Privacy Policy

Rescuer Robots Privacy Policy (Revised)
Effective January 5, 2026
Last Updated: January 5, 2026

​

Rescuer Robots (rescuerrobots.com) collects, uses, and protects personal data following Cornell University's Privacy Principles: notice/awareness, choice/consent, data integrity/purpose limitation, access/participation, and enforcement/accountability.

​

Data Classification and Collection

We classify and minimize data collection per Cornell Policy 5.10 standards:

​

CategoryExamplesPurposeRetentionContact Info (Low Risk)Name, email, phone, shipping addressOrder processing, support7 years post-transaction (tax/legal)Payment Data (High Risk)Last 4 card digits, transaction IDFraud prevention, receipts7 years; full cards never storedDevice/Usage (Public)IP address, browser type, pages visitedAnalytics, site improvement12 months or IP anonymizedAccount DataUsername, hashed password, order historyAccount managementUntil deletion request + 90 days

No sensitive data (e.g., health, biometrics) collected. Logging/auditing per Policy 5.9 analogs.

​

Lawful Uses and Processing Limits

Data processed only for specified, compatible purposes with explicit consent where required:

​

• Fulfill orders/shipping via providers (USPS, UPS).

• Process payments via PCI-compliant processors (Stripe).

• Analytics via Google Analytics (opt-out available).

• Transactional emails; marketing only with opt-in.

• Legal compliance, fraud detection, terms enforcement.

No materially different uses without 30-day notice and opt-out. California CCPA: Processing based on contract necessity or consent.

​

Sharing, Transfers, and Service Providers

Strict limits on disclosure with contractual safeguards (Cornell Policy 4.7 analogs):

​

• Processors: Shipping/payment/hosting vendors bound by DPAs with audits, encryption mandates.

• Legal: Court orders, rights protection, safety emergencies.

• No Sales: Never sold or shared for third-party marketing.

International transfers (if any) use EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

​

Security Controls and Incident Response

Cornell Policy 5.10-compliant safeguards:

​

• Encryption at rest (AES-256) and in transit (TLS 1.3).

• Quarterly access reviews, semiannual vulnerability scans.

• No sensitive data in filenames/URLs; multi-factor authentication required.

• Incident response: Notify affected users and CA AG within 72 hours if breach threshold met (CCPA).

Your Rights: Access, Correction, Deletion

Granular rights with defined processes (30-day response SLA)

1. Access/Portability: Request data copy in structured format (email privacy@rescuerrobots.com).

2. Correction: Update inaccurate data via account or email.

3. Deletion/Right to be Forgotten: Permanent removal except legal holds.

4. Opt-Out/Objection: Marketing, cookies, analytics (browser or email).

5. CCPA Specifics: Non-discrimination for sales opt-out (none occur); authorized agent process.

Appeals: Reply to denial within 45 days. Proof of identity required.

Cookies, Tracking, and Children's Privacy

Essential cookies only; analytics optional with banner opt-out. No third-party marketing trackers. Not directed at children under 13 (COPPA). Knowing collection prohibited; parents contact privacy@rescuerrobots.com for removal.

Policy Updates and Enforcement

Changes posted here with 30-day notice for material updates. Continued use = acceptance. Questions to privacy@rescuerrobots.com. Accountability Officer oversees compliance audits annually.