Privacy Policy
Effective Date: 2026-09-25
Summary of Key Points
This summary provides key points from our Privacy Policy. You can find more detail by reading the full policy below or by using the table of contents to navigate to the section you need.
What personal information do we process? When you visit our Website, we automatically collect technical data such as your IP address, browser type, and pages visited. We do not require account registration, collect passwords, or process payments on this Website. Learn more.
Do we process any sensitive personal information? No. We do not process sensitive personal information.
Do we collect any information from third parties? No. We do not collect information from third parties.
How do we process your information? We process your information to deliver and secure the Website, measure traffic with Google Analytics (on by default for visitors in the United States until they opt out, and only with consent everywhere else), respond to inquiries, and comply with law. Learn more.
In what situations and with which parties do we share personal information? We share data with our hosting provider (Cloudflare), analytics provider (Google Analytics), and our internal compliance platform (Codex Titan) for privacy request fulfillment and consent audit logging. We do not sell or share personal information for advertising. Learn more.
How do we keep your information safe? We use TLS encryption, Cloudflare's edge security (WAF, DDoS protection), and restrict access to authorized personnel with multi-factor authentication. Learn more.
What are your rights? Depending on where you are located, you may have rights to access, correct, delete, or port your personal information, and to opt out of sale or sharing. Learn more.
How do you exercise your rights? Email privacy@rbzilla.com or visit https://www.rbzilla.com/privacy/data-request. We will respond within the applicable statutory timeframe.
Table of Contents
- Introduction
- Information We Collect
- How We Collect Information
- How We Use Information
- Information Sharing and Disclosure
- Data Retention
- Your Privacy Rights
- Cookies and Tracking
- Global Privacy Control and Do Not Track
- United States State Privacy Rights
- International Data Transfers
- Children's Privacy
- Security Measures
- Changes to This Policy
- Contact Information
1. Introduction
RB ZILLA LLC ("RB ZILLA," "we," "us," or "our") operates the website located at https://www.rbzilla.com (the "Website"). RB ZILLA is a solutions studio for precision-engineered ventures, built with intent and measured by impact.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we retain it, and what rights you have with respect to your information. It applies to all visitors who access the Website.
Scope. This Privacy Policy covers only the Website at rbzilla.com. RB ZILLA LLC operates other products and services (including mobile applications) that have their own privacy policies. If you use those products, please refer to the privacy policy published within or alongside that product.
Controller Identity. For purposes of applicable privacy law, RB ZILLA LLC is the data controller for personal information collected through the Website. Where we operate products or platforms on behalf of business customers and process personal information on their behalf, we act as a data processor governed by the applicable data processing agreement. This Privacy Policy does not cover processing performed in our capacity as a data processor.
By using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Website and contact us at privacy@rbzilla.com to request deletion of any information we hold about you.
2. Information We Collect
The Website is an informational site. We do not require account registration, collect passwords, process payments, or operate login functionality. We do not process sensitive personal information. The categories of personal information we collect are limited to what is described below.
2.1 Usage and Technical Data
We automatically collect certain technical information when you visit the Website:
- IP address (truncated where supported by our analytics provider)
- Browser type and version
- Operating system and device type
- Pages visited and navigation path
- Referring URLs and exit pages
- Session duration and timestamps
- Country-level location (derived from IP address by Cloudflare; we do not collect precise geolocation)
2.2 Cookies and Tracking Data
We collect data through cookies and similar tracking technologies as described in Section 8. This includes a consent-state cookie and, where analytics is allowed (by default in the United States until you opt out, and after you accept everywhere else), analytics identifiers set by Google Analytics.
2.3 Communication Data
If you contact us by email (e.g., via the contact address displayed on the Website), we collect:
- Your name and email address (as provided in your message)
- The content of your message and any attachments you include
- Communication history and correspondence records
We collect this data only when you voluntarily initiate contact. The Website has no marketing or newsletter signup forms. The only on-site data-collection form is the Data Subject Access Request (DSAR) form at https://www.rbzilla.com/privacy/data-request, which collects the information you submit to exercise privacy rights.
3. How We Collect Information
We collect information through the following methods:
Directly from you. When you send us an email, you provide information directly to us. This is the only way we collect information that you voluntarily submit.
