Privacy Policy
Effective Date: January 1, 2023 | Last Updated: May 1, 2026
This Privacy Policy (this "Privacy Policy" or "Policy") describes how RUBY AND CITRINE LLC, a limited liability company organized and existing under the laws of the State of North Carolina, with its principal place of business at 201 Shannon Oaks Circle, Suite 102, Cary, NC 27511 ("Company," "R+C," "We," "Us," or "Our"), collects, uses, discloses, and otherwise processes Personal Data of individuals who visit, access, or use Our website located at www.rubyandcitrine.com and any related websites, subdomains, mobile applications, e-commerce platforms, social media properties, live chat services, and other digital properties operated by Company (collectively, the "Site" or "Service").
This Privacy Policy is incorporated by reference into, and forms an integral part of, Company’s Online Sales Terms and Conditions, Social Media Terms of Service, Consent and Release Agreement – Live Chat Recording, and any other Company terms, agreements, or policies that reference it. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the applicable agreement.
By accessing or using the Site or Service, or by submitting Personal Data to Company through any means, You (or "Your", referring to the individual data subject, including any User, Buyer, Member, visitor, contractor, partner, or recipient of Company’s communications) acknowledge that You have read, understood, and agree to the practices described in this Privacy Policy. If You do not agree, You must not access or use the Site or Service.
CONTENTS
- Definitions
- Scope and Application
- Categories of Personal Data We Collect
- How We Use Personal Data
- Legal Bases for Processing (GDPR)
- Sharing Personal Data with Others
- Live Chat Recording, Monitoring, and Automated/AI Processing
- E-Commerce and Buyer Information
- Social Media and User Content
- Referral Partners and Service Providers
- International Transfers of Personal Data
- Cookies and Similar Technologies
- Data Security
- Retention and Deletion of Personal Data
- Children’s Privacy
- Your Rights Under the GDPR
- Your Rights Under the California Consumer Privacy Act (CCPA/CPRA)
- Other U.S. State Privacy Rights
- Third-Party Sites and Services
- Do-Not-Track Signals
- Changes to This Privacy Policy
- Contacting Us
1. DEFINITIONS
Capitalized terms used in this Privacy Policy have the meanings set forth below. To the extent a term is defined in another Company agreement (including the Online Sales Terms and Conditions, Social Media Terms of Service, or Consent and Release Agreement – Live Chat Recording), the definition in this Privacy Policy is intended to be consistent with such agreements.
1.1 “Account” means a registered user account established with Company on the Site or Service.
1.2 “Buyer” means any natural person or entity who places an Order for Products through the Site, as further defined in the Online Sales Terms and Conditions.
1.3 “Chat Content” means all messages, text, files, attachments, images, documents, links, and any other content transmitted by a User during a Chat Session.
1.4 “Chat Session” means any live chat communication between a User and Company, including communications with Company’s personnel, automated systems, chatbots, or artificial intelligence systems, conducted through the Site or Service.
1.5 “Cookie Policy” means Company’s cookie policy, as amended from time to time, available on the Site, which is incorporated herein by reference.
1.6 “Data Controller” means the natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
1.7 “Data Processor” means a natural or legal person that processes Personal Data on behalf of the Data Controller.
1.8 “Data Subject” means any identified or identifiable natural person whose Personal Data is processed by Company.
1.9 “Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to name, email address, telephone number, physical address, payment information, IP address, device identifiers, financial information, and any other information that can be used to identify such person directly or indirectly. This definition is intended to be interpreted broadly and to encompass “personal information,” “personal data,” and “nonpublic personal information” as those terms are used under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR), the Gramm-Leach-Bliley Act (GLBA), and other applicable privacy laws.
1.10 “Recording” means any capture, storage, or retention of Chat Content, audio, video, screen shares, and Technical Data from Chat Sessions, in any format or medium.
1.11 “Technical Data” means timestamps, IP addresses, device type, device identifiers, operating system, browser type and version, screen resolution, geographic location data, session duration, clickstream data, and related metadata collected in connection with Your use of the Site, Service, or Chat Sessions.
