How Ruproa Protects Your Business Credit Data and Policy

Introduction

Forthwith Industry LLC d/b/a Ruproa (“Ruproa,” “we,” “us”) is committed to protecting the privacy of our users and their business information. This Privacy Policy (“Policy”) describes how we collect, use, disclose, and protect information obtained through our website (ruproa.com), our web application, any mobile applications, and other communications (collectively, the “Services”).

Please review this Policy carefully. By using the Services, you agree to the collection and use of information as described here. You can determine when this Policy was last revised by referring to the “Last Revised” date above. We will post updates to this Policy on the Services; material changes will be communicated by email or in-platform notice.

Questions? Contact us at service@ruproa.com.

1. What Information We Collect

Notice at Collection

A summary of what we collect, why, and how long we keep it. The rest of this section has the detail.

• Identifiers (name, email address, phone number, mailing address, account identifier) — to create and run your account, provide support, and send account and billing messages. Kept for the life of your account, and afterwards only where the law requires
• Business information (legal business name, state of formation, EIN, business address) — to retrieve and report business credit data with your authorization. Kept for the life of your account, and in the bureaus’ own records once reported
• Commercial information (plans, purchases, invoices) — to take payment, prevent fraud, and keep financial records. Kept for the life of your account, and payment records for as long as the law requires
• Internet and device activity (pages viewed, referring site, campaign parameters, approximate location, a shortened IP address, browser and device type) — to measure how the Services are used and how our advertising performs. Individual records are kept 13 months, then reduced to monthly totals
• Sensitive personal information — we do not collect Social Security Numbers, and we do not use sensitive personal information to infer characteristics about you

We do not sell personal information for money. We do share internet and device activity with Google and Meta to measure advertising, which California law calls “sharing.” You can stop that at any time with Your privacy choices in the footer of any page; see Section 10.

Information You Provide

When you create an account, enroll in a Service, or interact with Ruproa, we may collect:

• Your name, email address, phone number, and mailing address
• Business entity information, including legal business name, state of formation, EIN (Employer Identification Number), and business address
• Payment information (credit/debit card number, billing address), processed and stored by our payment processor, Stripe; Ruproa does not store raw card data
• Account credentials (username and password)
• Customer support correspondence and general feedback
• Any other information you voluntarily provide when completing forms or using platform features

Business Credit Information

With your authorization, Ruproa retrieves business credit data from the major business credit bureaus we are integrated with on behalf of your registered business entity, including Creditsafe and Equifax Business. This data includes business credit scores, tradeline information, payment history, public records, and related business financial data. This information is used solely to provide the Services you have requested and is associated with your business entity, not your personal consumer credit file.

Ruproa does not collect or require your Social Security Number (SSN).

Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

• Log Data: IP address, browser type and version, operating system, referring URLs, pages viewed, and time spent on the platform
• Device Information: Device type, screen resolution, MAC address, and language preferences
• Cookies and Tracking Technologies: We use cookies, pixel tags, web beacons, and similar technologies to recognize your browser, remember preferences, analyze usage patterns, and support marketing and advertising activities (described further below)
• Analytics: We use analytics providers such as Google Analytics to track and report on platform usage. You may opt out of Google Analytics data collection at tools.google.com/dlpage/gaoptout
• First-Party Analytics: We keep our own record of how the Services are used, using three cookies set by Ruproa: rp_vid, which recognizes a returning browser for up to 13 months; rp_sid, which groups the pages of one visit and expires after 30 minutes of inactivity; and rp_consent, which remembers your cookie choice for 12 months. Each record includes the page viewed, the referring website, campaign details in the link you followed (such as UTM parameters and ad click identifiers), your approximate location (country, region and city) derived from your IP address, a shortened form of your IP address, browser and device type, screen size, language, time zone and, if you are signed in, your account. It also records actions such as submitting the contact form, creating an account and starting checkout. We do not store your full IP address, what you type into forms, or the rest of the page address.

You may configure your browser to decline cookies; however, some features of the Services may not function properly without them. We honor Global Privacy Control signals as described in Section 6, but we do not respond to other “Do Not Track” browser signals.

