Privacy Policy

Rito is operated by GKWJ LLC, doing business as 7 Pro Labs, 1512 Little Wren Ln, Winter Park, FL 32792, United States. Contact: [email protected].

Representative in the European Union (Article 27 GDPR): Gabriel Torres de Souza, Av. da Liberdade 318, 4710-250 Braga, Portugal. You may address any question about the processing of your data to the representative, in addition to or instead of 7 Pro Labs, at this address or at [email protected]. Supervisory authorities may do the same.

The law firm using the platform is the controller of its clients', cases', documents' and communications' data. 7 Pro Labs acts as a processor when it processes that data on the firm's behalf, under the General Data Protection Regulation (GDPR) and the Data Processing Agreement.

We may process identification, contact and professional data, case data, uploaded documents, messages, tasks, billing, electronic signatures and the technical metadata needed to secure and operate the service.

When a member connects their Google account, we also process the data described in section 10. When the firm connects its WhatsApp or Instagram, we process the data described in section 11. When a person turns on notifications on a phone or browser, we process the data described in section 12.

Data is processed to provide the service, authenticate users, manage organizations, clients and cases, send communications, produce reports, keep audit records, prevent abuse and comply with applicable legal obligations.

To protect personal data, including sensitive data and data obtained from Google, we apply the following technical and organizational measures:

• Encryption in transit: traffic between the browser and Rito, between Rito and its database, and between Rito and Google APIs is encrypted with TLS (HTTPS). The site sends the HSTS header, which prevents unencrypted connections.
• Encryption at rest: the database, files and their backups are hosted by Supabase in the European Union (Frankfurt, Germany) on AES-256 encrypted storage.
• Additional encryption of Google credentials: Google access and refresh tokens are encrypted by the application itself with AES-256-GCM before they are stored. The key is not in the database — it exists only in the application server's environment — so a copy of the database would not allow anyone to use those tokens. Tokens are never sent to the browser.
• Tenant isolation and access control: every request is checked against the authenticated user's firm and permissions, and one firm's data is never served to another. The database grants no access to visitors or users through Supabase's public API: only the application server and authorized operator tools reach it, with credentials that never reach the browser.
• Authentication: passwords are never stored in plain text; the authentication provider (Supabase Auth) stores only a hash.
• Protected Google authorization flow: the authorization request carries a signed (HMAC-SHA256) parameter, checked against a cookie and valid for 10 minutes, which prevents cross-site request forgery (CSRF).
• Least privilege: we request from Google only the scopes needed for the features described in section 10. We do not request access to Gmail, Google Drive, contacts or any other Google account data.
• Restricted internal access: only authorized 7 Pro Labs personnel can access production systems, and only to provide support, keep the service secure or meet legal obligations. Administrative actions and relevant actions inside each firm are recorded in audit logs.
• Monitoring and incident response: errors and technical events are monitored. In the event of a personal data breach, we notify the firm without undue delay and, where the law requires it, the supervisory authority and the data subjects.
• Automatic, encrypted backups for recovery in case of failure.

• Account and firm data: while the account is active and for up to 30 days after it is closed, unless the law requires otherwise.
• Items deleted by users (clients, documents, tasks, invoices): kept for 90 days, then permanently deleted by a daily automated job.
• Billing data: for the applicable tax retention period.
• Audit logs: for as long as needed for security, proof of operations and legal obligations.
• Technical logs: background job history is deleted every week once it is older than 14 days; error logs are kept for up to 90 days.
• Backups: rotated on a cycle; deleted data is gone from backups within 30 days.

Data obtained from Google follows its own, shorter rules, described in section 10.5.

You can request deletion of your data at [email protected]. We respond within 30 days; where the data is processed on behalf of a law firm, we coordinate the request with that firm.

Providing the service involves hosting, database and authentication, payments, email, real-time notification, error monitoring and artificial intelligence providers. The application server is hosted by Hostinger (United Kingdom) and the database and files by Supabase (Frankfurt, Germany). All site traffic passes through Cloudflare (proxy and attack protection), which decrypts it on its network to route it to the server. These providers are used only when needed to operate the platform and are bound by contract. Electronic signatures are produced by Rito itself, with no external provider. Notifications on phones and computers are delivered by the push services of Google, Apple, Mozilla and Microsoft (section 12).