Automatically through your use of the Website. Our hosting infrastructure and third-party analytics tools automatically record technical and usage data when you visit the Website.
Through cookies and similar technologies. We use cookies as described in Section 8 to store your consent preferences and to measure website traffic via analytics: by default in the United States until you opt out, and with your consent everywhere else.
Through consent action logging. When you make a choice in our consent banner (accepting, rejecting, or changing your cookie preferences), use the "Do Not Sell or Share My Personal Information" link, or first visit the Website with a Global Privacy Control signal (which we record as a refusal), we log the consent action to our compliance platform (Codex Titan) to maintain a record of valid consent, as the GDPR requires. This log includes: (1) a pseudonymized visitor identifier (a keyed HMAC-SHA256 value derived from your IP address and browser user-agent and scoped to this website — the raw IP address is not retained in the log, and the value cannot be recomputed without a secret key we hold); (2) the consent action you took (accept, reject, or withdraw); (3) the consent categories you selected; (4) your detected consent region, how it was determined (from your connection's country, from your browser's time zone, or by default because it could not be determined), and the applicable consent regime (opt-in or opt-out); (5) whether a Global Privacy Control signal was active, and whether it was detected in your browser or at our server; (6) the version of the consent banner you responded to; and (7) a timestamp. Your name, email address, and browser user-agent string are not included in consent logs.
We do not collect information from third parties.
4. How We Use Information
We use personal information for the purposes set out in the table below. Where we rely on legitimate interests, we have balanced those interests against your rights and determined that our interests do not override your fundamental privacy rights.
Large language models. We do not use your personal information to train large language models, and we do not use artificial intelligence to process personal information collected through this website.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Responding to emails and inquiries you send us | Legitimate interests (communication) |
| Measuring website traffic and interactions via Google Analytics (cookies) | Consent (analytics requires opt-in outside the United States, including in GDPR regions) |
| Delivering website content reliably and protecting against attacks | Legitimate interests (security and availability) |
| Enforcing consent preferences and honoring privacy signals (GPC) | Legal obligation |
| Complying with legal obligations (e.g., law enforcement requests) | Legal obligation |
We do not use your information for marketing, advertising, profiling, or automated decision-making.
5. Information Sharing and Disclosure
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We share personal information only as described in this section.
5.1 Service Provider and Sub-Processor Registry
Every third-party service that receives personal data from us is listed in the table below.
| Service | Role | Data Shared | Why |
|---|---|---|---|
| Cloudflare | Hosting (Cloudflare Pages), DNS, CDN, DDoS protection | Request metadata (IP address, request headers, URLs) | To host and deliver the Website, protect against attacks, and optimize performance |
| Google Analytics | Website analytics, traffic measurement | Request metadata (IP address, browser, pages visited, session data, interactions such as link clicks); analytics cookies (_ga, _ga_<container-id>) |
To measure website traffic and understand how visitors interact with the Website. Loaded directly from Google only when analytics is allowed: by default for visitors in the United States until they opt out, after consent everywhere else, and never while the browser sends a Global Privacy Control signal. |
| Codex Titan | Privacy request management and consent audit logging | DSAR requests: email address, name (if provided), request type, jurisdiction. Consent logs: pseudonymized visitor identifier (keyed HMAC, not IP address), consent action, consent categories, detected region and how it was determined, consent regime, GPC signal state, consent-banner version. | To fulfill Data Subject Access Requests (DSAR) and maintain consent proof records as the GDPR requires. Codex Titan is an RB ZILLA LLC internal compliance platform; data is not shared with external third parties. |
Note on Google Fonts: The Website uses the Chakra Petch and Rajdhani typefaces. These fonts are downloaded at build time and self-hosted from our own domain via Next.js font optimization. No requests are made to Google's font servers when you visit the Website, and Google does not receive your IP address or any personal data for font delivery.
We have contracts in place with each service provider that require them to protect your personal information and prohibit them from using it for their own commercial purposes.
5.2 Additional Disclosure Circumstances
Legal requirements. We disclose personal information when required to do so by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to comply with applicable law or respond to a valid government request.
Protection of rights. We disclose personal information when we believe it is necessary to protect the rights, property, or safety of RB ZILLA, our visitors, or the public.
