Legal

Privacy Policy

This policy explains what personal data CSresults collects, why, who processes it, how long it is kept, and how to use your rights. It covers csresults.app, the CSresults app, the emails it sends, and the shared plans your customers open.

Who we are

CSresults is provided by The Didact Company LLC (“we”, “us”). For anything about privacy, email support@revopsolutions.com.

Two kinds of data, two roles

Account data. Each person's sign-in account: their name, email address, password and two-step sign-in, their sign-in records, and their email choices. We decide how this is used. We are its controller.
Customer data. Everything an organization keeps in CSresults belongs to that organization: the records about its own customers and their people, and the record of its team's work, such as who owns each customer and who wrote a note or a check-in. It decides what goes in and what happens to it; we process it on its behalf and on its instructions. If you are a contact of one of our customers and have a question about your data, ask the organization that works with you. We will help it answer.

The data processing summary describes the second role in more detail.

What we collect

When you have an account

Your name and work email address, and your password, which is stored only as a hash.
Your authenticator app, if you set up two-step sign-in (we keep the shared secret it uses to make codes, not the codes).
The organizations you belong to, your role in each, whether you are active, and your email choices (daily and weekly summaries).
Records of sign-ins kept by our sign-in provider, including the time and the IP address they came from.
What you do in the app that your team needs to see: notes, check-ins and tasks you write, changes you make, and entries in your organization's audit log. This is part of your organization's data.

What organizations put into CSresults

Customers: names, websites, industry, contract value (ARR), renewal dates, status, notes and renewal history.
Customers' people: names, job titles, email addresses, phone numbers, their role (for example executive sponsor) and when they left.
Plans and work: products, timelines, outcomes, check-ins with who attended, notes (which can mention teammates), tasks, resources, expansion opportunities, product feedback and forecasts.
Files your team uploads, and links to files kept elsewhere.
Progress updates your team emails to customers: who they went to, the subject and the note.
From a CRM, when an admin connects HubSpot or Salesforce: companies or accounts, deals and products, contacts, and meetings (title and time).

From people who open a shared plan

A shared plan opens from a private link, with no account. Each visit is counted with its time only. If the visitor answers “How is it going?”, we keep the score (1 to 5), any comment (up to 1,000 characters) and their name if they give one. They can also tell the team that something they owe is ready. The organization that shared the plan sees these answers.

From people who receive our emails

The addresses emails are sent to, and whether someone has unsubscribed, so that no more emails of that kind go to them.

When you visit the site

Our host, Lovable, adds an analytics script to every page of csresults.app, including the sign-in page, the app and shared plans. It records the page address, the page you came from, your browser and its language, and keeps a session identifier in a cookie for 30 minutes. Page addresses can include identifiers, such as a customer's id in the app or a shared plan's link.
A second script from Lovable captures errors in the page (the error message, its technical trace and the page address), and the app passes it errors it catches, so we can find and fix them. That script can also record sessions; when we last checked, in November 2026, Lovable had not switched that on for csresults.app.
Our providers keep technical logs of requests to the site, the database and our background functions, which include IP addresses.

When you contact us

Your email and what you tell us, to answer you.

How we use it

To provide CSresults: show your organization its data, run its plans, playbooks, reports and forecasts, and sync the CRMs it connects.
To send the emails the service needs or that you ask for: confirmations and password links, invitations, daily and weekly summaries, and the progress updates your team sends to its customers.
To keep the service secure and working: two-step sign-in, sending limits, rate limits, the audit log, and finding and fixing errors.
To support you, and to tell organization admins about changes to the service or these terms. When a new organization signs up or an admin asks about seats, storage or a plan, our team is told by email.

We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models. The product sends no personal data to AI services; our staff use an AI coding assistant to build and run the service, as the security page describes.

Where the law asks for a legal basis (for example under the GDPR), ours are: the contract with your organization, to provide the service; our legitimate interests in keeping it secure, improving it and talking to the businesses that use it; and the law, where it requires us to keep or share something.

People in your organization, according to their role. A CSM sees the customers in their own book; admins, managers and contributors see every customer.
Anyone with a shared plan's link, which your team creates, replaces and switches off. It shows the customer's plan and results, what is needed from them, who to contact, and the files marked as shared.
Services your organization connects: its CRM, the addresses its webhooks go to, systems with its API keys, and the calendar apps people subscribe in.
Our staff, to operate the service and when you ask us for help, as the security page describes.
Our subprocessors, which run the service for us (listed below).
Authorities, when the law requires it.
A buyer of the business. If CSresults or The Didact Company LLC is sold or merged, the data passes to the new owner, who must keep to this policy or tell you before changing it.