The WhatsApp assistant replies with models from OpenAI (GPT-6 Luna) or Anthropic (Claude), depending on the firm, and voice messages are transcribed by OpenAI with Groq as a fallback — all in the United States, under the European Commission's Standard Contractual Clauses and terms under which the data sent is not used to train models. These providers never receive Google data (section 10.3).

The full list, with each provider's purpose and location, is at https://rito.7prolabs.com/legal/sub-processors.

Data subjects may request access, rectification, erasure, restriction, portability or objection from the law firm responsible for their data.

Requests about a Rito account can be sent to [email protected]. Where the data is processed on behalf of a law firm, we may forward the request to that firm or respond in coordination with it.

We use essential cookies for authentication, session and security. Analytics and campaign measurement cookies are only enabled after the user accepts them in the cookie notice.

With that consent, the site's public pages, such as the home page, the sign-in and sign-up pages and the legal pages, load Google Tag Manager to measure where visits come from and how advertising campaigns perform, following Google's Consent Mode v2, including Google Analytics and the Meta Pixel. You can change your choice under «Definições de cookies» in the site footer. The list of cookies is at /legal/cookies.

These tools are never loaded in the platform's authenticated areas or on pages that carry an access token, so case, client, signature or booking addresses are never disclosed to third parties.

This section applies to people who are not yet Rito customers and leave us their details to learn more about the platform. For this data, 7 Pro Labs is the controller, not a processor acting for a law firm.

Where the data comes from

• Meta lead forms (Instant Forms) in Rito's ads on Facebook and Instagram;
• the forms on Rito's website;
• direct contact with us, by WhatsApp, email or any other means.

What we collect

Name, phone or WhatsApp number, email address and the answers given in the form: professional role, country of practice, practice area and the approximate volume of contacts received on WhatsApp.

What we use it for

To contact you about Rito, book demos, send commercial proposals and work out whether Rito fits your practice (lead qualification). This data is not sold, nor shared with third parties for their marketing.

Legal basis

• Consent (Art. 6(1)(a) GDPR), given through the form's checkbox, for us to contact you by WhatsApp and email. You can withdraw it at any time, without affecting the lawfulness of contacts made before then.
• Legitimate interest (Art. 6(1)(f) GDPR) in business-to-business commercial follow-up, after your request for information. You can object at any time, and we then stop contacting you.

Where it is stored

In Nexo, the CRM operated by 7 Pro Labs itself. The Nexo application is hosted by Hostinger (Manchester, United Kingdom) and its database by Supabase, in the European Union (Ireland). Nexo is listed at https://rito.7prolabs.com/legal/sub-processors.

Meta

When you fill in a form in a Facebook or Instagram ad, Meta Platforms collects that data under its own terms and policies and passes the answers on to us. Meta is not our processor for this purpose.

Retention and deletion

If you do not become a customer, your data is deleted 12 months after the last contact. If you do, it follows the retention rules in section 5.

Stopping contact

You can ask us to stop contacting you at any time by replying “PARAR” on WhatsApp or by writing to [email protected]. We act on the request within 30 days.

You can also exercise the other rights described in section 7. For this data, the request goes directly to 7 Pro Labs, at the same address.

This section describes how Rito accesses, uses, stores, shares, protects, retains and deletes data obtained through Google APIs. It applies only to members who choose to connect their Google account to Rito's calendar, under Settings → Booking → “Google Calendar”. The connection is personal: each member connects their own account.

10.1 Data we access

• “calendar.events” (view, create, change and delete events on the account's calendars): to write Rito's consultations to the chosen calendar, show events from the selected calendars in the Agenda, and let the member edit or delete their own events from the Agenda, and create the Google Meet link of online consultations.
• “calendar.calendarlist.readonly” (view the account's list of calendars, with name, color and permissions): so the member can choose the destination calendar and the calendars to check. This scope gives no access to events.
• “openid” and “email”: to identify the connected Google account, whose email address is shown to the member in settings.
• We do not request access to Gmail, Google Drive, contacts or any other Google account data.

10.2 How we use the data

• Create, update and remove, on the calendar the member chose, the Rito consultations and appointments they take part in — booked in the Agenda, through the public booking link or by the WhatsApp assistant.
• Read events from the calendars the member selected, only for the date range on screen, to show them in their Agenda and — only if the member shared them (section 10.3) — in their colleagues' Agenda.
• Work out when the member is busy, so booking links and the WhatsApp assistant never offer overlapping times.
• At the member's request, change or delete one of their own Google events from the Agenda.
• For an online consultation where the firm chose “Create the Google Meet link automatically”, ask Google for a Google Meet link on the event created in the organiser's calendar, and use it for that consultation.
• List the account's calendars so the member can choose which ones to use.

