RiteBinder Privacy Policy

Effective date: September 7, 2026 · Last updated: October 11, 2026

RiteBinder ("RiteBinder," "we," "us") is run by ARDEO LABS LLC, a Florida limited liability company. This policy covers our apps, website, support channels, and the client pages that need no login: booking pages, client portals, and rehearsal agendas. It applies to officiants who hold accounts and to the people they serve: couples, families, and honorees.

The short version: your data is yours. We don't sell or rent it, run ads, share it for anyone's advertising, or use your content to train AI models. We never market to your couples or families. You can export or delete everything at any time.

1. What we collect

Account information. Email address, name, and authentication credentials (managed by our authentication provider).

Your practice content. Packages and prices, ceremonies, venues, agreements, questionnaires, scripts and their versions, your ceremony library, license-return tasks, payment records, notes, branding, and payment-link URLs.

The people you serve. Names, pronouns, phonetic pronunciations, emails, phone numbers, addresses, and notes about your clients, including, for funerals and memorials, the person honored and their family. You enter them, or clients submit them through your links. You must have the right to share them with us. We use them only to provide the service, never for our own marketing.

Ceremony content. Questionnaire answers, vows, eulogy material, and style preferences, including a note on religious or spiritual tradition. It can include health, disability, or end-of-life details. We treat it as sensitive: it is never sold, never used for ads, and never used to train AI models.

E-signature records. When a client signs, we record the typed signature name, the signer's email, the server time, and the IP address of the request, as your evidence of signature.

Portal activity. Timestamps for when a link was opened, a questionnaire submitted, or a script approved, and any comment a client leaves on a script, with their name.

Payment information. Stripe processes subscription payments on its own pages. We get your subscription status only — we never receive or store card numbers, card brands, or billing card details of any kind. Your clients pay you in one of two ways. On your own payment rails (your link, invoice, cash, or check), payment happens outside RiteBinder, and we record only the amount, method, date, and note you enter. If you turn on collecting through RiteBinder, Stripe opens a checkout page as a direct charge on the Stripe account you connected: you are the merchant of record, and the money settles to you, never into a RiteBinder balance. We send Stripe the amount, what it is for, your practice name, our own reference for the ceremony, and your client's email address, so Stripe can pre-fill the form and send a receipt. Your client enters card or bank details on Stripe's page, and those details are never delivered to us. We get back the amount, method, timestamps, Stripe's charge identifiers, and the platform fee, never card data.

In-app subscriptions. On iOS or Android, Apple or Google processes the payment, and we get no card or billing details from them. RevenueCat manages the subscription for us and receives your organization ID (as your app user ID), purchase and subscription history, and entitlement status.

Usage, device, and website data. In the apps, PostHog collects screens and features used, device type, OS version, and approximate region and city from your IP address, keyed to your account ID. On ritebinder.com, PostHog collects page views, clicks, and errors, using a first-party cookie and browser storage. Booking pages and client portals load no analytics; Cloudflare Turnstile runs a bot check on booking forms. We do not record website sessions, and we use no advertising cookies or cross-site tracking. Sentry collects crash diagnostics in the apps, set not to send personal data.

Your analytics choice. In the EU/EEA, the United Kingdom, and Switzerland, we ask before turning on usage analytics; elsewhere it is on by default. Change it anytime with the "Analytics preferences" link in the footer.

Cookie-free site measurement. Our websites also use Cloudflare Web Analytics to count page views and load speed, without cookies, fingerprinting, or cross-site tracking. It builds no profile of you and gives us no name, email, or precise location.

On-device copies. Podium mode caches the script and your branding on your device for offline use. The cache is cleared when you delete the app or the ceremony.

Support communications. Messages you send by email, the website contact form, or the in-app support form. The in-app form adds app version and build, platform, OS version, device model, language, time zone, and any photos you attach.

Device permissions we ask for.

Your phone's contacts, only when you pick one. On iOS and Android you can add a client by picking one contact. We read only that contact's name and the phone number and email you choose, nothing else. RiteBinder never uploads, browses, syncs, or stores your address book, and picking sends us nothing on its own: we keep only what you save to the client record. On the web, this appears only in browsers with their own contact picker.

Photos: only when you pick a practice logo or booking-page cover, or attach photos to a support message. For a logo or cover, we read the one image, strip its metadata, and store it. Both are public to anyone with the link: the logo on your booking page, client portals, and documents; the cover on your booking page. Support photos go privately to our support team. Your photo library is never uploaded.

Notifications: if you turn them on, we store a push token for that install to send your chosen alerts (questionnaire completed, script approved or commented on, agreement signed, rehearsal and podium reminders). It is removed when you delete your account or the device stops receiving notifications, such as after an uninstall. Couples and families never get push notifications from us.

We do not use your camera, microphone, location, or calendar.

