Privacy Policy

1. Information We Collect

When you sign in with Google, we receive your name, email address, and profile picture. We store these to identify your account on DataToRAG.

If you connect a service such as Google Workspace, we receive an OAuth access token scoped to the permissions you approve, and we record which permissions you granted. We use the token only to fulfil requests you make. We do not access your data outside an explicit tool invocation.

Conversations.If you use the in-product agent, we store your messages, the agent's replies, and the tool calls and results from that conversation. We keep them so you can return to a thread, and they remain until you delete the thread or ask us to delete your account. Please do not paste anything into a conversation that you would not want stored, including other people's personal details.

Usage records. For each tool call we record the tool name, the connected account it ran against, whether it succeeded, how long it took, and the size of the request and response. We do not store the arguments or the response body in these records. Error messages are redacted for emails, identifiers and quoted content before they are stored.

How you found us. We record the marketing channel, campaign parameters, referring site and entry page associated with your sign-up, so we understand which channels bring people to DataToRAG.

Billing. If you subscribe, Stripe processes your payment and we store the customer reference it returns. We never see or store your card details.

2. How We Use Your Information

To authenticate you and manage your account; to execute tool calls on your behalf using the services you have connected; to generate and manage API keys you create; to operate and improve the product, including diagnosing failures; to send transactional email about your account.

We do not sell your personal information, and we do not use your conversations or your connected-service data to train models.

3. Data Storage and Security

Your data is stored in encrypted databases hosted in the United States. OAuth tokens are stored securely and are never exposed in client-side code. All traffic uses HTTPS. Access is scoped to your user account.

4. Third-Party Services

Two different kinds, and the difference matters.

Services you connect. Google Workspace and similar integrations are used only after you explicitly connect them, and only to carry out requests you make.

Providers we use to run DataToRAG. These process data without a connection step on your part: Anthropic, which receives your conversation content in order to generate the agent's replies; PostHog, for product analytics tied to your account; Stripe, for payments; and our hosting and database providers. We do not sell, rent or share your personal information with third parties for marketing purposes.

5. Data Retention

We retain your account data for as long as your account is active.

You can disconnect a service at any time from your dashboard, and you can delete an individual conversation at any time from the agent.

To delete your account, email [email protected] and we will remove your account, your stored tokens, your conversations and your personal data. We do not currently offer a self-serve delete button. We aim to complete a deletion request within 30 days. Some records may be retained where we are required to keep them, for example billing records.

6. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting [email protected].

7. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date.

8. Contact

Questions? Reach us at [email protected].