private notes, shift and issue records, monthly schedules, extraction rules, and support requests. Their content may include names, contact details, customer-support text, and other information entered by an organization or its agents.
• Agent activity and preferences: favorites, recently used items, daily usage counts, custom categories, and translation history.
• Authentication and technical information: administrator session tokens are kept in browser storage; the service processes request and connection information needed to authenticate, protect, and operate the service. Hosting providers may also create operational logs.
• Chrome extension setting: the extension stores whether its floating launcher was dismissed in Chrome's local extension storage.

REA uses browser local storage for session state, preferences, caches, and some agent data. Some agent data and organization records are also synchronized to REA's backend database so they can be used across sessions and devices.

Smart Extractor and OCR

When an agent chooses an image or clicks Paste in Smart Extractor, REA reads the selected clipboard item or file for that action. The Chrome extension asks for clipboard permission the first time clipboard paste is used; the agent can decline and use keyboard paste or choose a file instead. Pasted text is processed in the browser using extraction rules. Screenshot OCR also runs in the browser. In the Chrome extension, the Tesseract.js worker, language data, and OCR engine are packaged with the extension and run locally. In the website version, Tesseract.js assets may be loaded from jsDelivr; that provider receives requests for those assets, not the selected image, recognized text, or extracted values. The OCR feature does not upload images, recognized text, or extracted values to REA's backend. The extension may request the organization's extraction rules from REA's backend; those rules are used locally to identify fields. Results remain in the current interface unless the agent chooses to use or save them through another REA feature.

The extension's floating launcher is injected only on WhatsApp Web, Facebook and Messenger sites, Telegram Web, Gmail, tawk.to sites, and WinBucks sites under winbucks.co.zw and usd-win.betfounders.com. Its content script displays the launcher but does not read page text, form values, browsing history, or page URLs, and does not transmit page content to REA.

How information is used

REA uses information to provide the requested support-work features, authenticate administrators, synchronize an agent's preferences and history, operate organization schedules and records, respond to support requests, prevent abuse, and maintain service security and reliability. REA does not sell personal information or use it for advertising.

Sharing and service providers

• Hosting: REA's website and backend are hosted on Vercel. Vercel processes data and technical logs needed to deliver and secure the service under its own privacy terms.
• Database: REA uses Neon to host its production PostgreSQL database. Neon processes workspace records to provide database hosting and backups.
• Translation: phrases that are not handled by REA's built-in dictionary may be sent from REA's backend to Google Translate for translation. Do not submit sensitive customer information for translation unless your organization permits it. Dictionary matches are handled within REA and are not sent to Google Translate.
• Organization access: workspace information is available to authorized agents and administrators in the relevant organization according to REA's role and access controls.

REA does not share information with third parties for their independent advertising or marketing. Information may also be disclosed where required by law or to protect the security and rights of users and the service.

Retention and deletion

Workspace records are retained until an administrator deletes them or a deletion request is made. Administrators can delete certain records using REA's available management features, and some local preferences can be cleared by clearing browser or extension storage. REA does not currently provide an automatic retention period or a self-service account-wide deletion control. Records not removed through the available controls may remain stored.

To request access to or deletion of agent or organization information, contact gfc.dev@proton.me from the address associated with the organization and identify the organization and records involved. We will verify authority before acting. Deletion from active systems may not immediately remove copies held in provider backups or operational logs; those copies are retained and expire according to provider processes.

Translation history is stored in browser local storage and may also be synchronized to the backend. Clearing it in the interface currently clears the local copy only; contact us to request removal of the synchronized copy.

Security

REA uses access controls and technical measures intended to protect information, including hashed administrator PINs and organization-scoped records. No internet transmission or storage system can be guaranteed completely secure. Organizations are responsible for limiting access to their agent accounts and avoiding unnecessary sensitive information in templates, notes, issues, and translation requests.

Children and changes

REA is a workplace tool and is not intended for children. This policy may be updated as REA's features, providers, or practices change. The effective date above indicates the latest revision.

Contact

For privacy questions or data requests, email gfc.dev@proton.me.