Privacy Policy

English · Español

Effective: 2026-04-23.

1. Controller

Carlos René Echanique Torres ("rag.art"), Spain. Contact: privacy@rag.art.

2. Data we process

• Identifiers: email, name, user id.
• Billing: minimal data handled by Stripe.
• Usage: assistant messages, uploaded documents, technical metadata (IP hash, user agent).
• Observability: anonymized error traces (Sentry) and product events (PostHog), conditional on your consent.

3. Legal basis

• Contract performance (Art. 6(1)(b) GDPR) to provide the service.
• Legal obligations (Art. 6(1)(c)) — invoicing, fraud.
• Consent (Art. 6(1)(a)) for non-essential cookies and marketing.
• Legitimate interest (Art. 6(1)(f)) for security and abuse prevention.

4. Retention

While the account is active, plus 30 days after cancellation; 24 months for security logs. You can request deletion from Settings → Danger zone.

5. Recipients (sub-processors)

Supabase (database, EU — Ireland, eu-west-1), OpenAI/Anthropic (LLM), Vercel (hosting), Stripe (payments), Resend (email). EU Standard Contractual Clauses (2021/914) apply for international transfers. Full list including optional sub-processors (Twilio, PostHog, Sentry, Langfuse) at /legal/subprocessors.

6. Rights

Access, rectification, erasure, objection, portability and restriction. Exercise at privacy@rag.art or in-app endpoints (/settings). You may complain to the Spanish Data Protection Authority (AEPD).

7. Automated decisions

We do not make legal-effect decisions solely on automated profiling. LLMs produce responses, not binding decisions.

8. Children

The service is not directed to users under 16. We suspend accounts we detect are under 16.