Privacy Policy

Two different kinds of data are involved, and our role differs for each:

• Account and authentication data (described in Section 2). For this data we act as a data controller: we decide how and why it is processed to operate the Service.
• Customer Data — the documents and content you upload, connect, or process through the Service. For this data we act as a data processor (or “encargado”) on your behalf. You (or your organization) are the controller. We process Customer Data only on your instructions and as described in the Terms of Service, and you own it at all times. We do not use Customer Data to train AI models or for any purpose other than providing the Service to you.

Account and profile information. When you create an account or sign in through an identity provider, we collect identifiers such as your name, email address, and a unique user identifier. When you sign in with Microsoft, Google, GitHub, or Supabase, we receive this limited profile information from that provider to create and secure your account. We do not receive or store your identity-provider password.

Usage and device information. We collect technical data such as IP address, browser/device type, log data, timestamps, and actions taken within the Service (audit logs), to operate, secure, and improve the Service.

Customer Data. The documents and content you process through the Service. We handle this as a processor on your behalf (see Section 1). It may incidentally contain personal information that you choose to include; you are responsible for the lawfulness of that content.

Billing information. If you purchase a paid plan, payment is handled by Paddle; we receive limited transaction data, not full card numbers.

We use personal information to:

• Create, authenticate, and secure your account.
• Provide, maintain, and improve the Service.
• Communicate with you about the Service, including security and service notices.
• Process payments and manage subscriptions.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell personal information, and we do not use Customer Data to train AI models or for advertising.

Where required by applicable data-protection law, we rely on the following legal bases: performance of a contract (to provide the Service), our legitimate interests (to secure and improve the Service), your consent (where requested, e.g., certain cookies), and compliance with legal obligations.

We share personal information only as needed to operate the Service:

• Subprocessors and service providers — such as cloud hosting, database, and infrastructure providers — bound by confidentiality and data-protection obligations.
• AI model providers — when you select a third-party model (for example, Anthropic, OpenAI, Google), the relevant content is processed by that provider subject to its terms; on supported plans you may choose the model or keep processing local via RAGfly Desktop.
• Identity providers — to authenticate your sign-in (for example, Microsoft Entra ID).
• Legal and safety — when required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or reorganization, with the protections of this policy preserved.

A current list of subprocessors is available on request at admin@ragfly.ai.

The Service may process data in countries other than yours. Where applicable law requires, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers. On supported plans, you may restrict processing to your own infrastructure via RAGfly Desktop.

We retain account and usage data for as long as your account is active and as needed to provide the Service, then for the period required by law or for legitimate business purposes. Customer Data is retained according to your instructions and the Terms of Service: after termination you have a grace period to export it, after which we delete it, subject to legal retention obligations.

We apply reasonable technical and organizational measures, including encryption of document data at rest, encrypted communications (HTTPS), role-based access control (RBAC) with granular permissions, multi-factor authentication, structural isolation between organizations, and audit logging. No system is completely secure, but we will notify you without undue delay of any breach affecting your personal information or Customer Data, as required by law.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, contact us at admin@ragfly.ai. If your personal information is contained in Customer Data controlled by an organization, please direct your request to that organization; we will assist them as their processor.

The Service uses cookies and similar technologies that are necessary for authentication and security, and, where applicable, optional analytics cookies subject to your consent. You can manage cookies through your browser settings.

The Service is not directed to children under 18 (or the age of majority in your jurisdiction), and we do not knowingly collect their personal information.

We may update this Privacy Policy. We will post the updated version with a new “Last updated” date and, for material changes, provide reasonable notice.

For privacy questions or to exercise your rights:

[Provider legal name]
Website: ragfly.ai
Email: admin@ragfly.ai