1.12 “User” means any natural person who accesses or uses the Site or Service, including visitors, registered Account holders, Members, Buyers, and any individual who participates in a Chat Session or otherwise communicates with Company through the Site or Service.
1.13 “User Content” has the meaning set forth in the Social Media Terms of Service.
2. SCOPE AND APPLICATION
2.1 Application. This Privacy Policy applies where Company is acting as a Data Controller with respect to Your Personal Data — in other words, where Company determines the purposes and means of processing.
2.2 Incorporation by Reference. This Privacy Policy is incorporated by reference into Company’s Online Sales Terms and Conditions, Social Media Terms of Service, Consent and Release Agreement – Live Chat Recording, Pre-Chat Consent Modal, and other Company agreements that reference it. In the event of any conflict between this Privacy Policy and an agreement that incorporates it, this Privacy Policy controls solely with respect to Company’s privacy and data-handling practices.
2.3 Other Policies. Your use of the Site and Service is also subject to Company’s Cookie Policy and any other posted policies, which are incorporated herein by reference.
3. CATEGORIES OF PERSONAL DATA WE COLLECT
Company collects the following categories of Personal Data, depending on how You interact with the Site, Service, and Company:
3.1 Account Data
Information You provide when registering for or maintaining an Account, including name, email address, employer, job title, and account credentials.
3.2 Service Data
Personal Data provided in the course of receiving Company’s Services, including name, email address, telephone number, billing and shipping addresses, and project-related communications.
3.3 Order and Transaction Data
Information related to Orders placed through the Site, including products purchased, Purchase Price, payment method, payment confirmation, billing and shipping addresses, and Order history. Payment card details are processed by Company’s payment processors and are not stored by Company in unencrypted form.
3.4 Chat and Communications Data
Chat Content, Recordings, and Technical Data captured during Chat Sessions, as well as Correspondence Data contained in any communication You send to Company.
3.5 Usage Data
Information about Your use of the Site and Service, including IP address, geographic location, browser type and version, operating system, referral source, length of visit, page views, navigation paths, and the timing, frequency, and pattern of Service use. The source of Usage Data is You, Your device, Google Analytics, and Company’s analytics tracking systems.
3.6 User Content
Content You post, upload, or transmit through Company’s social media properties or the Service, as further described in the Social Media Terms of Service.
3.7 Enquiry and Notification Data
Information contained in any enquiry You submit and information You provide to subscribe to Company’s email notifications or newsletters.
3.8 Public Data
Information found on public sources, including public social networking profiles, business directories, and similar sources.
3.9 Referral Partner Data
Information processed in connection with the R+C Referral Partnership Program, including referrer and referee names, contact information, and engagement details.
3.10 Legal Claims Data and Professional Use Data
Any of Your Personal Data identified in this Policy where necessary for the establishment, exercise, or defense of legal claims; for obtaining or maintaining insurance coverage; for managing risks; or for obtaining professional advice.
3.11 No Sensitive Data Solicited
Company does not request that You provide special categories of Personal Data. Please do not submit such information to Us unless We specifically prompt You to do so. The Site and Service are not intended for the submission of Protected Health Information (PHI) under HIPAA.
4. HOW WE USE PERSONAL DATA
Company processes Personal Data for the following purposes:
- Providing the Site, Service, and Products — fulfilling Orders, providing customer support, and administering Accounts.
- Communications — responding to enquiries, sending transactional notices, sending newsletters and marketing communications (where permitted), and providing Service updates.
- Analytics and improvement — analyzing use of the Site and Service to improve, secure, and personalize them.
- Recording, monitoring, and analysis of Chat Sessions — as further described in Section 7 and consistent with the Consent and Release Agreement – Live Chat Recording.
- Marketing and business development — offering, marketing, and selling relevant goods and Services.
- Compliance and enforcement — complying with legal obligations and enforcing Company’s Terms of Use, Privacy Policy, and other applicable policies and agreements.
- Security and fraud prevention — protecting the security and integrity of the Site and Service.
- Risk management and professional advice — obtaining or maintaining insurance coverage, managing risks, and obtaining professional advice.
