Privacy Policy — Rekiva
Last updated: 2026-10-20 · Operated by Connealy Koll LLC
Rekiva ("we", "us") helps contractors track subcontractor paperwork (W-9, General Liability, Workers' Comp), payments, and projects. This policy explains what we collect, how we use it, who we share it with, and what we do if something goes wrong.
What we collect
- Account info: your email address, a password hash (if you sign up with email), your business name, and the date and version of the Terms you accepted. If you choose Sign in with Google, we receive your Google account's basic profile (name, email address, and a stable account identifier) solely to create and secure your account.
- Your business data: the contacts, agreements, projects, paperwork statuses and dates, and payment records you enter into Rekiva, plus a log of the emails you send through Rekiva (who it went to, the subject, and whether it was delivered) and of documents you share (the recipient's email address).
- Information about the people you work with: contact records you create can include a subcontractor's or customer's business name, contact person, email address, phone number, address, trade, and your notes. See "Information about your subcontractors and contacts" below.
- Your business logo (optional): if you upload a logo, we store that image on our servers (in our database) so we can show it in the app. We re-encode it, which strips hidden metadata such as location. It is the only uploaded file we store.
- Documents in YOUR Google Drive (optional): if you connect Google Drive, Rekiva files documents (W-9s, insurance certificates and the like) into folders in your own Drive and stores only the resulting file ID, name, link, status and dates in our database. Document files are never uploaded to or stored on our servers.
- Notification settings: if you turn on notifications, your browser gives us a push subscription (an endpoint address and encryption keys) so we can send reminders to that device. Turning notifications off or deleting your account removes it.
- Language preference: the language you choose (English or Spanish), saved on your account and in a small cookie on your device.
- Cookies: a signed session cookie that keeps you signed in, the language cookie above, short-lived security cookies during Google sign-in / Drive connection, and, if you try the demo, a random demo-visitor cookie. We don't use advertising or tracking cookies.
- Technical logs: like most websites, our hosting provider records basic request logs (such as IP address, time, and page requested) that we use for security and troubleshooting.
- Visit counts: to see how people find Rekiva, we count page views ourselves (no third-party tracker and no cookie): the page, the time, whether you were signed in, and an approximate location (country and, in the US, state) worked out from your IP address on our own server using an offline database. We do not store your IP address or anything else that identifies you with these counts.
How we use Google user data (Limited Use)
Rekiva requests only the drive.file scope, which grants access exclusively to files the
app itself creates in your Drive — never to the rest of your Drive. We use Google sign-in data
only to authenticate you, and Drive access only to store, organize, copy, and share the documents
you handle through Rekiva.
Rekiva's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:
- sell Google user data, or use it for advertising;
- transfer or use it for any purpose other than providing and improving Rekiva's features;
- allow humans to read your Google data, except (a) with your explicit consent, (b) as needed for security or to comply with law, or (c) when the data is aggregated and anonymized for internal operations.
Emailing your subcontractors on your behalf
When you send a "request missing documents" email or a payment reminder from Rekiva, we deliver that message to the subcontractor's email address that you entered, on your behalf, through our email provider (see Sub-processors). These emails are sent only to the specific contacts you choose, only when you choose to send them, and the reply-to address is your own email so the subcontractor's response goes directly to you, not to us. We do not email your contacts for our own marketing, and we do not add them to any mailing list.
Information about your subcontractors and contacts
Rekiva's users (contractors) decide which people they track and what they record about them — names, emails, phone numbers, addresses, and paperwork status. The contractor controls those records; we store and process them on the contractor's behalf, only to run the Service for that contractor. We never use them for our own marketing, and we never sell them.
If you've received an email sent through Rekiva and want to stop receiving them or want your information removed, you can: (1) reply to the email and ask the business that sent it — replies go straight to them; or (2) write to support@rekiva.app with the email address involved and the name of the business that contacted you, and we'll pass your request to that business and help make sure it's handled. Every email sent through Rekiva names the business that sent it.
Sharing documents (copy-and-share)
When you share a document (for example, forwarding a certificate of insurance you received) with a
named recipient, Rekiva makes a copy in your own Google Drive and grants that specific
person read access to that copy by their email address (a Google type=user, role=reader
permission). Google then sends its own access invitation to that recipient. We never make a
document public or shareable-to-anyone-with-the-link. You can revoke a recipient's access from
within Rekiva, which removes that permission from the copy in your Drive. Our records store only
that a grant was made (the recipient's email and the permission reference) — not whether the
recipient opened or downloaded the file.
Sub-processors
We rely on a small number of third-party service providers ("sub-processors") to operate Rekiva. They process your data only to provide their service to us, under their own security and privacy commitments:
- Railway (railway.app) — application hosting and our PostgreSQL database (your account and business records).
- Resend (resend.com) — delivery of the transactional emails described above (document requests, payment reminders, account/security emails such as email verification and password reset).
- Google LLC — "Sign in with Google" authentication (if you use it) and, if you connect it, Google Drive storage of your documents in your own account.
- Stripe (stripe.com) — payment processing for paid subscriptions, once billing is turned on (it isn't yet). Stripe collects your card details directly; we never see or store your card number. We keep only your Stripe customer and subscription IDs and subscription status.
- Sentry (sentry.io) — error monitoring, if enabled. It receives technical error reports; we strip request bodies, cookies, and user identity from them before they're sent.
- Your browser's push service (for example Apple, Google or Mozilla) — delivers the notifications you turn on. Notification contents are encrypted end to end so the push service can't read them.
We don't use third-party analytics or advertising services.
We do not sell your data, and we do not share it with anyone other than the sub-processors above except as required to operate the service or to comply with law.
Retention & deletion
We keep your records, including archived ones, for as long as your account exists, so your history and reports stay complete. Archiving a contact hides it; it doesn't delete it.
You can delete your entire account at any time in Settings → Delete account. That permanently deletes your account and all of its records — contacts (including archived ones), agreements, payments, paperwork statuses, document links, email and sharing logs, notification subscriptions, and your logo — from our live database right away. Deleted data is purged from our backups within 30 days. We also disconnect Google Drive and delete our stored access to it. Files already in your own Google Drive stay in your Drive under your control (including copies you shared, which their recipients can keep seeing until you remove their access in Google Drive), and you can review Google access at any time at myaccount.google.com/permissions.
Security
Passwords are hashed (bcrypt). Sessions use signed, http-only cookies and can be revoked. Data is transmitted over HTTPS. Document files (W-9s, insurance certificates) never touch our servers — they live in your Google Drive; your business logo is the only image we store. We never store tax identification numbers, and we keep document contents and account numbers out of our application logs.
Data breach commitment
We maintain an internal incident-response process. If we become aware of a security breach that compromises your personal information, we will investigate promptly, take steps to contain and remediate it, and notify affected users and any applicable authorities without undue delay and in accordance with applicable law (for breaches affecting residents of jurisdictions with statutory deadlines, within the time those laws require). Our notice will describe, to the extent known, what happened, what information was involved, and what you and we can do in response.
Your rights
You can access, correct, export, or delete your information. Most of this you can do yourself in the app (edit any record, export reports as CSV or PDF, or delete your account in Settings). For anything else, email support@rekiva.app from your account's email address; we'll respond within 30 days. Depending on where you live, you may have additional rights under local law, and we'll honor them.
Do Not Track
Some browsers send a "Do Not Track" signal. Because Rekiva doesn't track you across other websites and doesn't use advertising or analytics trackers, there is no cross-site tracking for the signal to switch off; we treat every visitor the same whether or not it's sent.
Children
Rekiva is a business tool for adults (18+). We don't knowingly collect information from children.
Changes
We may update this policy as Rekiva evolves. If we make a material change, we'll email you at your account address before it takes effect, and we'll update the "Last updated" date above.
Language
This policy is written in English. If we provide a translation, the English version controls.
Contact
Questions or data requests: support@rekiva.app