Privacy Policy

Rail ("Rail," "we," "us") provides a customer relationship management platform for payments and POS sales teams, available at railcrm.com and app.railcrm.com (together, the "Service"). This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information. When you sign up we collect your name, email address, company name, and a password (stored only as a salted cryptographic hash — we cannot read it).
• Customer data you enter. The Service exists to store your team's sales data: leads, merchant business names, contact names, phone numbers, emails, addresses, notes, appointments, quotes, and related records. This data belongs to your organization; we store and process it only to provide the Service.
• Billing information. Paid subscriptions are processed by Square. Your card details are collected and stored by Square, not by us — we receive only a customer reference, subscription status, and plan details. See Square's privacy policy for how they handle payment data.
• Optional integrations. If you connect an email account (e.g., a Gmail or Outlook app password) to send email from the Service, those credentials are stored encrypted and used solely to send messages you compose.
• Usage and log data. Like most services, our hosting provider records standard server logs (IP address, browser type, pages requested) for security and reliability.

Cookies

The app uses a single, essential session cookie so you stay signed in. We do not use advertising cookies or third-party tracking cookies.

How we use information

• To provide, maintain, secure, and improve the Service.
• To process subscription payments and manage trials.
• To send service communications (e.g., appointment reminders and notifications you enable, receipts, important account notices).
• To respond to support requests.

We do not sell your personal information, and we do not sell or share the customer data you store in the Service with third parties for their own marketing.

How we share information

We share data only with service providers needed to run the Service — hosting and storage (Vercel), payment processing (Square), and email delivery — each bound to use it only on our behalf. We may also disclose information if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to previously collected data).

Security

Organization data is stored encrypted at rest (AES-256-GCM), transmitted over HTTPS, and isolated per organization. Passwords are hashed with scrypt. No method of storage or transmission is 100% secure, but we work to protect your data with industry-standard measures.

Data retention and deletion

We retain your organization's data while your account is active. If you cancel, you may request export or deletion of your organization's data by contacting us; we will delete it within a commercially reasonable period, except where retention is required by law.

Your rights

Depending on where you live (including under the Texas Data Privacy and Security Act and the California Consumer Privacy Act), you may have rights to access, correct, delete, or export your personal information. To exercise any of these rights, email us at the address below — we will respond within the time required by applicable law.

Children

The Service is for business use and is not directed to anyone under 16. We do not knowingly collect information from children.

Changes to this policy

If we make material changes, we will update the effective date above and notify account owners by email or in-app notice before the changes take effect.

Contact

Questions or requests: travis@railcrm.com. Rail is operated from Texas, United States.