Privacy Policy

1. Who is responsible

Lumination Ltd Co, doing business as RSC, 5878 Bradley Ct, Frisco, TX 75035, USA, is the business responsible for personal data collected through the partners portal at partners.rs-chain.com, the public pages at rs-chain.com that lead to it, and the emails and text messages we send in connection with it. Questions and requests: support@rs-chain.com.

This policy covers partner (buyer) accounts, applicants, and the people at those businesses who use the portal. Members who sell to RSC through the member platform are covered by the member Privacy Policy on rs-chain.com. Team members and contractors who use the portal for timesheets are covered by their engagement terms and by the sections below that apply to account, security and activity data.

2. What we collect

We collect only what the portal needs to run a wholesale relationship:

• Application details: business name, contact name, email, phone, country and region, store or website links, expected volume, how you heard about us, your message, and your marketing consent choices.
• Account and profile: name, company, email, phone, tax information you provide, billing and shipping addresses, saved store locations and shipping contacts, your time-zone (team accounts), and the time zone and theme preferences you set.
• Sign-in and security: the email address used to sign in, one-time codes, session and device information, IP address and browser type, and a log of security-relevant actions (sign-ins, invitations, changes to contact details).
• Orders and money: quotes you request, offers you accept, orders, invoices, payment method, payment status and references. When you pay by card, the card is processed by Stripe; RSC stores only the card brand, last four digits, amount and receipt link, never the full card number.
• Shipping: recipient names, addresses, phone numbers, package details, tracking numbers, delivery events, and, for the client label desk, the sender and recipient details, customs information and pickup details you enter.
• Communications: emails and messages you exchange with us, notes you add to quotes or orders, and whether marketing emails were delivered, opened or clicked.
• Consent records: what you agreed to, the wording version, the time, your IP address and browser, so we can show the consent existed.
• Usage and device data: pages visited, actions taken in the portal, error reports, approximate location from IP address, and cookies described in section 8.

3. What we use it for

To review applications and open accounts; to show you a catalog, pricing and offers; to price quotes; to take, allocate, invoice and ship orders; to reconcile payments with our bank and accounting records; to book shipping labels and pickups you request; to answer support requests; to detect fraud, misuse and unpaid accounts; to keep the portal secure; to meet tax, accounting, export and sanctions obligations; and, with your consent, to tell you about special offers and partner updates.

For visitors from the EEA, the UK and other places with similar laws, our legal bases are: performing our contract with you (accounts, orders, shipping, invoicing, support); our legitimate interests in running, securing and improving a wholesale business and in preventing fraud, balanced against your interests; your consent (marketing email, text messages, non-essential cookies); and compliance with legal obligations (tax, accounting, export controls, sanctions).

We use automated tools to suggest matches between bank deposits and invoices and to rank prices; a person reviews before anything is applied to your account. We do not make decisions with legal or similarly significant effects on you by automated means alone.

4. Who we share it with

We share personal data with service providers who process it for us under contract, and with carriers and authorities where needed. We do not sell personal data and do not share it for third-party advertising.

• Clerk (sign-in and session management), Supabase (database hosting) and Vercel (application hosting, logs, anonymous performance analytics), all in the United States.
• Stripe, for card payments and receipts. Your bank, Wise and our bank for wires and transfers you send.
• FedEx and other carriers you select, who receive the sender, recipient, package and customs details needed to move a shipment.
• Intuit QuickBooks, our accounting ledger, which mirrors customer names, invoices and payments.
• Resend, which delivers our emails and reports delivery, opens and clicks. Our SMS provider, if you have consented to text messages.
• Google (Google Analytics and Google Ads conversion measurement) only if you accept measurement cookies; and the identifiers Google attaches to an ad click when you arrive from one of our ads.
• Anthropic, whose AI models help our team summarize and reconcile order, invoice and support text. Your data is not used to train their models under our agreement.
• Our team's internal notification channel (Discord), which receives short alerts such as a new application, quote, claim or order, containing your business name and the amount.
• Professional advisers, auditors, banks and insurers as needed to run the business; and courts, regulators, carriers' claims departments and law enforcement where the law requires it or where we need to establish, exercise or defend legal claims.
• A buyer or successor if RSC or the portal is sold or reorganized, under this policy.

5. International transfers

RSC is in the United States and our providers are mostly US-based. If you are in the EEA, the UK, Switzerland or another country with transfer rules, your data is transferred to the United States to run the service. Where required, we rely on the providers' standard contractual clauses or the EU–US Data Privacy Framework certifications they hold. Contact us for details of the safeguards in place.

6. How long we keep it

Account, order, invoice, payment and shipping records: for the life of the account and then for as long as tax, accounting and export law requires, which is generally seven years. Consent records: for as long as the consent is relied on, then as evidence for the period in which a complaint could be made. Marketing engagement data: 24 months. Security and activity logs: 24 months. Application data for declined applicants: 12 months. Backups roll off on a fixed schedule after deletion from the live system.

7. Your choices and rights

Marketing: switch email offers on or off under Profile in the portal or with the unsubscribe link in any marketing email; reply STOP to any text message. Transactional messages continue while the account is open.

Depending on where you are, you may have the right to access the personal data we hold, to have it corrected or deleted, to receive a copy in a portable format, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. Texas residents have the rights set out in the Texas Data Privacy and Security Act, including the right to know, correct, delete and opt out of targeted advertising; we do not sell personal data or engage in targeted advertising as defined there. California residents may exercise their rights under the CCPA/CPRA to the extent it applies.

To exercise a right, email support@rs-chain.com from the address on your account, or write to the address in section 1. We will verify the request and answer within 45 days, extendable once where the law allows. We will not treat you differently for exercising a right. Some records must be kept even after a deletion request, such as invoices and consent evidence; we will tell you what is kept and why.

EEA and UK residents may complain to their local data protection authority; UK residents to the Information Commissioner's Office.

8. Cookies and similar technologies

The portal uses a small set of cookies and browser storage:

• Essential: sign-in session cookies set by Clerk; a region cookie (rsc.region) so prices show in your currency; and your consent choice (rsc.consent). These are needed for the site to work and cannot be switched off.
• Preferences: theme (light or dark), collapsed sidebar, the last catalog draft you were working on, and similar settings stored in your browser only.
• Measurement (with consent): Google Analytics and Google Ads conversion tags load only after you accept them in the cookie notice; you can change your choice by clearing the rsc.consent cookie. Vercel's anonymous performance analytics uses no cross-site identifiers.
• Email: marketing emails may include an open-tracking image and click-tracked links, provided by Resend, so we can see whether an offer was read. Transactional emails do not.

9. Security

Access to the portal is by one-time email code; staff access is role-based and logged. Data is encrypted in transit and at rest with our providers; card numbers never touch our systems. We keep an activity log of security-relevant events and review it. No system is perfectly secure; if we learn of a breach that affects you we will tell you and any regulator as the law requires.

10. Children

The portal is for businesses and their adult representatives. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes to this policy

The current version and effective date are always at partners.rs-chain.com/legal/privacy. For material changes we will email account holders or show a notice in the portal before they take effect. Earlier versions are available on request.

12. Contact

Lumination Ltd Co, DBA RSC · 5878 Bradley Ct, Frisco, TX 75035, USA · support@rs-chain.com