Business transfers. If RB ZILLA LLC is involved in a merger, acquisition, asset sale, or other business transaction, personal information may be transferred as part of that transaction. We will notify affected individuals via a prominent notice on the Website before personal information becomes subject to a materially different privacy policy.
Aggregated or de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose.
5.3 Categories Disclosed for Business Purposes
We have disclosed the following categories of personal information to service providers for a business purpose in the preceding twelve (12) months:
- Category A (Identifiers): IP address, online identifiers, cookie identifiers — disclosed to Cloudflare and Google Analytics for hosting and analytics. Email address and name (when voluntarily submitted via DSAR form) — disclosed to Codex Titan for privacy request fulfillment.
- Category F (Internet or similar network activity): Browsing history, pages visited, interactions with the Website — disclosed to Cloudflare and Google Analytics. Pseudonymized consent interaction data — disclosed to Codex Titan for consent audit logging.
We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months.
6. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this policy and to comply with our legal obligations.
| Data Category | Retention Period |
|---|---|
| Analytics data (Google Analytics) | Event-level data: 2 months. User-level data linked to the analytics identifier: 14 months after your most recent visit (the period restarts each time you return). These are the data retention settings of our Google Analytics property; aggregated reports that do not identify you may be kept longer |
| Consent records (cookie consent state) | Duration of the consent cookie: 366 days (a choice stored on or before September 17, 2026 may instead expire after 182 days), then you are asked again |
| Consent action logs (Codex Titan) | Not less than 24 months and not more than 25 months from the date of the consent or opt-out action, after which the record is permanently deleted. The 24-month minimum is the California recordkeeping period for records of consumer requests |
| Email correspondence | Retained for as long as necessary to resolve the inquiry, then deleted within 1 year of the last communication unless a legal hold applies |
| Server and CDN logs (Cloudflare) | Retained per Cloudflare's data retention policies (generally 72 hours for detailed logs) |
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it. If deletion is not immediately possible (for example, because information has been stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.
Legal Hold. Notwithstanding the periods above, we retain personal information for longer periods when required by law, regulation, or ongoing legal proceedings, or when necessary to resolve disputes and enforce our agreements.
7. Your Privacy Rights
7.1 Consolidated Rights Table
The following table summarizes the privacy rights available to you under applicable law. Because RB ZILLA LLC is a United States-based company, the rights below primarily reflect US state privacy frameworks. The GDPR is named where our processing practices align with its standards.
| Right | Description | Applicable Law |
|---|---|---|
| Right to Know / Access | Request disclosure of the categories and specific pieces of personal information we have collected about you | CCPA; GDPR |
| Right to Deletion | Request deletion of personal information we have collected, subject to certain exceptions | CCPA; GDPR |
| Right to Correction | Request correction of inaccurate personal information | CCPA; GDPR |
| Right to Opt Out of Sale / Sharing | Opt out of the sale of personal information or sharing for cross-context behavioral advertising | CCPA |
| Right to Data Portability | Receive a copy of your personal information in a portable, machine-readable format | CCPA; GDPR |
| Right to Restrict Processing | Request that we limit how we use your personal information in certain circumstances | GDPR |
| Right to Object | Object to our processing of your personal information based on legitimate interests | GDPR |
| Right to Withdraw Consent | Withdraw your consent at any time where we rely on consent as the legal basis for processing | GDPR |
| Right to Lodge a Complaint | File a complaint with a supervisory authority in your country of residence | GDPR |
| Right to Non-Discrimination | We will not discriminate against you for exercising any privacy right | CCPA |
| Right to Appeal | Appeal our decision if we deny your privacy request | US state privacy laws |
These rights may be limited in some circumstances by applicable law.
7.2 How to Submit a Request
To exercise any of the rights listed above, you may:
- Email us directly: privacy@rbzilla.com
- Submit a Data Subject Access Request: https://www.rbzilla.com/privacy/data-request
Authorized agents. Under certain US state privacy laws, you may designate an authorized agent to submit a request on your behalf. We may deny a request from an authorized agent who does not submit proof of valid authorization to act on your behalf in accordance with applicable law. The agent will need to provide written, signed permission from you.