- Other purposes — any other purpose disclosed to You at the time of collection, or to which You subsequently consent.
5. LEGAL BASES FOR PROCESSING (GDPR)
Where the GDPR applies, Company relies on the following legal bases:
- Performance of a contract — to provide the Site, Service, and Products to You and to fulfill Orders.
- Consent — for marketing communications, certain cookies, recording of Chat Sessions, and other processing for which We request Your consent. Consent may be withdrawn at any time, without affecting the lawfulness of processing prior to withdrawal.
- Legitimate interests — to operate, secure, analyze, and improve the Site and Service; to communicate with Users and Buyers; to market relevant Products; to protect Our business; and for the establishment, exercise, or defense of legal claims.
- Legal obligation — to comply with applicable laws, including tax, accounting, anti-fraud, anti-bribery and anti-corruption, anti-spam (including the CAN-SPAM Act and TCPA), and data protection laws.
- Vital interests — where processing is necessary to protect the vital interests of You or another natural person.
6. SHARING PERSONAL DATA WITH OTHERS
6.1 Affiliates and Group Companies. Company may share Personal Data with its Affiliates, subsidiaries, parent company, and other group companies (collectively, "Group Companies") for the purposes and on the legal bases set out in this Policy.
6.2 Service Providers (Processors). Company engages vendors, consultants, contractors, and other service providers that process Personal Data on Company’s behalf (collectively, "Service Providers" or "Processors"). Service Providers are engaged in the following categories of activity:
- Web hosting, DNS, content delivery, and security
- Business email, productivity, and cloud storage
- CRM and marketing automation
- Marketing and transactional email delivery
- Live chat and AI/automated processing
- Outbound sales and lead generation
- Social media management and scheduling
- Payment processing and invoicing
- Project management, scheduling, and workflow automation
- Video conferencing and call recording
- Internal collaboration and messaging
- Electronic signature and document execution
- Accounting, tax, and bookkeeping
- Analytics
- Professional advisers — attorneys, accountants, and insurers as described in Section 6.5.
All Service Providers are required, by written agreement, to: (a) process Personal Data only on Company’s documented instructions and for the purposes for which they were engaged; (b) implement appropriate technical and organizational security measures; (c) impose confidentiality obligations on personnel; (d) assist Company in responding to Data Subject requests; and (e) comply with applicable data protection laws, including the GDPR, CCPA/CPRA, GLBA, CAN-SPAM, and TCPA, as applicable.
6.3 Independent Contractors and Personnel. Company’s independent contractors and personnel are bound by the Independent Contractor & Non-Disclosure Agreement or the Mutual Non-disclosure and Confidentiality Agreement, which require compliance with applicable data protection and privacy laws (including the CCPA, GDPR, GLBA, and HIPAA, as applicable).
6.4 Referral Partners. Where You participate in the R+C Referral Partnership Program, Company may share limited Personal Data with referral partners to administer the program, consistent with applicable privacy laws.
6.5 Insurers and Professional Advisers. Company may disclose Personal Data to its insurers, attorneys, accountants, and professional advisers as reasonably necessary to obtain or maintain insurance coverage, manage risks, obtain professional advice, or establish, exercise, or defend legal claims.
6.6 Legal and Compliance Disclosures. Company may disclose Personal Data where required to comply with a legal obligation, court order, subpoena, or lawful governmental request, or to protect the vital interests of any natural person.
6.7 Business Transfers. In connection with any merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, Company may transfer Personal Data to a successor or acquirer, subject to confidentiality and applicable law.
6.8 With Your Consent. Company may share Personal Data with other parties with Your consent or at Your direction.
6.9 Advertising Platforms (Independent Controllers). Company uses third-party advertising platforms (including Google Ads and LinkedIn Ads) to deliver advertisements about Company’s Products and Services to relevant audiences. These platforms act as independent controllers with respect to data they collect through their own technologies. Their processing is governed by their own privacy policies. Where required by applicable law, the disclosure of Personal Data to such platforms may constitute a “sale” or “share” within the meaning of the CCPA/CPRA and similar laws — please refer to Sections 17 and 18 for Your rights and how to exercise them.
