This Privacy Policy ("Policy") describes how Rhino Tool House ("we," "us," or "our") collects, uses, retains, and protects personal information in connection with RhiKnows (the "Service"), our customer-facing product. This Policy is maintained as part of Rhino Tool House's information security and privacy program and supports our SOC 2 Type II compliance obligations.
1. Purpose for Collecting or Processing Personal Information
Rhino Tool House collects limited personal information through RhiKnows solely to:
Create and administer individual user accounts for customers and authorized users of the Service.
Authenticate users and control access to the Service.
Communicate with users about their account, the Service, support requests, and material changes to the Service or this Policy.
Maintain accurate records of who is authorized to access customer environments within RhiKnows.
Rhino Tool House does not use personal information collected through RhiKnows for advertising, profiling, or any purpose unrelated to providing and supporting the Service.
2. Lawful Basis for Collecting or Processing Personal Information
Rhino Tool House processes personal information under the following lawful bases, as applicable:
Performance of a contract — processing is necessary to provide the Service under an agreement with the customer organization and to enable the individual user to access their account.
Legitimate interests — maintaining account security, preventing unauthorized access, and administering the Service are necessary and proportionate to Rhino Tool House's legitimate business interests.
Legal obligation — where applicable, Rhino Tool House may process or retain limited personal information to comply with legal, regulatory, tax, or audit requirements.
Where required by applicable law, Rhino Tool House will identify and document the specific lawful basis relied upon for a given customer or jurisdiction.
3. Scope of This Policy; Controller and Processor Roles
This Policy addresses the personal information Rhino Tool House collects and processes to administer user accounts and access to RhiKnows: the name, work email, and limited technical and log data described in Section 4. This Policy does not address:
Rhino Tool House's own employee and applicant data, which is addressed by Rhino Tool House's internal HR and recruiting privacy notices;
Data collected from visitors to Rhino Tool House's or RhiKnows' marketing websites, which is addressed by Rhino Tool House's website privacy notice; or
The substantive content that customers or their users store, upload, or generate within RhiKnows ("Customer Content"), which is addressed by the Data Processing Agreement (DPA) or Master Services Agreement (MSA) between Rhino Tool House and the customer.
For the account data described in this Policy, Rhino Tool House acts as a controller (or "business," as that term is used under U.S. state privacy laws) with respect to the personal information it collects to administer accounts and provide the Service. For Customer Content, Rhino Tool House acts solely as a processor (or "service provider"/"processor") acting on the customer's instructions, and the terms of the applicable DPA govern.
4. Types of Personal Information Collected or Processed
RhiKnows is designed to minimize the personal information it collects. The Service collects and processes the following categories of personal information:
First name
Last name
Work email address
Device or push-notification token associated with a user's account, used solely to deliver in-app and push notifications through Firebase Cloud Messaging (see Section 9).
Security and audit log data (e.g., authentication timestamps, IP address, and system activity associated with a user's account), collected for security monitoring and incident detection (see Section 10).
RhiKnows does not intentionally collect Social Security numbers, government identifiers, financial account information, precise geolocation, biometric data, or other sensitive categories of personal information. Personal (non-work) email addresses, personal phone numbers, and home addresses are not requested or required to use the Service.
5. Choice and Consent
Individual user accounts in RhiKnows are provisioned by the user's employer or organization (the "customer") as part of that organization's use of the Service. Because RhiKnows is a business tool provided to employees of Rhino Tool House's customers, individual users typically do not have the ability to opt out of providing the minimum information (name and work email) required to create an account, as this information is necessary to perform the contract between Rhino Tool House and the customer.
Customers are responsible for informing their own employees or authorized users that their name and work email will be provisioned into RhiKnows, and for obtaining any consent required under their own internal policies or applicable law. Users may direct requests to limit, correct, or remove their information to their organization's administrator or directly to Rhino Tool House as described in Section 8.
6. Methods of Collection
Rhino Tool House collects personal information through RhiKnows via the following methods:
Direct entry by an administrator when provisioning a new user account.