2. How We Use Your Information

We and our service providers may use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and improve the Ruproa platform, including business credit monitoring, score updates, tradeline reporting, and marketplace access
• Account Management: To create and manage your account, process payments, and communicate billing information
• Credit Bureau Reporting: To report tradeline data associated with your Ruproa subscription to the major business credit bureaus we are integrated with, including Creditsafe, Equifax Business and Moody’s
• Communications: To send transactional emails (receipts, score alerts, bureau notifications, account updates) and, with your consent, marketing communications about new features, offers, and related products
• Personalization: To present offers, content, and financial service matches relevant to your business profile
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorized access, or violations of this Policy and our Terms of Service
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests
• Analytics & Improvement: To analyze usage trends, conduct research, and improve the functionality, design, and performance of the Services
• Aggregated Insights: To create aggregated, de-identified data that does not personally identify you, which we may use and disclose for any business purpose

3. How We Share Your Information

We may share your information with the following categories of recipients:

• Business Credit Bureaus: The major business credit bureaus we are integrated with: Creditsafe and Equifax Business, for the purpose of tradeline reporting and credit data retrieval as authorized by you, and Moody’s, for the purpose of tradeline reporting
• Service Providers: Third-party vendors who assist in operating the platform, including cloud hosting (Vercel, Supabase), payment processing (Stripe), email delivery (Resend, Brevo), customer support tools, and analytics providers. These providers are contractually required to protect your information and may not use it for their own commercial purposes
• Advertising Partners: Google (Google Analytics and Google Ads) and Meta, to measure how our advertising performs. When you submit the contact form, create an account, start checkout, or make a purchase, we may send that event to them directly from our servers, together with your IP address, browser type, the page where it happened, identifiers from their advertising cookies, your Ruproa account identifier and, where available, a hashed (one-way encoded) version of your email address. Google and Meta process this information under their own terms and privacy policies. You can opt out as described in Section 6.
• Marketplace Partners: Third-party financial service providers featured in the Ruproa marketplace, with your consent or at your direction when you engage with an offer or apply for a product
• Affiliates: Our affiliated entities, for the purposes described in this Policy
• Business Transfers: In connection with a merger, acquisition, sale of assets, or other corporate transaction, your information may be transferred as part of the business. We will notify you before such a transfer if required by applicable law
• Legal & Compliance: To comply with legal process, respond to governmental requests, enforce our Terms of Service, or protect the rights, privacy, safety, or property of Ruproa, its users, or others

We do not sell your personal information to third parties for their own independent marketing purposes. Mobile information gathered through SMS opt-in will not be shared or sold to third parties for promotional purposes.

4. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include secure HTTPS connections, encrypted data storage, and access controls limiting employee access to customer data.

Ruproa's payment processing is handled entirely by Stripe. We do not store, transmit, or have access to raw credit card data. Our PCI-DSS obligations are limited to SAQ A compliance.

No data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you believe your account has been compromised, please contact us immediately at service@ruproa.com.

5. Data Retention

We retain your personal and business information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When you close your account, we may retain certain information as required by law or for legitimate business purposes such as fraud prevention and legal defense. Upon request, we will delete or anonymize personal information that we are not required to retain by law.

First-party analytics records, described in Section 1, are kept for 13 months. After that they are reduced to monthly totals that do not identify any browser or person, and the individual records are deleted.

6. Your Choices & Rights

Marketing Communications

You may unsubscribe from Ruproa marketing emails at any time by clicking the “Unsubscribe” link in any marketing email or by contacting service@ruproa.com. You may not opt out of transactional and account-related communications (such as billing notices, score alerts, and security notifications) while your account is active.

Account Information

You may review and update your personal and business information at any time through your account settings at ruproa.com/settings. For corrections that cannot be made through self-service, contact service@ruproa.com. We may require identity verification before making certain changes.

