RB Command

Privacy Policy

Last updated: May 10, 2026

This Privacy Policy describes how Batta Holdings, LLC ("RB Command", "we", "us", or "our") collects, uses, and protects your information when you use the RB Command application (also referred to as "Jarvis") at rbcommand.com.

RB Command is an internal operations tool used by Batta Holdings, LLC and its operating subsidiaries. We do not sell the application as a public SaaS product, and we do not share or sell user data with any third party for advertising, marketing, or analytics purposes.

1. Information we collect

1.1 Account information

When you sign in to RB Command, we collect the email address you authenticate with and basic profile information (name, avatar) returned by our authentication provider (Supabase Auth). This is used solely to identify you within the application and to gate access to data you are authorized to see.

1.2 Google account data accessed via the Gmail API

When you connect a Google account, we request the following OAuth scopes:

  • https://www.googleapis.com/auth/gmail.readonly — to read your messages and labels so we can display your inbox inside RB Command and run filters and classifications against it.
  • https://www.googleapis.com/auth/gmail.send — to send replies and new emails on your behalf when you explicitly compose a message inside RB Command and click Send.
  • https://www.googleapis.com/auth/gmail.modify — to apply or remove labels, mark messages read/unread, archive, snooze, trash, and create or update draft messages (for two-way Gmail draft sync) on your behalf, in response to actions you take inside RB Command.

With these scopes we may access: message metadata (sender, recipient, subject, timestamps), message bodies (plain text and HTML), attachments, threading information, labels, and draft messages. We access this data only for the connected account and only for the user who connected it.

1.3 Information you input directly

When you compose, label, snooze, archive, or otherwise act on a message inside RB Command, we store that action so it can be reflected back to Gmail and so the user interface stays consistent across sessions and devices.

1.4 Automatically collected information

We collect standard request logs (IP address, user agent, timestamp, request path, response status) for security, debugging, and abuse prevention. We do not deploy advertising or analytics trackers.

2. How we use your information

We use the information we collect to:

  • Operate the RB Command application — display your mailbox, execute the actions you take in the user interface, synchronize state with Gmail, and persist your configuration across sessions.
  • Run AI-assisted features that you explicitly invoke, including: drafting reply suggestions, extracting structured data from messages, applying natural- language filters you create (e.g., "emails from X go to label Y"), and answering questions you ask about your inbox.
  • Improve the reliability and security of the application (for example, identifying broken syncs or revoked OAuth tokens).
  • Comply with applicable legal obligations.

3. Google API Services User Data Policy — Limited Use

RB Command's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we affirm that we:

  • Use Google user data only to provide or improve user- facing features that are prominent in the application interface.
  • Do nottransfer or sell this data to third parties for advertising or other purposes unrelated to providing the application's features.
  • Do not use this data to serve advertisements (including retargeted or personalized advertisements).
  • Do notallow humans to read the data unless we have obtained the user's affirmative agreement to view specific messages; the data is required for security purposes (such as investigating abuse); to comply with applicable law; or the data is aggregated and used for internal operations and the data has been de-identified.
  • Do notuse Google user data to develop, improve, or train generalized machine learning or AI models. AI features that operate on your data (e.g., reply suggestions, classification) are powered by third-party AI providers (currently Anthropic's API) under contracts that prohibit those providers from training their models on our customers' data.

4. How we share your information

RB Command does not sell your information and does not share it for advertising. We share information only with the infrastructure providers we depend on to operate the application:

  • Supabase — our primary database and authentication provider. Data accessed via the Gmail API (message metadata, bodies, labels, drafts) is stored in a Postgres database hosted by Supabase, encrypted at rest, and accessible only to authorized users via row-level security policies.
  • Vercel — application hosting. Vercel processes HTTP requests to deliver the application but does not persist Google user data outside of standard short- lived request logs.
  • Anthropic— AI model provider used for features you explicitly invoke (reply drafting, classification, natural-language rule parsing). Content sent to Anthropic is processed under Anthropic's enterprise terms which prohibit using customer data for model training.
  • Google— Gmail API requests are sent to Google's servers under the terms of the Google API Services User Data Policy and the OAuth grant you provided.

We may disclose information when required by law, court order, or to protect against fraud or abuse.

5. Data retention

We retain Google user data for as long as your account remains connected to RB Command. If you disconnect a Google account or delete your RB Command account, we delete the associated mailbox data from our database within 30 days, with the exception of records we are required to retain for legal or compliance reasons (such as audit logs of administrative actions).

6. Your choices and rights

You can at any time:

  • Revoke RB Command's access to your Google account at myaccount.google.com/permissions. Revoking access also signals us to stop syncing that account.
  • Disconnect an account from inside RB Command at Admin → Integrations. Doing so removes our stored OAuth tokens and triggers deletion of the associated mailbox data.
  • Request deletion of all your data by emailing privacy@rbcommand.com. We respond within 30 days.
  • Request a copy of the data we hold about you by emailing the same address.

7. Security

We protect your information using industry-standard practices, including TLS in transit, encryption at rest in the database, OAuth refresh tokens stored encrypted, row-level security policies on every table, and least-privilege access controls. No system is perfectly secure; we will notify affected users promptly in the event of any security incident affecting their data.

8. Children's privacy

RB Command is not directed to children under 13 and we do not knowingly collect information from children.

9. International users

RB Command is operated from the United States. If you access the application from outside the United States, you consent to your information being transferred to and processed in the United States.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be announced to active users via email or an in-app notice.

11. Contact us

For questions about this policy or your data, contact:

Batta Holdings, LLC
Attn: Privacy
California, USA
Email: privacy@rbcommand.com