Privacy Policy

1. Who we are

Rollset is a customer relationship management platform operated by Rollset LLC, an Arizona limited liability company. Copperline CRM is the former name of the Rollset CRM product. This policy applies to our websites, applications, support services, and integrations with services you choose to connect.

Our principal and mailing address is 4539 N 22nd St, Ste N, Phoenix, AZ 85016, United States.

Organizations that use Rollset control the business data they place in their accounts. If a Rollset customer collected your information, you may also contact that organization directly about its privacy practices.

2. Information we collect

• Account information: name, email address, organization, role, authentication records, and account preferences.
• CRM content: contacts, companies, conversations, appointments, calendars, tasks, documents, invoices, forms, campaigns, and other content you choose to store or process.
• Connected-service data: provider account identifiers, permission grants, encrypted OAuth credentials, connection health, and data needed to perform the actions you request. Native social connections can also handle profiles, publishing settings, original media, post links, available performance counts and supported discussions, as described in the Social Privacy notice.
• Usage and device data: browser, device, IP address, security events, logs, diagnostics, and interactions with the service.
• Billing records: plan, transaction, and invoice references. Payment card details are processed by payment providers and are not stored by Rollset.

3. Google user data

When you connect Google, Rollset accesses only the Google services and permissions you authorize. Depending on the features you enable, this can include Gmail messages and metadata, Google Calendar calendars and events, files or spreadsheets you select in Google Drive and Google Sheets, Business Profile accounts and managed locations, and YouTube channel identities, videos, statistics and supported comments or replies.

We use Google user data only to provide the user-facing CRM features you request, such as email and calendar synchronization, conflict checking, creating calendar events, and reading or updating selected workflow files. Business Profile features support the location updates, offers and events you request. Rollset uses YouTube API Services for channel connection, original video and thumbnail uploads, selected audience/visibility settings, available statistics and supported discussions. We do not use Google user data for advertising. Human access is limited to cases where you give specific consent for support, access is required for security or abuse investigation, or access is required by law. Rollset's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Native social features remain in preview and depend on provider approval and account eligibility. See the Social Privacy notice for the information each connection uses and deletion help for the YouTube revocation and data-removal controls. You may also remove Google access in Google's third-party permissions settings. A shared Google authorization may support more than one Rollset connection. Read the Google Privacy Policy and, for YouTube features, the YouTube Terms of Service.

4. Zoom data

When you connect Zoom, Rollset receives your Zoom user ID, email address, OAuth access and refresh credentials, and the meeting information needed to create, update, or delete meetings for appointments you manage in Rollset. Stored OAuth credentials are encrypted at rest. Rollset stores meeting IDs and join URLs so it can keep scheduled appointments synchronized.

Rollset's current Zoom integration does not request access to recordings, transcripts, in-meeting chat, webinars, or contacts. Zoom data is used only to provide the connection and meeting-management features you request. Each authorization is scoped to the Rollset user and client account from which it was created.

5. Other connected services

If you connect services such as Meta, Threads, LinkedIn, TikTok, X, Microsoft, Stripe, Twilio, or SendGrid, Rollset may process provider identifiers, authorized content, delivery or engagement information, and encrypted credentials needed to operate that integration. We use this information only to provide the connected features you select and follow the provider permissions you grant.

The native social preview has its own data-use notice and disconnect and deletion instructions. Connecting one social platform does not authorize an unrelated platform or create a general inbox of private messages.

6. Cookies, browser storage and third-party content

Rollset uses session cookies for sign-in and security, and browser storage to remember navigation, workspace and interface preferences. Clearing this storage may sign you out or reset preferences. Your browser provides controls for cookies and local storage.

Where configured, PostHog provides dashboard usage analytics using cookies and local storage, with events associated with an account or workspace identifier. Where configured, Sentry receives diagnostic and performance information, which may include account details and technical context. Error-session replay is configured to mask text and inputs and block media. These optional services have their own data handling; blocking their requests does not revoke a social account's authorization.

Provider-hosted profile images, previews, embedded content and external links can cause your browser to contact a third party. That party may receive your IP address and request information and apply its own cookie and privacy practices. Social publishing also sends selected media or retrievable media URLs to the destinations you choose. See social media hosting and sharing for those limits.

7. How we use information

• Provide, maintain, personalize, secure, and improve Rollset.
• Authenticate users and enforce agency, client-account, and role permissions.
• Synchronize data and perform actions you request through connected services.
• Process billing and prevent fraud, abuse, and security incidents.
• Respond to support requests and communicate service or policy changes.
• Comply with law and enforce our agreements.

8. How information is shared

We disclose information only as needed to your authorized agency or client-account members, providers you direct us to connect, infrastructure and support vendors acting for us, professional advisers, or authorities when legally required. We may also disclose information in a corporate transaction, subject to appropriate protections. We do not sell Zoom or Google user data.

Infrastructure used for the service includes Vercel for the web application and Convex for backend processing, database records, file storage and scheduled work. Stripe handles supported payments and subscriptions. Other connected features use the providers you select, and optional analytics or diagnostics services receive the data described above.

Workspace administrators can expressly authorize customer-managed AI agents to use Rollset's scoped MCP or REST tools. When an authorized agent calls a tool, the result can include CRM or connected social data permitted by its scopes and can be processed by the AI service the customer selects, such as OpenAI, Anthropic, xAI, or a self-hosted provider. The customer identifies the agent/provider and grants specific permissions; connecting an account alone does not send its data to an agent. The provider's own terms govern copies or conversation history held in that service. Rollset does not receive the provider's account credentials. Hosted MCP requests and responses pass through Vercel; a direct REST connection avoids that MCP relay. API keys can be revoked in Rollset.

Google data remains subject to the Google API Services User Data Policy and its Limited Use restrictions. A transfer of that data as part of a merger, acquisition or sale of assets requires the user's explicit prior consent.

9. Retention, disconnection, and deletion

We retain information while your account is active and as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. You can disconnect a provider from Rollset's Connections or Integrations settings at any time using the control provided for that integration. For native social connections, ordinary disconnect removes the publishing credential and stops future local work, but can retain profile information and history. YouTube uses a combined revocation and deletion control. You may also revoke Rollset from the provider's own connected-app settings; local disconnection and provider-side revocation are separate actions.

Deleting a social connection's imported data does not delete your whole workspace, original drafts or uploads, existing posts on a social network, or every billing and request record. Deletion runs in stages, and a status for one request describes that request's scope. It is not confirmation that all backups or third-party copies have been erased. The social deletion guide explains the available controls, retained records and how to ask for broader removal.

To request deletion of your Rollset account or associated personal information, email nick@rollset.app with the subject Rollset privacy request. Identify the account and data involved, but do not send passwords or OAuth credentials by email.

10. Security

We use administrative, technical, and organizational safeguards designed to protect information, including tenant separation, role-based access controls, transport encryption, encrypted connected-service credentials, and security logging. No system can guarantee absolute security.

11. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to the processing of personal information, withdraw consent, or appeal a denied request. You may also designate an authorized agent where the law allows.

To exercise a right, email nick@rollset.app with the subject Rollset privacy rights request and describe your request. We may verify your identity and authority before acting. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

You can also write to Rollset LLC, 4539 N 22nd St, Ste N, Phoenix, AZ 85016, United States. If an organization manages your workspace or collected your information, include its name so we can route the request appropriately. Do not send passwords, access tokens or app secrets.

12. Children

Rollset is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

13. Changes and contact

We may update this policy as Rollset evolves. We will post the current version here and update the date above. Questions and privacy requests can be sent to nick@rollset.app.