Self-service account registration or profile completion by the user, where enabled.
Single sign-on (SSO) or directory synchronization (e.g., via Microsoft Entra ID / Azure AD) when a customer connects their identity provider to RhiKnows.
RhiKnows does not use third-party advertising cookies or cross-site tracking technologies. The Service may use strictly necessary session cookies or similar local storage technologies solely to maintain login state and basic application functionality; these do not collect additional personal information beyond what is described in Section 4.
7. Use, Retention, and Disposal
Personal information collected through RhiKnows is used only for the purposes described in Section 1. Retention is governed as follows:
Active accounts: name and work email are retained for as long as the account remains active and the underlying customer contract remains in effect.
Offboarded users: when an administrator deactivates a user or a customer's contract ends, associated personal information is disabled from active use and removed in accordance with Rhino Tool House's internal data retention schedule.
Backups: information may persist for a limited period in encrypted backups after deletion from production systems, consistent with Rhino Tool House's internal backup retention policy, after which it is purged.
Disposal: personal information is disposed of using secure deletion methods consistent with Rhino Tool House's Media Sanitization and Information Security & Risk policies, such that it is not recoverable through ordinary means.
Specific retention and backup-purge timeframes are maintained in Rhino Tool House's internal Data Retention Schedule, Backup Retention Policy, and Media Sanitization Policy, and are available for audit and customer-diligence purposes upon request. This Policy describes Rhino Tool House's retention and disposal practices; it does not itself set a contractual service-level commitment on timing.
8. Data Subject Rights
Individuals may have rights to access, correct, port, restrict, or request deletion of their personal information, and to object to certain processing, to the extent such rights are provided by a law applicable to them and to Rhino Tool House's processing of their information. Rhino Tool House provides these rights only to the extent required by applicable law, as follows:
Requests may be submitted by the individual or their organization's administrator to privacy@rhinotoolhouse.com.
Rhino Tool House will verify the identity of the requester before acting on a request — for example, by confirming the requester's affiliation with a customer account, or, for a request submitted through an authorized agent, by requiring proof of the agent's authorization together with verification of the individual's identity.
Where applicable law provides an authorized-agent process, Rhino Tool House will accept a request submitted by an authorized agent on the individual's behalf, subject to that verification.
Rhino Tool House will respond to verified privacy rights requests and any applicable appeals within the timeframes required by applicable law. Where permitted by law, Rhino Tool House may extend the applicable response period and will provide notice of the extension as required.
If Rhino Tool House denies a request, Rhino Tool House will communicate the basis for the denial to the requester. Where applicable law provides a right to appeal a denial, Rhino Tool House will provide instructions for submitting an appeal at that time.
Rhino Tool House maintains a log of requests received under this Section, including the date, nature of the request, and outcome.
Because RhiKnows accounts are provisioned by the customer organization, some requests (e.g., account deactivation) may be directed to or coordinated with the customer administrator.
8.1 U.S. State-Specific Data Subject Rights
Rhino Tool House provides the rights described in Section 8 to a resident of a U.S. state only to the extent required by a comprehensive state consumer privacy law that applies both to that individual and to Rhino Tool House's processing of their information. Because RhiKnows principally processes personal information in a business-to-business, employment-related context, most U.S. comprehensive privacy laws exclude this processing from their scope. California is a notable exception: its business-to-business and employment-context exemptions expired December 31, 2022, so California's law applies to this processing.
Rhino Tool House does not extend the rights in this Section on a nationwide or voluntary basis beyond what an applicable law requires. Where no state law applicable to an individual's information grants a right described in Section 8, that right is not available to the individual under this Policy.
Right to Know / Access, Right to Correct, Right to Delete, and Right to Data Portability, where and to the extent granted by an applicable state law.
Right to Opt Out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects — not applicable in practice, as RhiKnows does not engage in these activities.
Right to Appeal a denied request, in states where that right is provided by law.
