Skip to content
RapidXM Book a walkthrough

Privacy Policy

Last updated: October 13, 2026

This policy explains how Pixametrics LLC, which operates RapidXM ("RapidXM", "we", "us"), handles personal information on www.rapidxm.com (the "Site") and in the RapidXM console at console.rapidxm.com, including its MCP endpoints, APIs and built-in assistant (the "Console"). Together these are the "Services".

Two roles, explained plainly

  • When you visit our Site or use the Console as a customer, we decide how your information is used. This policy covers that.

  • When someone uses a website one of our customers runs on RapidXM (for example by submitting a form, chatting with its support assistant, or asking about the business through an AI agent), that business decides how the information is used, and its own privacy policy applies. We process that information only on the business's behalf and instructions, as its service provider. If you have a question about one of those sites, contact that business first. We will help them respond.

What we collect

On the Site

  • Walkthrough requests: your name, email, website address, and optionally your phone number and a message.

  • Emails you send us, and our replies.

  • Support chat: the questions you ask, the answers given, the page you started on, and your approximate country (from your IP address).

  • Site audits: results of automated checks on the public website you give us. We do not access anything that is not public.

  • Technical and usage data: IP address, browser and device type, pages viewed, referring page, and conversion events (such as submitting the form). Where this relies on cookies, it is collected only as your consent choices allow.

  • Spam protection: forms and chat use Cloudflare Turnstile, which assesses browser signals to tell people from bots.

In the Console

  • Account details: name, email, organisation, role and permissions. Sign-in is handled by Cloudflare Access, which passes us your verified email address and sign-in records.

  • Billing details: billing contact, address, subscription and payment history. Payments are processed by Stripe. Stripe collects your card details directly, and we never see or store your full card number.

  • Your content: pages, posts, images, brand settings, product listings, knowledge base entries, and the instructions you give the assistant.

  • Connection credentials: Cloudflare account details and API tokens, integration settings (such as Stripe or Shopify), webhook addresses, MCP API keys, and any AI provider API key you supply. These are stored encrypted.

  • Usage and logs: actions taken in the Console and through MCP or the API, assistant usage against your allowance, deploy history, errors and security events.

Data we hold for our customers

For the websites our customers run on RapidXM, we process the following on their behalf:

  • Form submissions, stored in a database in the Cloudflare account the site deploys to, and forwarded to any webhook the customer sets up.

  • Support chat transcripts, with the page each conversation started on and the visitor's approximate country.

  • Questions AI agents ask about the business through the site's MCP or API, with the agent's user-agent string.

  • Conversion events, such as calls, form submissions and bookings.

How we use it

  • To respond to walkthrough requests, run the audit you asked for and arrange a call. As the form says: no list, no newsletter. We only contact you about your site.

  • To provide the Console: build, preview and deploy sites, run the assistant and support chat, store and route form submissions, and report on conversions.

  • To send Console users service emails (such as security, billing and account notices) and occasional product updates from mail.rapidxm.com. You can opt out of product updates at any time by contacting us. Service emails are part of the Services.

  • To bill you and manage your account.

  • To keep the Services secure, rate-limit abuse, prevent fraud and fix problems.

  • To understand how the Site and Console are used so we can improve them, using aggregated or de-identified data where we can.

  • To meet legal obligations and enforce our Terms of Service.

Where the GDPR or UK GDPR applies, our legal bases are:

  • performing our contract with you;

  • our legitimate interests in running, securing and improving the Services and in responding to enquiries;

  • your consent, for non-essential cookies; and

  • compliance with legal obligations.

AI processing

The assistant and support chat send the relevant prompt, conversation and content to an AI model provider to generate a response. Depending on configuration, that provider is Anthropic, OpenAI, Google (Gemini) or Cloudflare Workers AI. Requests may pass through Cloudflare AI Gateway. If you supply your own API key, requests for your projects go to the provider you chose, under your agreement with them. We do not use your content, or your visitors' conversations, to train AI models. We use providers whose API terms do not permit them to train on that data.

Google user data

If we offer, and you connect, Google products such as Search Console, Google Analytics or Google Ads through Google APIs, we will access only the data needed to show you search performance and to send or report the conversion events you set up. RapidXM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only with the following:

  • Service providers that run the Services for us under contract:

    • Cloudflare, for hosting, databases, file storage, sign-in (Access), email delivery, Turnstile and AI Gateway;

    • the AI model providers named above; and

    • Stripe, for subscription billing and payments.

  • Tools you connect. When you connect a webhook, CRM, Stripe, Shopify, a Google tag or an AI agent, we send it the data you have directed us to send.

  • Legal and safety: where required by law or legal process, or to protect the rights, property or safety of our customers, the public or us.

  • Business transfers: to a successor if RapidXM is merged, acquired or sells assets, subject to this policy.

Cookies and your privacy choices

The Site uses RapidXM's own consent manager. The cookies and similar storage it uses include:

  • rxm_consent, which remembers your consent choices;

  • rxm_chat, which keeps a support chat conversation going between pages;

  • rxm_form, used by forms; and

  • rxm_gpc_notice_shown, which remembers that you have seen the opt-out signal notice.

Consent and security storage is always on. The chat cookie is used only as your choices allow. Analytics and marketing tags run only according to your choices and the rules where you are. You can change your choices at any time with the Your Privacy Choices link in the footer. We honour Global Privacy Control: if your browser sends it, analytics and marketing are switched off and the Site confirms the signal was honoured.

The Console uses Cloudflare Access's sign-in cookie (CF_Authorization) and its own session and editor cookies. These are needed to sign you in and keep you signed in.

How long we keep it

  • Walkthrough requests and correspondence: up to 24 months after our last contact, unless you become a customer.

  • Account, content and customer data: for as long as your account is active. After that we keep it for 30 days so you can request an export, then delete it. Copies in backups are deleted within a further 90 days.

  • Billing records: as long as tax and accounting law requires.

  • Security and usage logs: for a limited period, generally no more than 12 months.

Security

We protect information in several ways:

  • encryption in transit;

  • Cloudflare Access in front of the Console;

  • role-based permissions;

  • encrypted storage of API keys and integration credentials; and

  • separation of each customer's data by project and organisation.

No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

Your rights

Depending on where you live, you may have the right to:

  • know what personal information we hold about you and get a copy;

  • correct it;

  • delete it;

  • object to or restrict certain uses, or withdraw consent;

  • receive it in a portable format; and

  • opt out of sale, sharing or targeted advertising. We do not do these things, but you can still use Your Privacy Choices or GPC.

Residents of California, Washington and other US states with privacy laws have these rights under those laws, and we will not treat you differently for using them.

To make a request, email [email protected]. We will verify your request, usually by confirming your email address, and respond within the time the law allows. You can use an authorised agent. If we decline a request, you can appeal by replying to our decision. If you are in the EU or UK, you can also complain to your data protection authority.

If your information was collected by one of our customers' websites, please send your request to that business. We will help them respond.

International transfers

We are based in the United States. Our providers, including Cloudflare's global network, may process information in other countries. Where the law requires, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Children

The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

Changes

We will update this policy as the Services change. If a change is material, we will notify customers by email or in the Console before it takes effect. The date at the top always shows the latest version.

Contact

Pixametrics LLC
[email protected]