Privacy Policy

Effective date: September 30, 2026

This Privacy Policy explains how Highlight Labs LLC, a California limited liability company and the maker of RapidHarness ("Highlight Labs", "we", "us" or "our"), collects, uses, shares and protects personal information when you visit rapidharness.com, use the RapidHarness desktop software and cloud library, buy a subscription, or contact us (together, the "Service"). It also explains the choices and rights you have. Capitalized terms not defined here have the meanings given in our Terms of Use.

1. Information We Collect

Information you give us

• Account information: your first and last name, email address, password (stored only as a salted cryptographic hash), and the name of your team. When you sign up we send a one-time code to verify your email address.
• Billing contact information: if you purchase a subscription, the company name, contact name, email address, phone number, billing address, purchase order numbers and the email addresses that should receive receipts and invoices, and the email addresses of the users assigned to each license.
• Payment information: card payments are collected and processed directly by our payment processor, Stripe. We receive only limited details from Stripe, such as the card brand, last four digits, expiration date and payment status.
• Your Content: the designs, drawings, libraries, parts, files and notes you create or upload. Content is mostly technical, but it may contain personal information, such as names in title blocks or notes.
• Communications: emails and in-app feedback you send us, including your name, email address and the content of your message, and our replies.

Information collected automatically

• Design version information: each time a design is saved, we record the time, the user who is editing it, and the name of the computer it was saved from. Each time a version of a design is created, we also record the name, email address and team of the user who created it. This forms the design's version history, which the team can see. We also use computer names to detect a single license being used on more than one computer at the same time.
• Diagnostic and crash reports: the desktop software sends reports to our servers when it starts and exits, when it encounters an error or unexpected condition, and when certain actions occur, such as signing in or out, creating a PDF, or removing a team member or partner. Reports contain technical details such as the software version, operating system version, .NET version, language and time zone settings, computer name, Windows user name, your account email address, error messages, stack traces and a log of recent actions within the software, which records the parts of the software you used but not the contents of your designs. A report may also include anything you type into the software's error window and, where they are part of the action being reported, the names or email addresses of other users, such as a team member being removed. If a report cannot be sent immediately, it is stored on your computer until it can be.
• Parts searches: the search terms you enter when searching third-party parts catalogs are sent from our servers to our parts data provider. We do not send your identity with these searches.
• Server logs and monitoring: our hosting provider and our application monitoring service record technical information about requests to our website and servers, such as IP addresses, request times, the pages and addresses requested, and error and performance information, which we use to operate, troubleshoot and secure the Service.
• Cookies: see Section 6.

Information from others

• Your team administrator or another team member may provide your name and email address to invite you to a team or assign you a license, and a partner team may provide your email address to invite you to a partnership.
• Stripe provides us with payment status and the limited card details described above.

2. How We Use Information

We use personal information to:

• Provide the Service: create and secure your account, sync and store your designs, maintain version history, manage teams, licenses and partnerships, and enforce plan limits.
• Process payments: bill you, send receipts, invoices and renewal reminders, collect overdue amounts and prevent payment fraud.
• Support you: respond to your questions, feedback and support requests, and follow up when you first sign up to offer help getting started.
• Maintain and improve the Service: diagnose and fix errors, crashes and performance problems, and understand which features need improvement.
• Communicate with you: send service messages (such as email verification, password resets, security notices, billing notices and changes to our terms), and, where permitted, news about new RapidHarness features. You can opt out of feature news at any time (Section 8).
• Protect the Service and comply with law: detect and prevent security incidents, abuse and license misuse, enforce our Terms, and comply with legal obligations.

We may use automated tools, including artificial intelligence, to help us carry out these purposes. We do not use your personal information or Content for targeted advertising, we do not use your Content to train artificial intelligence models, and we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

3. Legal Bases (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

• Performance of a contract: to provide the Service, manage your account and subscription, and provide support.
• Legitimate interests: to secure and improve the Service, diagnose errors, prevent misuse, send feature news to business customers, and use service providers and automated tools to run the Service and support our customers efficiently. We balance these interests against your rights, and you can object at any time (Section 9).
• Legal obligation: to keep financial records and respond to lawful requests.
• Consent: where required by law, for example for certain marketing communications. You may withdraw consent at any time.

4. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

• Within your team: members of your team can see the team's designs, their version history (including the names and email addresses of users who saved each version), and the list of team members. Team administrators can manage members, licenses and billing.
• With partners you choose: when your team shares designs with a partner team, the partner can see the shared designs and their version history.
• With service providers that process information on our behalf to help us run the Service, under contracts that limit how they may use it. These include providers of cloud hosting, data storage and backups; application monitoring; payment processing and billing; email delivery and business email; customer support and business software, including tools that use artificial intelligence; and electronic parts data. Some providers, such as our payment processor, also use certain information for their own purposes, such as preventing fraud and meeting legal obligations, under their own privacy policies. We may change or add service providers from time to time, and you can ask us for the names of our current service providers.
• For legal reasons: when we believe in good faith it is required by law, subpoena or other legal process, or necessary to protect the rights, property or safety of Highlight Labs, our users or others. Where legally permitted, we will try to notify you before disclosing your information in response to a legal demand.
• In a business transfer: in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this Privacy Policy.
• With your consent or at your direction.

In addition, some features connect your device or browser directly to third parties, who receive your IP address and basic technical information under their own privacy policies. For example, the desktop software downloads part images from third-party image servers, and our website loads some code libraries from public content delivery networks and embeds tutorial videos from a video hosting service.