Right to Non-Discrimination for individuals who have rights under this Section: Rhino Tool House will not deny service, charge different prices, or provide a different level of service to any individual for exercising those rights.
9. Use of Subprocessors
Rhino Tool House uses a limited number of subprocessors to host and support RhiKnows and its companion applications (the RhiKnows app and Configurator app). Personal information is hosted on Microsoft Azure and processed within the Microsoft 365 / Microsoft Entra ID ecosystem for infrastructure hosting, identity, and authentication services. Rhino Tool House also uses the following subprocessors for specific functions:
| Subprocessor | Function | Applications | Personal Data Involved |
|---|---|---|---|
| Microsoft Azure / Microsoft 365 (Entra ID) | Infrastructure hosting, identity & authentication | RhiKnows app, Configurator app | Name, work email |
| Twilio SendGrid | Transactional email alert delivery | RhiKnows app, Configurator app | Work email, name (where used for personalization) |
| Firebase (Google) | In-app / push notification alert delivery | Notification app | Device/notification token associated with the user's account |
Apple App Store and Google Play Store are used solely to distribute the RhiKnows mobile applications to end users. They are not treated as subprocessors under this Policy: Rhino Tool House does not transmit the personal information described in Section 4 (name, work email) to Apple or Google for processing on Rhino Tool House's behalf. Apple and Google act as independent controllers of their own store-account, device, and download data under their respective privacy policies. Push notification delivery to iOS and Android devices occurs through Firebase Cloud Messaging (which in turn relies on Apple's and Google's underlying notification infrastructure); that data flow is addressed by the Firebase entry above.
Rhino Tool House maintains agreements with its subprocessors that require them to protect personal information consistent with this Policy and applicable law, and to process personal information only as instructed by Rhino Tool House.
Rhino Tool House will maintain a current list of subprocessors and will provide notice to customers of any intended changes to subprocessors in accordance with the applicable customer agreement, allowing customers the opportunity to object where required by law.
9.1 Compelled Disclosure and Legal Process
Rhino Tool House may disclose personal information where compelled to do so by a valid subpoena, court order, regulatory demand, or other legal process. Where permitted by law, Rhino Tool House will narrow the scope of any such disclosure to what is legally required and will notify the affected customer before or promptly after disclosure, unless Rhino Tool House is prohibited by law or the terms of the legal process from doing so.
9.2 Business Transfers
Personal information may be transferred to an affiliate or to a successor entity in connection with a merger, acquisition, financing, reorganization, or sale of some or all of Rhino Tool House's assets. Any receiving party will be required to honor the commitments in this Policy, or to provide protections that are materially equivalent, with respect to personal information transferred in this manner. Rhino Tool House will provide notice to affected customers as required by the applicable customer agreement or by law.
10. Technical and Organizational Measures
Rhino Tool House maintains technical and organizational measures designed to protect personal information processed through RhiKnows, consistent with Rhino Tool House's broader Information Security & Risk program, including:
Appropriate encryption measures for data in transit and at rest.
Role-based access control and the principle of least privilege for internal access to RhiKnows data.
Single sign-on and identity governance through Microsoft Entra ID, including support for SCIM-based provisioning and deprovisioning.
Endpoint protection, security monitoring, and logging over systems that process personal information.
Periodic access reviews and offboarding procedures to remove access promptly when no longer required.
Vendor risk management for subprocessors, including review of their security posture.
Documented incident response procedures for identifying, containing, and reporting security incidents involving personal information.
11. Breach and Unauthorized Disclosure Notification
If Rhino Tool House becomes aware of unauthorized access to, acquisition of, or disclosure of personal information processed through RhiKnows (a "Security Incident"), Rhino Tool House will:
Notify affected customers without undue delay and in accordance with applicable law and contractual requirements;
Provide customers with information reasonably available to Rhino Tool House describing the nature of the Security Incident, the categories of personal information involved, and the measures taken or planned in response, to support the customer's own notification obligations;
Cooperate with the customer's reasonable requests for further information needed to satisfy the customer's own notification duties to its employees, regulators, or others; and
Notify individuals and regulators directly where required by applicable law, in addition to the notice provided to customers.