7.3 Request Verification
Upon receiving your request, we will verify your identity before processing it. We will only use personal information provided in your request to verify your identity or authority to make the request. Verification may require you to confirm your email address or supply additional identifying information. If we cannot verify your identity from information already maintained by us, we may request additional information for verification and security purposes. We will not fulfill requests we cannot verify.
7.4 Response Timelines
We aim to acknowledge all privacy inquiries within 5 business days.
- GDPR (EEA/UK): We respond to requests within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension within one month of receipt, together with the reasons for the delay, as the GDPR requires.
- US state privacy laws (CCPA/CPRA, VCDPA, etc.): We respond to verifiable requests within 45 days of receipt. If we require additional time (up to 45 additional days), we will notify you in writing within the initial 45-day period, explaining the reason for the extension.
7.5 Appeals
If we decline to take action regarding your request, you may appeal our decision by emailing privacy@rbzilla.com with the subject line "Privacy Appeal." We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general or the applicable supervisory authority.
Complaints (United Kingdom). If you are in the United Kingdom, you have the right to make a data protection complaint directly to us before contacting the regulator. You can complain by emailing privacy@rbzilla.com. You do not have to use a particular form or channel — if you raise a concern with us any other way, we will treat it as a complaint. We will acknowledge your complaint within 30 days of receiving it and will investigate and respond without undue delay, keeping you informed of our progress. If you are unsatisfied with our final response, you may complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.
8. Cookies and Tracking
We use cookies on the Website. The table below describes every cookie category.
| Category | Purpose | Cookies | Lifespan |
|---|---|---|---|
| Strictly Necessary | Store your consent preferences so we respect your choices across visits | cc_cookie |
366 days (a choice stored on or before September 17, 2026 may instead expire after 182 days) |
| Analytics (on by default in the United States until you opt out; opt-in everywhere else) | Measure website traffic, page performance, visitor behavior, and interactions such as link clicks via Google Analytics | _ga, _ga_<container-id> |
_ga and _ga_<container-id>: 2 years, as set by Google (Chrome keeps them for 400 days). Safari, and other browsers on iPhone and iPad, may delete them after 7 days. |
No marketing, advertising, or functional cookies are set by this Website.
You can manage your cookie preferences at any time by clicking "Consent Preferences" in the Website footer. You may also manage cookies through your browser settings; however, deleting the consent cookie (cc_cookie) will cause the consent banner to reappear on your next visit. If you choose to remove or reject cookies, this could affect certain features of the Website.
We determine your region from the country that our hosting provider, Cloudflare, derives from your IP address (the country-level location described in Section 2). This is an approximate signal: a VPN or proxy can make your connection appear to be in another country. If Cloudflare reports no location for your connection at all, we fall back to your browser's time zone. If you visit from the United States (the 50 states and the District of Columbia), analytics is on by default, consistent with applicable US state privacy laws, and covers page views and interactions such as link clicks until you opt out. You can opt out with the Opt Out button in the consent banner, under "Consent Preferences" or "Do Not Sell or Share My Personal Information" in the Website footer, or by enabling Global Privacy Control. Everywhere else, including the EEA, the UK, Switzerland, and US territories, and whenever your location cannot be determined, analytics cookies are off by default and require your explicit opt-in consent.
Google Analytics. We use Google Analytics to track and analyze use of the Website. Our consent banner loads the Google Analytics script directly from Google only when analytics is allowed as described above, and never while your browser sends a Global Privacy Control signal. Before it loads, Google's consent signals are set to "denied". When analytics is allowed, only analytics storage is granted. Advertising storage, ad user data, and ad personalization stay denied, and Google signals and ad personalization are turned off for our property. To opt out of being tracked by Google Analytics across websites, visit https://tools.google.com/dlpage/gaoptout. For more information on Google's privacy practices, visit the Google Privacy & Terms page.
For additional detail, please refer to our Cookie Policy.
9. Global Privacy Control and Do Not Track
Global Privacy Control (GPC). We honor the Global Privacy Control signal. When we detect a valid GPC signal from your browser, we treat it as a request to opt out of the sale and sharing of your personal information, consistent with the California Consumer Privacy Act and other applicable state laws that recognize GPC as a valid opt-out mechanism.
We detect GPC through two mechanisms: (1) the navigator.globalPrivacyControl JavaScript property in your browser (client-side), and (2) the Sec-GPC HTTP request header on server-side API endpoints (such as our consent logging function). Both mechanisms produce the same result.