5. Our Role for Team Content

Where a business uses RapidHarness, that business decides who is on its team and what Content it stores, and we process personal information in its Content on its behalf, as a "processor" or "service provider". If your personal information appears in Content belonging to a team you are not the administrator of, please direct your request to that team, and we will assist them.

6. Cookies and Similar Technologies

Our website uses only cookies that are needed for it to work: a cookie that keeps you signed in to your account, a security cookie that protects forms from cross-site request forgery, and a cookie that remembers that you have dismissed our cookie notice. We do not use analytics, advertising or social media tracking cookies or pixels on our website. Our email provider may record whether our emails are delivered and opened, which we use only to make sure important account and billing emails reach you.

Some third-party content on our website may set its own cookies: YouTube may set cookies when you play an embedded tutorial video, and Stripe sets cookies on payment pages to process payments and prevent fraud. You can control and delete cookies through your browser settings; if you block cookies needed for signing in, you will not be able to use your account on our website. Because we do not sell or share personal information for advertising, there is nothing for an opt-out preference signal, such as Global Privacy Control, to opt you out of.

7. How Long We Keep Information

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy:

• Account information is kept while your account is active. When you ask us to delete your account, we delete your user account and profile information, except as described below.
• Content and version history are kept until they are deleted by your team, or after your team's account is closed as described in our Terms of Use. Because version history is a record belonging to the team, the name and email address recorded on design versions you created remain with those versions after you leave a team or delete your account.
• Billing records, such as invoices, receipts and billing contact details, are kept for as long as needed for tax, accounting and legal purposes, generally seven years.
• Diagnostic and crash reports are kept for as long as they are useful for fixing problems, generally no more than 180 days, and are deleted when the software version they relate to is retired.
• Support communications are kept while your account is active and for a reasonable period afterward to help with future requests, unless you ask us to delete them.
• Backups containing deleted information are overwritten in the ordinary course of our backup cycle.

8. Your Choices

• Account information: team administrators can update billing details from the Account section of our website. For other changes, contact us.
• Feature news: you can opt out of emails about new features by using the unsubscribe link in the email or by emailing us. You will still receive service messages, such as security, billing and account notices.
• Diagnostic reports: diagnostic reports are needed to keep the software working reliably. If you have concerns about them, contact us.
• Cookies: see Section 6.

9. Your Privacy Rights

Depending on where you live, you may have the right to: know what personal information we have about you and how we use it; access or receive a portable copy of it; correct inaccurate information; delete it; object to or restrict certain processing; withdraw consent where we rely on consent; and opt out of the sale of personal information, targeted advertising or certain profiling (we do not engage in these). Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other U.S. states with comprehensive privacy laws, and people in the EEA, the UK and Switzerland, have rights of this kind under their local laws. We extend these rights to all of our users where we reasonably can.

To make a request, email customer-service@rapidharness.com from the email address on your account, or tell us how to reach you. We will verify your identity, generally by confirming your control of your account email address, before we act on a request. You may use an authorized agent to make a request on your behalf; we may ask the agent for proof of authorization and ask you to verify your identity directly. We will respond within the time required by law, generally 30 to 45 days. We will not discriminate against you for exercising your rights.

If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal". If you are not satisfied with our response to an appeal, you may contact your state attorney general. If you are in the EEA, the UK or Switzerland, you may also complain to your local data protection authority.

Additional information for California residents

In the last 12 months we have collected the following categories of personal information described in the California Consumer Privacy Act: identifiers (such as name, email address, IP address and account identifiers); customer records and commercial information (such as billing contact details and purchase history); internet or other electronic network activity (such as diagnostic reports and server logs); and professional or employment-related information (such as company and team name). In the last 12 months we have disclosed each of these categories to our service providers for the business purposes described in Sections 2 and 4. The sources, purposes, recipients and retention of this information are described in Sections 1, 2, 4 and 7. We do not collect sensitive personal information other than account login credentials, which we use only to provide the Service. We have not sold or shared personal information, as those terms are defined in the CCPA, and we do not knowingly sell or share the personal information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing purposes.

10. International Transfers

We are based in the United States, and we store and process information in the United States. Our service providers process information mainly in the United States and the European Union. Where we transfer personal information from the EEA, the UK or Switzerland to countries that have not been found to provide adequate protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or on the provider's certification under the EU-U.S. Data Privacy Framework where applicable. You can ask us for a copy of these safeguards by contacting us (Section 15).

11. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption of data in transit (TLS) and at rest, salted and hashed passwords, access controls that limit our personnel's access to those who need it, and hosting with a major cloud provider. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password for your RapidHarness account and keep your computer secure. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by law.

The desktop software also keeps some information on your computer: your account email address; your password, only if you choose to have it remembered, encrypted by Windows so that only your Windows user account can read it; diagnostic reports waiting to be sent; preview images of your designs; and, after the software closes unexpectedly, a copy of unsaved design changes so they can be recovered. Anyone who can sign in to your Windows user account may be able to access this information.

12. Children

The Service is a professional engineering tool and is not directed to children. We do not knowingly collect personal information from anyone under 13. Users aged 13 to 17 may use the Service only under the supervision of a parent, guardian, or a school or other organization, as described in our Terms of Use. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

13. Links to Other Websites

The Service contains links to websites and services operated by others, such as parts manufacturers and distributors. Their privacy practices are governed by their own policies, and we encourage you to read them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in the Service before the changes take effect. The effective date at the top of this page shows when it was last updated.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, contact us at:

Highlight Labs LLC
Attn: Privacy
6 Liberty Square #2026
Boston, MA 02109, USA
customer-service@rapidharness.com