Subprocessors

Supabase
Purpose
The database, sign-in, and the background functions that sync CRMs, deliver webhooks and send email.
Data
Everything stored in CSresults apart from uploaded files, and the records of sign-ins.
Location
United States: Amazon Web Services, us-west-2 (Oregon)
Cloudflare
Purpose
Storage for uploaded files (R2), and the network the site is served through.
Data
Files your team uploads to customers; every page request passes through its network.
Location
Uploaded files: Cloudflare R2, storage region not yet confirmed, so ask us if you need it. Network: worldwide.
Lovable
Purpose
Builds and hosts the web app, counts page visits, and captures errors in the page.
Data
Page addresses, the referring page, browser type and language, and error details.
Location
Where Lovable stores this data is not yet confirmed; ask us if you need it.
Resend
Purpose
Sends email: sign-in and confirmation emails, invitations, daily and weekly summaries, and the progress updates your team sends to customers. Open and click tracking are off.
Data
Each recipient's email address and the content of the email, which Resend keeps in its sending logs.
Location
United States: us-east-1 (Virginia)
Anthropic
Purpose
Claude, the AI coding assistant our staff use to build, maintain and support CSresults. The product itself sends no data to it.
Data
What our staff look at with it while fixing a problem or answering a support request, which can include records from the database.
Location
United States
NixiHost
Purpose
Hosts the mailbox our support, sales, privacy and security email arrives in.
Data
The messages you send us and our replies.
Location
United States
Google (Gmail)
Purpose
The mailbox our operations alerts go to: new sign-ups, requests for seats, storage or a plan, and paused email sending.
Data
The name and email address of whoever signed up or asked, the organization's name, and any note they added.
Location
Google's data centers, in the United States and elsewhere

The security page lists the services your organization can connect, too.

Cookies and browser storage

CSresults uses no advertising cookies and does not track you across other sites. This is what the site kept in your browser when we last checked, in November 2026. The host's scripts are added by Lovable, not by us, and can change; we will update this list when we learn they have.

Sign-in session (local storage)
Set by
CSresults
Why
Keeps you signed in.
Kept
Until you sign out
Your last organization, list filters, dismissed tips, what's new you have seen (local and session storage)
Set by
CSresults
Why
Small conveniences, so the app opens the way you left it.
Kept
Until you clear your browser's site data; filters until the tab is closed
sidebar_state (cookie)
Set by
CSresults
Why
Remembers whether the app's sidebar is open.
Kept
7 days
Pulse answered (local storage, on a shared plan)
Set by
CSresults
Why
Remembers that you answered “How is it going?”, so you are not asked twice.
Kept
Until you clear your browser's site data
session-id (cookie)
Set by
Lovable, our host
Why
Groups the pages of one visit for the host's visit counts.
Kept
30 minutes
__cf_bm (cookie)
Set by
Cloudflare
Why
Tells people from automated traffic, to protect the site.
Kept
30 minutes

The first four are needed for the app to work as you expect. You can block the analytics script or its cookie with your browser's settings or a content blocker; CSresults works without it.

How long we keep it

Your account is kept until you delete it from Your account. Deleting it removes your profile, sign-in and memberships. What you wrote for an organization (notes, check-ins, tasks) stays with that organization without your account, and your name can remain in the text of its activity history, in its audit log, and in notes that mention you. The sign-in records kept by our sign-in provider (times and IP addresses) remain after an account is deleted.
Deactivated members keep their name and email in the organization that deactivated them, so its history stays readable.
Customer data is kept while the organization exists, and removed when the organization deletes it. Deleting the organization removes its records from the database within minutes, and its uploaded files from storage within about ten minutes after that.
After an organization is deleted, we keep a short record of the deletion (its name, when, who asked, and how many customers, members and files it had), and our internal record of the requests it made and the changes we made for it (seats, storage, plan and suspension, with any notes its admins added). We also keep counts of the emails it sent, and the addresses its progress updates went to with whether each unsubscribed, so that sending limits and unsubscribes keep working.
Logs are pruned on a schedule: notifications once read after 30 days and all of them after 90; the webhook delivery log after 30 days; API usage counters after 1 hour; the detail behind each forecast snapshot after 120 days; the history of scheduled jobs after 14 days, and copies of failed background calls after 30; and each customer's daily health and results snapshots after 2 years. Customer activity and the CRM sync log are kept while the organization exists.
Backups. We do not keep backups we could restore your data from, so a deletion cannot be undone.
Copies can remain for a time in our providers' own systems, such as their technical logs and the email provider's sending logs, for the periods they set, and in the CRMs, inboxes and webhook endpoints your organization sent data to.

Where it is stored

The database, with everything stored in CSresults apart from uploaded files, is in the United States (Supabase on Amazon Web Services, Oregon), and email is sent from the United States. Uploaded files are in Cloudflare R2, whose storage region we have not yet confirmed, and the site's analytics and error reports are held by Lovable, our host. The subprocessor list gives each provider's location as far as we know it. If you use CSresults from outside the United States, your data is transferred there. An organization that needs transfer terms, such as the EU Standard Contractual Clauses, can ask us to sign a data processing agreement.

How we protect it

Tenant isolation in the database, encryption in transit, two-step sign-in, an audit log and more are described on the security page.

Your rights and choices

Depending on where you live, you can ask to see the personal data we hold about you, to correct it, to delete it, to get a copy to take elsewhere, to restrict or object to how we use it, and to complain to your data protection authority. Many of these you can do yourself:

Change your name or email address, or delete your account, on Your account.
Turn summary emails off on Your account, or with the link in any summary.
Stop progress updates with the unsubscribe link in any of them.
Organization admins can export everything, or delete the organization.

For anything else, email support@revopsolutions.com with the subject “CSresults privacy request”. We may need to confirm it is you. If the data belongs to one of our customers (you are one of its contacts, say), we pass your request to that organization and help it answer.

California residents: we do not sell personal information or share it for cross-context behavioral advertising, and we do not treat you differently for using your rights.

Children

CSresults is a business tool and is not meant for anyone under 16.

Changes to this policy

When this policy changes, we update the date below. If a change matters to how your data is used, we email organization admins before it takes effect.

Last updated on November 4, 2026.