Google data serves only these features, which are visible in Rito's interface. It is not used for advertising, it is not sold, and it is not used to develop, improve or train artificial intelligence or machine learning models.

10.3 Sharing

• With colleagues in the same firm, only if the member chooses to, calendar by calendar: “Busy” (colleagues see only the time) or “Details” (title, location and description). By default every calendar is private. An event marked private in Google always shows as “Busy” only.
• The Google Meet link created for an online consultation is given to that consultation's participants: the firm members taking part and the client, in the booking confirmation.
• WhatsApp assistant (artificial intelligence): when it offers times to a client, the assistant receives only the free slots, computed from the busy periods. The title, description, attendees and location of Google events are never sent to an artificial intelligence model.
• Infrastructure providers: the data passes through the application server (Hostinger, United Kingdom) and is stored in the database (Supabase, Frankfurt), under contract and only to operate the service.
• Where required by law, or as part of a merger, acquisition or sale of assets — in that case only with the member's explicit prior consent.

We do not share Google data with anyone else, nor transfer it to other applications.

10.4 What we store and how we protect it

Rito stores only:

• the Google access and refresh tokens, encrypted with AES-256-GCM (section 4);
• the email address of the connected Google account;
• the IDs and names of the chosen calendars and each one's color and sharing preferences;
• the ID of each event Rito itself created in Google, so it can update or remove it later;
• the Google Meet link Rito created for an online consultation, stored on the consultation itself as the meeting's address;
• the time of the last sync and the last error message returned by Google, if any.

The content of events read from Google (titles, descriptions, attendees, locations) is not stored: it is fetched when requested, sent encrypted to the member's browser and discarded by the server. All of this data is protected by the measures in section 4.

10.5 Retention and deletion

• The data in section 10.4 is kept only while the connection is active, with one exception: a consultation's Google Meet link stays with that consultation, because its participants have already received it, and follows the retention of the rest of the consultation's data (section 5).
• When the member disconnects (Settings → Booking → “Disconnect”), Rito immediately revokes the authorization with Google and deletes the tokens, the account email, the calendar settings and the IDs of the events it created. If the same Google account is also connected in another firm on Rito, the authorization is revoked once it is disconnected there too.
• If the member is suspended or leaves the firm, the connection is deleted the same way. A daily automated job confirms no connection remains for anyone who is no longer an active member.
• If Google refuses the authorization (for example, because the member removed it in their Google account) and the account is not reconnected within 30 days, the connection and its data are deleted automatically.
• If the firm is deleted, all of its members' Google connections are deleted with it.
• Deleted data is gone from our encrypted backups within 30 days.
• Events Rito has already written to the member's calendar stay in Google, under the member's control, and can be deleted there at any time.

You can remove Rito's access at any time at https://myaccount.google.com/permissions, or request deletion of this data at [email protected] — we act on the request within 30 days.

10.6 Limited Use disclosure

Rito's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs, including the Google Calendar API, will adhere to the Google User Data Policy, including the Limited Use requirements. Specifically:

• we use the data only to provide the features described in section 10.2, which are visible in Rito's interface;
• we transfer it only in the cases listed in section 10.3;
• we do not use it for advertising, including personalized, retargeted or interest-based advertising;
• we do not sell it, nor use it to determine creditworthiness or for lending purposes;
• we do not use it to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models;
• no one at 7 Pro Labs reads this data, except with the member's affirmative agreement for specific data (for example, a support request), when necessary for security purposes such as investigating abuse, to comply with the law, or when aggregated and anonymized for internal operations.

A firm's owner or administrator can connect the firm's WhatsApp Business number to Rito (through Meta's WhatsApp Business Platform) and its Instagram professional account (through Instagram Login, with the permissions instagram_business_basic, instagram_business_manage_messages and instagram_business_manage_comments). Each connection is made by the firm itself, for its own accounts, and can be removed at any time in Settings → WhatsApp or Settings → Instagram.

What we receive

• the messages customers send to those accounts (text, images, audio, video and documents) and the team's replies;
• the name, WhatsApp number or Instagram username of the person writing;
• on Instagram, the comments on the account's own posts and the commenter's username;
• the IDs and names of the connected accounts and their access tokens, encrypted.