6.10 No Sale of Personal Data for Monetary Consideration. Company does not sell Personal Data in exchange for monetary consideration.
6.11 Current Service Providers (Illustrative). As of the Effective Date of this Policy, Company engages the Service Providers listed below. This list is illustrative and may change from time to time without amendment of this Policy; You may request the current list by contacting Company using the information in Section 22:
- Web hosting, DNS, CDN, and security: SiteDistrict; Cloudflare.
- Business email, productivity, and cloud storage: Google Workspace (Gmail, Google Drive); Microsoft 365 (OneDrive, SharePoint); Dropbox; Box.
- CRM, marketing automation, live chat, and electronic signature: HubSpot.
- Transactional email delivery: SendGrid (Twilio Inc.).
- Outbound sales, prospecting, and lead generation: Sopro (Prospect Global Ltd, trading as Sopro, Reg. UK Co. 09648733; ICO Reg: ZA346877; DPO: dpo@sopro.io); Instantly.
- Social media scheduling: Later.
- Payments and invoicing: Authorize.Net; QuickBooks / Intuit Inc.
- Project management and workflow automation: Monday.com; Make.com; Motion / usemotion.app.
- Video conferencing and recording: Zoom.
- Internal collaboration: Slack.
- Electronic signature: Google Workspace eSignature; HubSpot.
- Artificial intelligence and automated processing: Anthropic; OpenAI. These providers may be used to assist with processing of Chat Content, drafting, summarization, classification, and similar tasks consistent with Section 7.
- Analytics: Google Analytics.
A Service Provider may operate in multiple categories listed above. Inclusion of a Service Provider in this list is not an endorsement of its privacy practices, and You should consult the Service Provider’s own privacy policy for information about its independent data-handling activities.
7. LIVE CHAT RECORDING, MONITORING, AND AUTOMATED/AI PROCESSING
7.1 Recording and Monitoring. Chat Sessions — including text, audio, video (where enabled), screen shares, files, attachments, and Technical Data — are recorded and stored by Company. By initiating or continuing a Chat Session, You consent to such Recording and to the practices described in this Section 7 and in the Consent and Release Agreement – Live Chat Recording.
7.2 Automated Systems and Artificial Intelligence. Chat Sessions may be reviewed, monitored, and analyzed by Company personnel, contractors, automated systems, chatbots, and artificial intelligence systems (including those operated by Company’s AI Service Providers identified in Section 6.11) for the purposes of providing chat services, training and improving Company’s systems, quality assurance, security, fraud prevention, compliance, and other purposes described in this Policy.
7.3 No Expectation of Privacy in Chat Content. Consistent with the Consent and Release Agreement – Live Chat Recording, You expressly waive any expectation of privacy with respect to Chat Sessions and Chat Content.
7.4 Sensitive Information Warning. Please do not submit Social Security numbers, government identifiers, full payment card numbers, account passwords, health information, or other sensitive data through live chat.
7.5 Alternative Contact Methods. If You do not wish to consent to Recording, alternative methods to contact Company are available on the Site’s Contact page; You may use those methods without using live chat.
7.6 Automated Decision-Making. Company does not use solely-automated decision-making (including profiling) that produces legal or similarly significant effects concerning You. Where automated tools are used to support human decision-making, those decisions remain subject to human review.
8. E-COMMERCE AND BUYER INFORMATION
8.1 Order Processing. When You place an Order through the Site, Company collects Personal Data necessary to process and fulfill Your Order, governed by this Privacy Policy and the Online Sales Terms and Conditions, which are incorporated by reference.
8.2 Payment Processing. Payments are processed by third-party payment processors identified in Section 6.11. Company does not store full payment card numbers. Your interactions with payment processors are subject to those processors’ own privacy policies and terms.
8.3 Order Records. Company retains Order records for accounting, tax, warranty, dispute-resolution, and legal-compliance purposes for the period set out in Section 14.
9. SOCIAL MEDIA AND USER CONTENT
9.1 User Content. When You submit User Content through the Service or Company’s social media properties, Company processes Personal Data contained in such User Content in accordance with this Policy and the Social Media Terms of Service. Public-facing User Content may be visible to others.