When a GPC signal is detected, non-essential cookies are automatically denied and the consent banner is suppressed in all regions, including both opt-out mode (the United States) and opt-in mode (everywhere else). In opt-in mode, analytics cookies are already off by default, so GPC produces the same outcome as the default behavior. While your browser sends a GPC signal, Google Analytics does not load in any region, even if you turn analytics on in the consent preferences panel. On your first visit with GPC, we record the signal as a refusal in our consent log (see Section 3).
Note on server-side processing. While the Website's pages are statically generated and served without server-side rendering, we operate a small number of server-side API functions (hosted on Cloudflare Pages Functions). Data Subject Access Requests are submitted from your browser directly to our compliance platform (Codex Titan) using a publishable API key (Pattern A) — they are not proxied through our Pages Functions. Server-side Pages Functions are used for: (1) logging consent actions as proof of consent under the GDPR (the remaining personal-data proxy to Codex Titan), (2) telling the consent banner which country Cloudflare places your connection in, so it can choose opt-in or opt-out mode (the answer goes only to your browser and is not stored), (3) re-issuing your consent-choice cookie (cc_cookie) from the server so your browser keeps it for its full term (it reads only that cookie and sends it back only to your browser), and (4) receiving compliance document update notifications from our internal compliance platform to trigger site rebuilds (no personal data is processed by this notification function). No other server-side function processes personal data. Consent-log processing is described in Section 5.1.
Do Not Track (DNT). We do not respond to the Do Not Track browser signal. At this time, no uniform technology standard for recognizing and implementing DNT signals has been finalized, and the signal has not been adopted into enforceable law. California law requires us to disclose how we respond to DNT signals; as stated, we do not currently respond to them. If you wish to limit data collection, we recommend enabling Global Privacy Control (GPC), which has a defined legal meaning under applicable US state privacy laws.
10. United States State Privacy Rights
If you are a resident of a U.S. state with a comprehensive privacy law (including but not limited to California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of or delete your personal information, and withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.
10.1 Categories of Personal Information We Collect
The table below shows the categories of personal information (as defined in the California Consumer Privacy Act) we have collected in the past twelve (12) months through the Website.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | IP address, online identifier, cookie identifiers | YES |
| B. Personal information (Cal. Cust. Records) | Name and email address when voluntarily submitted via the DSAR form or email inquiry (no financial information) | YES |
| C. Protected classification characteristics | Gender, age, race, ethnicity | NO |
| D. Commercial information | Transaction history, purchase records | NO |
| E. Biometric information | Fingerprints, voiceprints | NO |
| F. Internet or similar network activity | Pages visited, browsing behavior, interactions with the Website | YES |
| G. Geolocation data | Country-level location (derived from IP address) | YES |
| H. Audio, electronic, sensory, or similar information | Audio, video, or call recordings | NO |
| I. Professional or employment-related information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences drawn from collected personal information | Preferences, characteristics | NO |
| L. Sensitive personal information | NO |
We will use and retain the collected personal information as described in Section 6:
- Category A — analytics: 2 months (event-level data) and 14 months after your most recent visit (user-level data) / 72 hours (server logs)
- Category F — analytics: 2 months (event-level data) and 14 months after your most recent visit (user-level data); consent action logs: 24–25 months (see Section 6)
- Category G — analytics: 2 months (event-level data) and 14 months after your most recent visit (user-level data) / 72 hours (server logs)
10.2 California-Specific Disclosures
CCPA/CPRA. California residents have the rights described in Section 7 under the California Consumer Privacy Act as amended by the California Privacy Rights Act. We respond to verifiable consumer requests within 45 days of receipt. If we deny your request, you may appeal by contacting us at privacy@rbzilla.com with the subject line "CCPA Appeal." You may also contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov.
Sale and sharing. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We do not sell personal information, including the personal information of minors under 16 years of age.
California's "Shine the Light" law. California residents may request, once per year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of those third parties. We do not disclose personal information to third parties for their direct marketing purposes.
Financial incentives. We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.
