RapidStarter Privacy Policy
Effective date: 6/15/26
RapidStarter ("RapidStarter," "we," "us," or "our") is a product of Forceworks, LLC. RapidStarter is an AI-assisted CRM that builds and maintains your customer records automatically from your organization's Microsoft 365 email and calendar activity, and surfaces the results inside Microsoft Teams and at rapidstarter.app.
This Privacy Policy explains what information RapidStarter collects, how we use and share it, and the choices and rights you have. It applies to the RapidStarter application, the RapidStarter Microsoft Teams app, and related websites and services (together, the "Service").
1. Who controls your data
For the personal data RapidStarter processes from your Microsoft 365 environment, your organization (the workspace owner who subscribes to RapidStarter) is the controller, and Forceworks, LLC acts as a processor on your organization's behalf. For account registration and billing data, Forceworks, LLC is the controller. If you are an individual user within a customer organization, please also review your organization's own privacy policies.
2. Information we collect
a. Account and identity information
When you sign in with your Microsoft 365 account, we receive your name, email address, Microsoft organization (tenant) identifier, and user identifier, via Microsoft Entra ID and Microsoft Graph (User.Read). For workspace owners, we may read limited directory information about teammates you invite (User.ReadBasic.All) to verify their identities.
b. Microsoft 365 email and calendar data
With your delegated permission, we access your Microsoft 365 mailbox (Mail.Read) and calendar (Calendars.Read). This includes message senders and recipients, subjects, body content and previews, timestamps, and calendar event details such as attendees and times. We use this content to identify the people, companies, deals, and follow-ups that make up your CRM.
c. CRM data we generate
From the activity above, RapidStarter creates and stores derived records — contacts, companies, deals, tasks, reminders, AI-generated summaries, and suggestions — and your decisions to approve or dismiss them.
d. Billing information
Subscriptions are processed by our payment provider, Stripe. Stripe collects and processes your payment card details directly; we do not receive or store full card numbers. We retain your subscription status, plan, and related billing metadata.
e. Usage and technical information
We collect operational logs, feature usage, AI token usage, device/browser information, and similar technical data needed to run, secure, and improve the Service.
3. How we use your information
We use the information we collect to:
- build and maintain your CRM automatically from your Microsoft 365 activity;
- generate suggestions, summaries, reminders, and answers to your questions about your data;
- let you review, approve, or dismiss proposed changes before they are saved;
- send notifications and, where you (as owner) explicitly direct it, send teammate invitations from your mailbox (Mail.Send);
- provide, secure, troubleshoot, and improve the Service;
- process billing and manage your subscription; and
- comply with legal obligations.
RapidStarter operates on an observe → suggest → you approve → commit model. We do not send email or take actions in your environment on your behalf, except actions you explicitly initiate (such as a workspace owner sending teammate invitations).
4. Microsoft 365 and Microsoft Graph data
RapidStarter's use of information received from Microsoft APIs adheres to Microsoft's API Terms of Use and limited-use requirements. We access Microsoft 365 data solely to provide and improve the user-facing features of the Service described in this policy. We do not sell this data, and we do not use it for advertising.
5. Artificial intelligence processing
To turn your email and calendar activity into CRM records, relevant content is sent to our AI processing subprocessor (OpenRouter, which routes requests to underlying large-language-model providers) to extract structured information and generate summaries and suggestions. This processing is performed solely to provide the Service to you. We do not use your email or calendar content to train our own models, and we do not sell your data.
6. How we share information
We do not sell your personal data. We share information only with service providers ("subprocessors") that help us operate the Service, under contractual confidentiality and data-protection obligations:
| Subprocessor | Purpose |
|---|---|
| Microsoft Corporation (Azure, Microsoft Graph, Bot Framework, Teams) | Application hosting, identity, and the Microsoft 365 / Teams platform |
| OpenRouter and its underlying model providers | AI processing of content to build your CRM |
| Stripe, Inc. | Subscription billing and payment processing |
We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a corporate transaction (such as a merger or acquisition), subject to this policy.
7. Data storage, security, and location
The Service is hosted on Microsoft Azure, in the European Union region. We apply administrative, technical, and organizational safeguards appropriate to the data, including: encryption in transit; encryption of stored mailbox access tokens; logical tenant isolation enforced at the database level so one customer's data is not accessible to another; and access controls limiting who can access production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If you access the Service from outside the European Union, you understand that your information will be processed and stored in the EU and, where applicable, transferred to subprocessors in other jurisdictions under appropriate safeguards.
8. Data retention
We retain your account, CRM, and activity data for as long as your workspace remains active, and as needed to provide the Service. When a workspace is closed or you request deletion, we delete or de-identify the associated personal data within a commercially reasonable period, except where we are required to retain certain records (for example, billing records) to meet legal obligations.
9. Your rights and choices
Depending on your location, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. These rights include those under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as applicable.
- Access and correction: You can view and edit your CRM data within the Service.
- Disconnect: You can disconnect your Microsoft 365 mailbox at any time from your preferences, which stops further collection.
- Deletion and export: You, or your workspace owner, may request deletion or a copy of your data by contacting us.
If you are an end user within a customer organization, we may refer your request to your organization (the controller). We do not discriminate against you for exercising your rights.
10. Children's privacy
The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where appropriate, provide additional notice.
12. Contact us
For privacy questions or to exercise your rights, contact:
Forceworks, LLC — RapidStarter
Email: connect@rapidstart.com