Cookies

A notice appears the first time you visit ruproa.com. Analytics and advertising measurement are on by default until you turn them off there, or later with Your privacy choices in the footer of any page. Turning measurement off stops our first-party analytics, deletes the rp_vid and rp_sid cookies, instructs the Google and Meta tags on our website not to use cookies for analytics or advertising, and stops the website events we send to Google and Meta from our servers. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sharing for advertising unless you choose otherwise in Your privacy choices. If you are signed in when you turn measurement off, we record that choice on your account, so purchases reported to Google and Meta later from our payment records are not shared either. If you were signed out at the time, email service@ruproa.com with the subject line “Advertising Opt-Out” and we will apply it to your account.

You may configure your browser to reject cookies or to alert you when cookies are being set. Opting out of certain cookies may affect platform functionality. You may also opt out of interest-based advertising at optout.aboutads.info and optout.networkadvertising.org.

Account Deletion

To request deletion of your account and associated personal data, contact service@ruproa.com. We will process deletion requests within a reasonable time, subject to any retention obligations under applicable law.

7. Third-Party Links & Services

The Services may contain links to third-party websites, tools, or marketplace partners. This Policy does not apply to third-party websites, and Ruproa is not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party sites you visit. When you engage with a marketplace partner or click through to an external offer, your interaction is governed by that third party's terms and privacy policy.

8. Third-Party Advertising

We may use third-party advertising technologies to serve advertisements relevant to your business interests when you access the Services or other websites. These companies may use cookies and similar technologies to collect information about your visits to our Services and elsewhere online in order to deliver relevant ads. To learn more or opt out of interest-based advertising, visit optout.aboutads.info or optout.networkadvertising.org.

We use Google and Meta advertising tags on our website, and we also send certain events to Google and Meta directly from our servers, as described in Section 3. Because server-side events do not pass through your browser, browser extensions and browser cookie settings do not block them. Your cookie choice and Global Privacy Control signals do, except for purchase reporting, as described in Section 6.

9. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at service@ruproa.com and we will take steps to delete it promptly.

10. California Residents

California residents have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”). We offer the same choices to everyone who uses the Services, because we cannot always tell where a visitor is.

Your rights

• Know and access: the categories and specific pieces of personal information we have collected, where it came from, why we collected it, and who received it
• Delete: personal information we hold about you, except where we must keep it to complete a transaction, for security, or to meet a legal obligation
• Correct: personal information that is inaccurate
• Opt out of sale or sharing: we do not sell personal information for money. We do share website activity with Google and Meta to measure advertising, which the CCPA treats as “sharing” for cross-context behavioral advertising, and you can stop it at any time
• Limit the use of sensitive personal information: we do not use sensitive personal information to infer characteristics about you, and we do not collect Social Security Numbers, so there is nothing here to limit
• Non-discrimination: using any of these rights does not change your price, your plan, or the Services you receive

How to use them

• Opt out of sharing: select Your privacy choices in the footer of any page. No account is needed. If you are signed in, we record the opt-out on your account, so it also covers purchases reported to Google and Meta later from our payment records
• Global Privacy Control: we treat a GPC signal from your browser as a valid opt-out of sharing, automatically. If you are signed in when it reaches us, we apply it to your account as well
• Know, delete or correct: email service@ruproa.com with the subject line “California Privacy Request.” We confirm receipt within 10 business days and respond within 45 days. If a request is complex we may take one further 45 days, and we will tell you before we do
• Verification: we verify requests against the account details we already hold, and may ask for more information before releasing specific pieces of personal information
• Authorized agents: an agent may submit a request for you with your written permission, and we may still confirm the request with you directly

What goes to advertising partners. Identifiers (advertising cookie identifiers, and a hashed email address or account identifier when you are signed in) and internet activity (the page an event happened on, campaign parameters, IP address, browser type) go to Google and Meta so we can measure which advertising works. Your credit reports, your business credit data and anything you type into a form are never part of it.

11. Jurisdiction & Cross-Border Transfers

Ruproa is operated from the United States. By using the Services, you consent to the transfer and processing of your information in the United States, which may have different data protection laws than your country of residence. The Services are intended for U.S.-based business entities only.

12. Contacting Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Please note that email communications are not fully secure; do not include sensitive financial information in general correspondence.

© 2026 Forthwith Industry LLC d/b/a Ruproa. All rights reserved.