10.3 Virginia (VCDPA)
Virginia residents have rights under the Virginia Consumer Data Protection Act. We respond to requests within 45 days, with a possible 45-day extension upon notice. If we deny your request, you may appeal within a reasonable time by emailing privacy@rbzilla.com. If your appeal is denied, you may contact the Virginia Attorney General at https://www.oag.state.va.us.
10.4 Other US States
Residents of other states with comprehensive privacy laws (including but not limited to Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Utah) may have similar rights under their respective state statutes. We honor those rights on the same 45-day response timeline and through the same request channels described in Section 7.2.
11. International Data Transfers
RB ZILLA LLC is headquartered in the United States. If you access the Website from outside the United States, your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.
Our service providers, including Cloudflare and Google, operate globally, which means your data may transit or be processed in multiple countries. We take steps to ensure that any international transfers of personal information are subject to appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) and UK transfer tools: Where required, we rely on the European Commission's Standard Contractual Clauses to govern transfers of personal data from the European Economic Area or Switzerland to countries not recognized as providing an adequate level of protection. For United Kingdom transfers, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable. Agreements with our service providers (including Cloudflare and Google) incorporate SCCs or equivalent mechanisms.
- Adequacy Decisions: Where the European Commission or another competent authority has issued an adequacy decision for the destination country, we rely on that decision as the transfer mechanism.
- Vendor Data Processing Agreements: We enter into data processing agreements with all sub-processors that impose data protection obligations consistent with applicable law.
By using the Website, you acknowledge that your information may be transferred to and processed in the United States and other countries as described in this section.
12. Children's Privacy
The Website is not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16. We do not knowingly sell or share the personal information of consumers under 16 years of age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at privacy@rbzilla.com. We will promptly investigate and, if confirmed, delete the information from our systems.
13. Security Measures
We implement technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. All data transmitted between your browser and the Website is encrypted in transit using TLS (Transport Layer Security). The Website is hosted on Cloudflare Pages, which provides DDoS protection, Web Application Firewall (WAF) capabilities, and edge-level security. Access to our Cloudflare and analytics accounts is restricted to authorized personnel and secured with multi-factor authentication.
While no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, we are committed to maintaining reasonable and appropriate safeguards proportionate to the sensitivity of the data we process. If we become aware of a security incident that compromises personal information we hold about you, we will assess the incident and notify affected individuals and/or the relevant supervisory authorities without undue delay where required by applicable law — including under the GDPR and comparable duties under applicable US state privacy laws. We do not commit to a shorter contractual notification SLA than those legal obligations require. Where notification is required, we will describe the nature of the incident, the categories of data involved (to the extent known), and the steps we are taking, by prominent notice on the Website and, where we hold an email address for you, by email.
14. Changes to This Policy
We update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The effective date at the top of this document identifies when the current version took effect. Prior versions are available upon request by contacting us at privacy@rbzilla.com.
When we make material changes to this policy — such as changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will provide at least fourteen (14) days' advance notice by displaying a prominent notice on the Website prior to the change taking effect.
Your continued use of the Website after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should discontinue use of the Website and submit a deletion request through the channels described in Section 7.
15. Contact Information
If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:
RB ZILLA LLC General Inquiries: hello@rbzilla.com Legal: legal@rbzilla.com Privacy Inquiries: privacy@rbzilla.com Website: https://www.rbzilla.com Mailing Address: 116 E Main St, Suite 201, Rock Hill, SC 29730, United States
Submit a Privacy Request (DSAR): https://www.rbzilla.com/privacy/data-request or email privacy@rbzilla.com
EU/UK Representative. We have not appointed an EU/UK representative under the GDPR at this time. Our processing of personal data of individuals in the EEA/UK is limited: analytics is off unless you opt in (see Section 8), and we do not engage in large-scale processing of sensitive data or systematic monitoring of individuals. We will re-evaluate this assessment if EEA/UK processing becomes regular, large-scale, or involves systematic monitoring. If you are located in the EEA or UK and have a privacy concern, please contact us at privacy@rbzilla.com.
This Privacy Policy was prepared for RB ZILLA LLC and is effective as of September 25, 2026. It covers only the Website at rbzilla.com and does not govern other RB ZILLA LLC products or services. The effective date is the sole document identifier; consent-banner revision numbers identify the CookieConsent tool configuration, not this policy version. Prior versions are available upon request by contacting us at legal@rbzilla.com.