This commitment operates alongside, and does not replace, Rhino Tool House's documented incident response procedures described in Section 10.
12. Artificial Intelligence and Automated Processing
RhiKnows may use AI-enabled features. Rhino Tool House applies appropriate privacy and security controls and will update this Policy if AI use materially changes how personal information is processed.
13. Quality, Including Data Subjects' Responsibilities for Quality
Rhino Tool House takes reasonable steps to keep personal information accurate, complete, and relevant for its intended use. Because RhiKnows relies on names and work email addresses supplied at account creation or through directory synchronization:
Customer administrators are responsible for ensuring that user information provisioned into RhiKnows (name and work email) is accurate and kept up to date, including promptly updating or removing records for employees who change roles or leave the organization.
Individual users are responsible for notifying their administrator or Rhino Tool House of any inaccuracies in their own account information.
Rhino Tool House will correct inaccurate personal information promptly upon verified request, as described in Section 8.
14. Monitoring and Enforcement
Rhino Tool House monitors compliance with this Policy through its Information Security & Risk Committee and internal governance processes, including:
Periodic internal review of this Policy and related data handling practices, at least annually or upon material change to the Service.
Periodic independent assessments of relevant controls.
Internal reporting channels for employees or customers to raise privacy or data handling concerns.
Documented consequences for internal policy violations, up to and including disciplinary action, consistent with Rhino Tool House's Information Security & Risk policies.
15. Complaint Handling
Individuals or customers who believe Rhino Tool House has handled personal information inconsistently with this Policy may submit a complaint using the contact information in Section 17. Rhino Tool House will:
Review privacy complaints and communicate the outcome as appropriate and in accordance with applicable law;
Escalate complaints that cannot be resolved at first review to the Information Security & Risk Committee; and
Maintain a log of complaints received under this Section, including the date, nature of the complaint, and resolution.
The accountable owner for this process is Rhino Tool House's Privacy Officer, with escalation to the Information Security & Risk Committee.
16. Children's Data
RhiKnows is a business tool intended for use by adult employees and authorized users of Rhino Tool House's customers. It is not directed to children, and Rhino Tool House does not knowingly collect personal information from individuals under the age of 18 through RhiKnows.
17. Contact Us
Questions, requests, or complaints regarding this Policy or Rhino Tool House's handling of personal information through RhiKnows may be directed to:
Privacy inquiries and complaints: privacy@rhinotoolhouse.com
Accountable owner: Rhino Tool House's Privacy Officer
Escalation: Rhino Tool House Information Security & Risk Committee
18. Changes to This Policy
Rhino Tool House may update this Policy from time to time to reflect changes in the Service, our data practices, or legal requirements. Material changes will be communicated to customers in accordance with the applicable customer agreement. The "Last Updated" date at the top of this Policy indicates when it was last revised.
Appendix A: California Notice at Collection
This Appendix supplements the Policy for California residents whose personal information Rhino Tool House processes in connection with RhiKnows, as required by the CCPA/CPRA.
Categories of Personal Information Collected
Identifiers — name, work email address, device/notification token.
Internet or other electronic network activity information — security and audit log data.
Sources of Collection
Directly from the individual or their employer (customer) at account provisioning.
Automatically through use of the Service (e.g., log and device/notification data).
Business Purposes
Providing, securing, and supporting the Service, as described in Section 1.
Categories of Personal Information Disclosed to Third Parties for a Business Purpose
Identifiers, as described in Section 9 (Use of Subprocessors).
Retention
As described in Section 7.
Sale or Sharing
Rhino Tool House does not sell or share (as those terms are defined by the CCPA/CPRA) personal information collected through RhiKnows.
Authorized Agent Requests
Rhino Tool House accepts requests submitted by an authorized agent on behalf of a California resident, subject to the verification described in Section 8.