Privacy policy

1. Scope

This policy describes how R-Owl, Inc. (“R-Owl”, “we”) handles personal information when you visit r-owl.example.com, create an account, post or respond to engagements, or communicate with us. It applies to clients, consultants, and visitors.

Where an engagement involves protected health information, the handling of that information is governed by a Business Associate Agreement between the parties and not by this policy. R-Owl does not require, and asks you not to upload, protected health information to the platform.

2. Data we collect

We collect information you provide directly, information generated by your use of the platform, and information from third parties used in verification.

• Account and profile data: name, work email, phone, title, organization, location, professional history, certifications, portfolio, and rates.
• Verification data: government identification, liveness capture, employment references, certification records, and sanctions and exclusion screening results. Identification images are deleted within 30 days of a verification decision.
• Engagement data: job briefs, proposals, contracts, milestones, deliverables, messages, reviews, and dispute records.
• Payment data: billing address, tax identifiers, and tokenized payment method references. Card and bank numbers are held by our payment processor, not by R-Owl.
• Usage data: log data, device and browser information, pages viewed, and actions taken, collected through first-party analytics and essential cookies.

3. How we use it

We use personal information to operate the marketplace, which includes:

• Creating and securing accounts, including two-factor authentication and session management.
• Verifying consultant identity, experience, and eligibility, and re-running sanctions screening every 90 days.
• Matching briefs to consultants using a deterministic scoring model whose reasons are shown to clients.
• Processing contracts, escrow funding, payouts, invoices, and tax reporting.
• Resolving disputes, investigating policy violations, and preventing fraud.
• Sending transactional notifications. Marketing email is sent only with consent and can be withdrawn at any time.
• Producing aggregated, de-identified statistics about marketplace activity.

We do not sell personal information and do not use engagement content to train machine learning models.

4. Sharing

We share personal information only as needed to run the platform:

• Between counterparties: a client sees a consultant’s public profile, proposal, and verification status; a consultant sees the client organization and the named contacts on an engagement.
• Service providers: identity verification, payment processing, cloud hosting, e-signature, and email delivery vendors under written data processing terms.
• Legal and safety: when required by law, to enforce our terms, or to protect the rights and safety of users.
• Corporate transactions: in a merger, acquisition, or asset sale, subject to this policy continuing to apply.

5. Retention

We retain account data for as long as the account is active and for seven years afterwards where required for contract, tax, and dispute purposes. Verification source documents are deleted within 30 days of a decision; the decision record and reviewer notes are retained for the life of the account. Usage logs are retained for 18 months.

You may request deletion earlier; see Your rights. Records we are legally required to keep are retained in a restricted archive until the retention period ends.

6. Security

Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production systems requires hardware-backed two-factor authentication and is scoped by role and logged. We conduct annual third-party penetration tests and maintain a coordinated vulnerability disclosure process at security@r-owl.example.com.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and the relevant regulators within the timelines required by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete personal information we hold about you, and to object to certain processing. You can exercise most of these from Settings in your account. For anything else, contact us using the details below; we respond within 30 days and will verify your identity before acting.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your supervisory authority. Residents of California and other US states with comprehensive privacy laws may designate an authorized agent to submit requests on their behalf.

8. Contact for privacy

Privacy questions and requests can be sent to privacy@r-owl.example.com or by mail to R-Owl, Inc., Attn: Privacy, One Prudential Plaza, Suite 2400, Chicago, IL 60601.

We may update this policy from time to time. Material changes will be announced by email and in the product at least 30 days before they take effect. The effective date at the top of this page shows the current version. See also our terms of service.