2. How we use it

• Run and improve the service, including the offline podium cache and backups.
• AI ceremony drafting: interview answers, your pins, partner names, pronouns and phonetics, your style settings (including the religion note), and library excerpts you select go to Anthropic's API to draft ceremony blocks. Drafts land in your review queue, unseen by couples and families until you share them, and nothing becomes part of a script without your acceptance. Under Anthropic's commercial terms, your inputs and outputs are not used to train their models.
• AI inquiry intake: inquiry text you paste goes to the same provider to suggest a client and ceremony. Suggestions wait in a review queue; duplicates are flagged, never merged; a suggestion becomes part of your records only when you accept it. Inquiries from your public booking page are recorded directly for you to review, and with instant booking on for an offering, a booking there is recorded as a booked ceremony: your agreement goes out for signature and the date is held for the window you set.
• Instant booking acts on your instruction: the booking, client record, and agreement are created from the visitor's submission under your settings.
• Send email you start to your clients through Resend, in your name and brand (never ours) with your reply-to: questionnaire invites and nudges, script shares, approval confirmations, agreements and signed receipts, payment reminders and receipts, and inquiry acknowledgments. If you turn them on, we also send, in your name, review requests after a ceremony and instant-booking mail (receipts, signature confirmations, and a notice if a held date releases).
• Send required product email (sign-in codes, billing receipts, security notices), a short onboarding sequence, and the optional weekly digest.
• Send push notifications you turn on, through Expo.
• Measure usage, diagnose crashes, prevent fraud and abuse, and comply with law.

3. Client links, share scopes, and vow privacy

Clients reach RiteBinder through links, not accounts. Each link has a long random token and cannot be guessed. Every client link can be turned off: share links (scripts, questionnaires, rehearsal agendas) can be revoked in the app, and an agreement's link stops working when you void it. A revoked link shows nothing, not even an error page. Anyone with a live link sees what it shows, so treat links like the documents.

• Booking pages are public and show your active packages and prices.
• Agreement portals show the agreement and collect the signature record above.
• Questionnaire portals show your questions and save answers as they are typed.
• Script portals show a snapshot at a scope. A partner-scoped link leaves out the other partner's vows and officiant-only blocks; a full-scope link shows everything couple-visible. We filter on our server, so excluded text never reaches the browser.
• Rehearsal-agenda pages show a timeline for planners and contain no script text at all.

4. If you're a couple, a family member, or a guest

Your officiant uses RiteBinder to run your ceremony and is responsible for the relationship with you; we process your details for them. Your questionnaire answers go to your officiant and, if they ask for a draft, to our AI provider, Anthropic, for a first draft only your officiant sees and approves; they are never used to train AI models. If you pay through a RiteBinder page, Stripe gets your email to pre-fill the form and send a receipt, and your card or bank details go only to Stripe. When you sign, we record your typed name, email, the time, and your IP address as your officiant's evidence. Email you receive comes from your officiant, through us. To see, correct, or delete your information, contact your officiant, or email us and we'll help.

5. Where your data lives

Data is stored with Supabase (PostgreSQL and file storage) in the United States, encrypted in transit (TLS) and at rest. Row-level security limits access to your practice, and client pages read only what their link allows. The website and those pages are hosted on Fly.io in the US.

6. How long we keep it

• While your account is active, we keep your content.
• If you delete your account (Settings → Delete account) as the practice owner, a 7-day grace window starts; sign in before it ends to restore everything. Client portals, questionnaire links, and agreement pages stop working immediately. After the window, your content is permanently deleted, except minimal records kept for legal, tax, or security reasons.
• What those minimal records are. Besides invoices, four kinds of record outlive a purge, none of them practice content: a hard bounce or spam complaint from an email address on our shared sending domain, so we do not resume mailing it; a waitlist sign-up and its consent date, our evidence the mailing was asked for; the IDs of Stripe payment notifications, so a redelivery is not counted twice; and any payment notification we could not match to a ceremony, kept open so arrived money is investigated. The last two hold Stripe IDs, amounts, and timestamps, with no card data or ceremony content.
• If you were invited to someone else's practice, deleting your account removes your access immediately; the practice's records stay with the owner.
• Backups age out on a rolling schedule of no more than 30 additional days.

7. Your rights and choices

• Access & portability: on any plan, export ceremony documents anytime (script PDF, large-type podium PDF, cue cards, rehearsal agenda, booking confirmation, Word .docx), or download all your account data (clients, ceremonies, scripts and versions, questionnaires, agreements, library, license tasks, and money records) as JSON from the app. Or email us and we'll assemble it.
• Correction: edit it in the app.
• Deletion: Settings → Delete account, or email us to do it for you.
• Marketing opt-out: every non-transactional email has an unsubscribe link; the weekly digest has its own toggle.
• State privacy rights: depending on where you live (for example, California, Colorado, Virginia, or Florida), you may have rights to access, delete, correct, or get a copy of your personal information, and to non-discrimination for using them. We honor these requests for everyone. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.

To use any right, email [email protected]. We verify requests through your account email and respond within the legal deadline (generally 45 days). If we decline, you may appeal by replying, and we will respond within 45 days. You may use an authorized agent with proof of authorization.

For client information you enter or collect, we are your service provider (processor): we use it only on your instructions, to provide the service. A data processing addendum is available on request.

8. Service providers (subprocessors)

Each provider handles data only as needed to serve us, and is bound by contract to protect it to the standard of this policy.

9. Children

RiteBinder is a business tool for adults; accounts require you to be 18+. We do not collect information from children directly, and the service is not directed at them. A child's name in a ceremony is content you entered, under your responsibility. If you believe a child has given us information, contact us and we will delete it.

10. Security

Row-level security on every table, TLS, encryption at rest, scoped credentials, revocable client links with constant-time misses, server-side scope filtering, and no card data in our systems. No system is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

11. Changes

We'll post changes here and update the date above. For material changes, we'll notify you in the app or by email before they take effect.

12. Contact

[email protected]