What we use it for

Only to show the conversations in the firm's shared inbox; send the replies the team writes; send the automated replies the firm itself configures (on Instagram, a private message to someone who comments a keyword and, optionally, a public reply to the comment, within Meta's limits); transcribe voice messages; and the assistance features the firm turns on, through the sub-processors in section 6. This data is not sold, not used for advertising, not shared with other Rito customers and not used to train models.

Retention and deletion

The data stays in the firm's workspace while the firm is a customer and is deleted as described in section 5. Disconnecting an account stops Rito receiving its data. The owner of an Instagram account can also remove the authorisation in Instagram → Settings → Apps and websites, or ask Meta to delete their data: Rito then deletes the token, the account identifiers and the stored comments. Conversations already received are the firm's records and only the firm can delete them. Deletion requests can also be sent to [email protected]; the instructions shared by all 7 Pro Labs products are at https://7prolabs.com/data-deletion.

Meta Platforms processes this data as the platform the firm chose, under its own terms and policies; it is not a Rito sub-processor.

Each person can receive Rito's notifications outside the open app: in the Rito apps for iPhone and Android and in web browsers. It is the person's own choice, device by device: Rito sends nothing to a phone or browser where they have not turned notifications on.

How they are turned on

In a browser, under Settings → Notifications → “Turn on notifications”, or from the invitation Rito shows in the corner of the screen, with the permission the browser asks for. In the app, the phone asks whether the person allows notifications, and the app only obtains the device identifier once they accept. Also under Settings → Notifications, each person chooses, per group of notices and in each firm, what reaches “Phone and computer”; anything switched off is not sent to any push service.

What we store per device

• in a browser: the delivery address the browser assigns to the subscription (endpoint), and the public key (p256dh) and authentication secret (auth) Rito uses to encrypt notifications for that browser;
• in the app: the Firebase Cloud Messaging registration token;
• in both cases: the browser or app identification sent by the device (user agent), the firm in which the device was last registered, the number of consecutive failed deliveries, the dates of registration, of the last change and of the last successful delivery and, where applicable, the date the device was retired.

Who delivers the notifications

• In the Rito apps: Google (Firebase Cloud Messaging, in Rito's own project) and, on iPhone, also Apple (Apple Push Notification service), to which Google hands the notification. These services receive the notification in clear: the title and text, which may include, for example, a client's name and the start of their message, the start of a team chat message or a task's title; the address of the Rito page the notification opens and the notification's technical identifiers; the number of unread notices; and the device identifier.
• In browsers: the browser's own push service — Google (Chrome, Brave and Opera), Apple (Safari), Mozilla (Firefox) and Microsoft (Windows Push Notification Services, in Edge). Rito encrypts each notification end to end (RFC 8291) with that browser's keys, and the service sees only metadata, such as the delivery address, the size, the time and that the notification comes from Rito.
• In the team chat: in a confidential conversation, or for someone who turned off “Show message content in notices”, the notification says only who wrote and in which conversation, never the text.

Google, Apple, Mozilla and Microsoft are named in the sub-processor list (section 6) and process these notifications in the United States, under the safeguards that apply to international transfers.

What we use it for

Only to notify the person, on the device they chose, of what Rito shows them in the bell, the inbox or the chat. This data is not sold, not used for advertising and not shared with other Rito customers.

Retention and deletion

• “Turn off”, under Settings → Notifications, immediately deletes that browser's record.
• When the person signs out from Rito's menu, the browser cancels its subscription and the app deletes its token; at the next delivery the service answers that the device is no longer subscribed, and Rito retires it.
• Rito also retires a device when the push service answers that the subscription no longer exists (404 or 410), and after 5 consecutive failed deliveries.
• A retired device receives no further notifications; its record is kept, unused, until the person's login account is deleted.
• In the app, turning notifications off in the phone's settings stops them from appearing, but does not retire the device: to do that, sign out of the app.

Material changes to this policy are announced by email or in the app, normally 30 days before they take effect. A change that broadens how we use Google data only applies after the member consents again.

Email: [email protected]. Address: GKWJ LLC, d/b/a 7 Pro Labs, 1512 Little Wren Ln, Winter Park, FL 32792, United States. Representative in the European Union: Gabriel Torres de Souza, Av. da Liberdade 318, 4710-250 Braga, Portugal.

You may lodge a complaint with the competent data protection authority. In Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD).