Legal

Privacy Policy

Last updated: May 22, 2026

The honest version: RFF runs on data about your endpoints - hardware specs, installed software, who's logged in, what jobs ran. We collect what's needed to run the product for you, store it in a small set of well-known infrastructure providers, never sell it, and delete it when you tell us to. Below is the full breakdown.

1. Who we are

Vitko Software, LLC (the company behind RFF), California, USA. Reach the data controller - also a guy named Brian - at brian@getrff.com or privacy@getrff.com.

2. What we collect

Account data (you give us)

Email - for login + service emails.
Display name + company name - for the UI and invoices.
Password - stored as a bcrypt hash, not plaintext. We can't see it; if you forget it you reset, you don't recover.
Payment method - handled by Stripe. RFF never sees your full card number; we see last 4 digits + the Stripe customer ID.

Endpoint data (the agent collects)

When you install the RFF agent on a Windows machine and run inventory, it collects the list below. On a Mac or Linux machine it collects the same kinds of data from that OS's own sources (the installed apps or package database, launchd or systemd, local accounts), and its security posture is FileVault, SIP, Gatekeeper and the firewall on a Mac, or the firewall, AppArmor or SELinux, disk encryption (LUKS) and automatic updates on Linux.

Hostname, FQDN, OS caption + version + build, system architecture, uptime, manufacturer / model / serial / chassis type, virtual-machine status.
CPU, RAM, GPU, disk drives + free space, motherboard, BIOS, TPM, Secure Boot state.
Network adapters (name, MAC, IPv4 / IPv6 - non-loopback only).
Installed software list (from the Uninstall registry hive - name, version, publisher).
Logged-on user identity (account, profile path, local group memberships).
Domain membership, role, distinguished name (when joined).
Security posture: BitLocker, Defender, firewall, pending Windows updates.
Active Directory user attributes (display name, email, department, title, city, manager) - only when a tenant admin explicitly enables "AD lookup" in Settings (opt-in, default off).

We also store the audit log of actions performed on your tenant (who deployed what, when, from which IP). Job logs (the stdout/stderr of scripts you ran) live in the database for 90 days then rotate out.

What we don't collect

File contents from your endpoints. The agent inspects installed-software metadata, not what's inside user files / documents / email.
Keystrokes, screenshots, screen recordings. RFF isn't surveillance software.
Browser history, browsing behavior, or anything from web browsers running on the endpoint.
Any marketing or analytics tracking inside the product. app.getrff.com runs no ad pixels, no analytics scripts and no cross-site tracking cookies - nothing you do while signed in is shared with an advertiser. The public marketing site is a separate matter and we describe it honestly just below.

Tracking on this marketing site

This site (getrff.com) currently loads the Reddit advertising pixel. We run ads on Reddit, and the pixel is how we tell whether a click turned into someone actually looking at the product. It records a page view, and a click on the "Try the demo" or "Sign up" buttons, and it can set cookies from Reddit's domain. It is a third-party ad script, and we would rather say so plainly than hide it in a paragraph about cookies.

What it does not do: it is not present on app.getrff.com, so it never sees your fleet, your jobs, your endpoints, or anything else inside your tenant. The line between "we advertise on the public website" and "we track you inside the product" is one we intend to keep.

If you would rather not be measured at all, any tracker blocker stops it, and nothing on this site breaks when you block it.

3. Where it lives

Your data is stored in the following infrastructure, all in the United States:

Postgres database hosted by Render (Oregon region). Encrypted at rest.
File / package storage on Cloudflare R2. Files you upload (MSIs, EXEs, .ps1 scripts) live here.
Nightly database backups to a separate R2 bucket. 90-day retention. Backups are SQL dumps of the database; same encryption.
Application logs (request logs, error traces) in Render's log retention. Auto-rotated.

4. Who we share with

RFF uses a small set of subprocessors to operate. We don't share your data with anyone else. We don't sell it. We don't trade it. We don't license it to data brokers.

Current subprocessors:

Stripe - payment processing. Receives your email, name, and card data (we don't see the card).
Render - hosts the API and Postgres database.
Cloudflare R2 - hosts file uploads and database backups.
Resend - transactional email delivery (login resets, billing notices, invite emails).
Sectigo - code-signing certificate authority for the Windows and Linux agent binaries. They sign metadata about the binary; they don't see your data.

If we ever add a new subprocessor or change one materially, we'll update this page and (for material changes) email you with at least 30 days' notice.

5. AD lookup - extra detail

Active Directory user-attribute lookup is opt-in per tenant. When disabled (the default), the agent never queries AD. When enabled by a tenant admin in Settings, the agent - running as SYSTEM on a domain-joined endpoint - uses the computer account's credentials to read the following attributes for the primary logged-on user: displayName, mail, department, title, physicalDeliveryOfficeName (city), company, manager (resolved to manager's displayName).

We collect the minimum useful attributes for help-desk workflows. We do not read memberOf (group memberships), groupMembership, or any other attributes beyond the list above. The opt-in is logged in the audit trail.

6. Your rights

Access - see what we have about you and your tenant. Most of it is in the app already. Email us for a full JSON export.
Correction - wrong data? Email us, we'll fix it.
Deletion - delete your account and we'll purge your tenant data from active systems within 7 days. Encrypted backups retain it for up to 90 days before rotation.
Portability - JSON export on request.
Objection / restriction - tell us if you don't want a specific kind of processing; we'll work with you.

Send requests to privacy@getrff.com. We'll respond within 30 days, usually much faster.

7. California residents (CCPA)

You have the right to know what we collect, request deletion, and not be discriminated against for exercising those rights. We don't sell personal information (under CCPA's definition or anyone else's), so there's no opt-out-of-sale step.

8. Cookies

getrff.com (the marketing site) sets no cookies beyond essential ones required for the site to function. app.getrff.com (the product) sets:

A first-party authentication cookie / token to keep you logged in.
A theme preference (light vs dark mode) in localStorage.

Neither is shared with third parties. No ad cookies, no cross-site tracking, no consent banner needed because we don't collect anything that requires consent.

9. Children

RFF is a B2B tool for IT administrators. It's not designed for or marketed to anyone under 18. If we learn we've inadvertently collected data from a minor, we'll delete it.

10. International users

RFF's infrastructure is in the United States. If you use RFF from outside the US, your data is being transferred to and stored in the US. By using RFF you consent to that transfer. We don't have a formal EU Data Processing Addendum (DPA) yet - if you need one to use RFF in an EU context, email us and we'll work it out.

11. Changes to this policy

We'll update this policy as RFF evolves. Material changes - new subprocessors, new categories of data collection, change in how we share - will be emailed to you with at least 30 days' notice. Minor edits we'll just push and bump the "last updated" date at the top.

12. Questions

privacy@getrff.com for privacy-specific stuff, or brian@getrff.com for anything else. A person replies, usually within a business day.