9.2 Third-Party Platforms. Company’s presence on third-party social media platforms is subject to those platforms’ own privacy policies and terms.
10. REFERRAL PARTNERS AND SERVICE PROVIDERS
10.1 Referral Partner Obligations. Referral partners participating in the R+C Referral Partnership Program are required to handle all Personal Data collected or processed in connection with referral activities in accordance with applicable privacy laws (including the GDPR, CCPA, CAN-SPAM Act, and TCPA) and Company’s privacy policies, to obtain all necessary consents before sharing any Personal Data with R+C, and to implement appropriate technical and organizational measures to protect such data.
10.2 Service Provider Obligations. Service Providers that process Personal Data on Company’s behalf are bound by written agreements requiring them to: (a) process Personal Data only on documented instructions from Company; (b) implement appropriate security measures; (c) assist Company in responding to Data Subject requests; and (d) comply with applicable data protection laws.
11. INTERNATIONAL TRANSFERS OF PERSONAL DATA
11.1 Cross-Border Transfers. Company is headquartered in the United States, and Personal Data may be processed in the United States and in other countries where Company or its Service Providers operate. These countries may have data protection laws that differ from those of Your country of residence.
11.2 Transfers Outside the EEA/UK. Where Personal Data is transferred from the European Economic Area ("EEA") or the United Kingdom to a country that has not been deemed to provide an adequate level of protection, Company implements appropriate safeguards — including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms — to protect Your Personal Data.
11.3 Service Providers Outside the United States. Certain of Company’s Service Providers and sub-processors are located outside the United States, including in the United Kingdom, the European Union, and other jurisdictions. Where such Service Providers process Personal Data of EEA, UK, or Swiss Data Subjects, transfers are protected by the safeguards described in Section 11.2.
11.4 Internet Publication. You acknowledge that Personal Data You submit for publication through the Site or Service may be available, via the internet, around the world. Company cannot prevent the use (or misuse) of such Personal Data by others.
12. COOKIES AND SIMILAR TECHNOLOGIES
12.1 Cookies. Company uses cookies, pixels, web beacons, and similar technologies on the Site. By using the Site and agreeing to this Policy, You consent to Company’s use of cookies in accordance with the terms of Company’s Cookie Policy.
12.2 Analytics. Company uses third-party analytics services (including Google Analytics) to collect and analyze Usage Data. You may opt out of certain analytics by using browser-based tools or opt-out mechanisms made available by such third-party providers.
13. DATA SECURITY
Company implements appropriate technical and organizational measures designed to protect Personal Data from unauthorized access, disclosure, alteration, and destruction. Despite these measures, no method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of Your Account credentials and for notifying Company promptly of any suspected unauthorized use.
14. RETENTION AND DELETION OF PERSONAL DATA
14.1 Retention Principles. Personal Data that Company processes for any purpose shall not be kept for longer than is necessary for that purpose, except where retention is required by law or is necessary for the establishment, exercise, or defense of legal claims.
14.2 Specific Retention Periods. Without limiting the generality of Section 14.1: (a) Account Data is retained for the duration of Your Account plus a reasonable period thereafter; (b) Order and Transaction Data is retained for the period required by applicable tax, accounting, and consumer-protection laws (typically not less than seven (7) years); (c) Chat Recordings and Chat Content are retained for the period set out in the Consent and Release Agreement – Live Chat Recording; (d) marketing-related Personal Data is retained until You opt out or for a reasonable period thereafter; and (e) Legal Claims Data is retained for the duration of the relevant limitations period plus a reasonable buffer.
15. CHILDREN’S PRIVACY
The Site and Service are not directed to children under the age of thirteen (13), and Company does not knowingly collect Personal Data from children under 13. Consistent with the Social Media Terms of Service, You must be at least thirteen (13) years of age to access or view the Service and at least eighteen (18) years of age (or the age of majority in Your jurisdiction) to enter into a binding agreement with Company. If You believe a child has provided Personal Data to Company, please contact Us at privacy@rubyandcitrine.com and We will take reasonable steps to delete it.
16. YOUR RIGHTS UNDER THE GDPR
If You are located in the EEA, the United Kingdom, or Switzerland, You have the following rights with respect to Your Personal Data, subject to applicable law:
- Right to be informed — to receive transparent information about the processing of Your Personal Data.
- Right of access — to obtain confirmation of whether Company processes Your Personal Data and, if so, a copy of such data and certain additional information.
- Right to rectification — to have inaccurate Personal Data corrected and incomplete Personal Data completed.
- Right to erasure (the “right to be forgotten”) — to have Personal Data deleted in certain circumstances.
- Right to restrict processing — to require Company to limit the processing of Your Personal Data in certain circumstances.
- Right to object — to object to processing based on legitimate interests, direct marketing, or scientific/historical research.
- Right to data portability — where processing is based on consent or performance of a contract and is carried out by automated means, to receive Your Personal Data in a structured, commonly used, machine-readable format.
- Right to withdraw consent — where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint — to lodge a complaint with a supervisory authority in the EU/EEA member state of Your habitual residence, place of work, or place of the alleged infringement.
To exercise any of these rights, please contact Us using the information in Section 22. We will respond within one (1) month of verifying Your identity, subject to extensions permitted by law.
17. YOUR RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA/CPRA)
If You are a California resident, You have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), subject to applicable exceptions:
- Right to know — to request the categories and specific pieces of Personal Data Company has collected about You; the categories of sources; the business or commercial purposes for collecting; and the categories of third parties to whom Company has disclosed Personal Data.
- Right to delete — to request deletion of Personal Data Company has collected from You.
- Right to correct — to request correction of inaccurate Personal Data.
- Right to opt out of sale or sharing — Company does not sell Personal Data for monetary consideration. To the extent any disclosures qualify as a “sale” or “share” under the CCPA (including for cross-context behavioral advertising through advertising platforms identified in Section 6.9), You have the right to opt out by contacting Us using the information in Section 22 or by using opt-out controls We make available on the Site.
- Right to limit use of sensitive personal information — to direct Company to limit the use and disclosure of Sensitive Personal Information to certain permitted purposes.
- Right to non-discrimination — Company will not discriminate against You for exercising any CCPA right.
- Authorized agents — You may designate an authorized agent to make a request on Your behalf, subject to verification.
To exercise these rights, contact Us using the information in Section 22. We will verify Your request consistent with CCPA requirements and respond within the timeframes required by law.
18. OTHER U.S. STATE PRIVACY RIGHTS
Residents of other U.S. states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) may have additional rights similar to those described in Section 17. To exercise these rights, please contact Us using the information in Section 22.
19. THIRD-PARTY SITES AND SERVICES
The Site contains links to external websites and services operated by other organizations. This Privacy Policy applies only to the Site and Service, not to those external websites and services, which have their own privacy policies. Company is not responsible for the privacy practices of third parties.
20. DO-NOT-TRACK SIGNALS
Some browsers transmit “Do Not Track” ("DNT") signals. Because there is no industry standard for DNT signals, Company does not currently respond to DNT signals. Where required by applicable law, Company honors recognized opt-out preference signals (such as the Global Privacy Control).
21. CHANGES TO THIS PRIVACY POLICY
21.1 Updates. Company may update this Privacy Policy from time to time by publishing a new version on the Site. The “Effective Date” and “Last Updated” dates at the top of this Policy indicate when this Policy was last revised.
21.2 Material Changes. If Company makes material changes, Company will provide notice through the Site, by email (where We have Your email address), or by other reasonable means before the changes take effect.
21.3 Continued Use. Your continued use of the Site or Service after the effective date of any update constitutes Your acceptance of the updated Policy.
22. CONTACTING US
If You have questions about this Privacy Policy or wish to exercise any of Your rights as a Data Subject, You may contact Company as follows:
By email: privacy@rubyandcitrine.com
By telephone: 919-244-2622
By post: Ruby and Citrine LLC, 201 Shannon Oaks Circle, Suite 102, Cary, NC 27511, United States
This Privacy Policy was last updated on May 1, 2026. It supersedes all prior versions, including the version dated May 5, 2023.