Privacy Policy

1. Information we handle

• Account and sign-in. Your name, email address, and the account identifier your sign-in provider returns (Google, through Auth0, or your company's own single sign-on provider); your workspaces, companies, roles, and invitations; and sign-in records, including IP address, the country we derive from it, and browser user agent. If you sign in with an emailed code, we send the code to your address.
• Customer content. Prompts and conversations, voice messages you record for transcription, images and files you attach, app source code and its history, app settings and encrypted secrets, connector settings, and published apps.
• Data inside your apps. Information your apps collect from their own users, such as their sign-in accounts, records in the app's database, uploaded files, and emails the app sends. For published apps we also record cookieless visit analytics: pages viewed, referrer, campaign tags, approximate location (country, region, city), browser, operating system, device type, and a per-tab session identifier.
• Usage and diagnostics. AI model usage and the credits each request used, machine hours and other usage meters, logs, audit events, diagnostics, and support emails.
• Billing. Your plan, subscription status, credit ledger, auto-reload setting, Stripe customer and payment references, the billing name, address, and tax IDs you give Stripe, and the countries of your billing address and card, which Stripe reports. Stripe collects and holds card numbers; RI7U4L does not store them.

2. How we use information

We use information to provide and secure the service; authenticate users; keep workspaces separate; run builds, previews, publishing, email, and connected features; meter AI usage and charge for plans and credits; determine the country of your network address, billing address, and card to enforce where RI7U4L is offered (see the Terms of Service); prevent abuse, including checking whether an email address is disposable or already used and counting new accounts per network address; respond to support requests; monitor reliability; keep records; and comply with law. We do not sell personal information, share it for cross-context behavioral advertising, or use customer prompts or source code for advertising.

3. AI and automated processing

AI features send the request and the context needed to answer it (which can include source code, files, screenshots, tool results, and conversation history) to our AI model provider, currently OpenAI. Agent and chat requests reach it through our own OpenAI-compatible model gateway, which runs on our servers. We do not use your content to train AI models; the model provider handles requests under its own terms for the accounts we use. AI output may be inaccurate or incomplete and must be reviewed by a person. Do not submit regulated or highly sensitive personal data unless a separate written agreement covers it.

4. Service providers and subprocessors

These providers process information for us:

• Netcup hosts our servers in Singapore, where the control plane, its PostgreSQL database, and app workspaces run.
• Cloudflare serves published apps and stores their files, handles custom domains and visit analytics for published apps, and stores our encrypted backups.
• Convex hosts each app's production database and file storage.
• Auth0 and Google provide sign-in.
• Resend sends sign-in codes, invitations, and emails your apps send.
• Stripe processes payments to RI7U4L.
• OpenAI provides the AI models; agent and chat requests reach it through our own OpenAI-compatible model gateway.
• GitHub stores an app's source code when you connect the app to a GitHub repository.

We find the country of a network address in a geolocation database kept on our own servers, so no address is sent elsewhere for it. IP Geolocation by DB-IP.

When you connect other services, such as your own Stripe or PayPal account for Commerce, WorkOS or Twilio for your app's sign-in, or other integrations, we send them the information needed for the feature you turned on, and their own terms apply. We also disclose information when you direct us to, when the law requires it, or when necessary to protect rights and security.

5. Your apps' users

When people use an app you build, RI7U4L processes their information to run the app on your behalf. You are responsible for telling your app's users how their information is handled and for having a lawful basis to collect it. A data processing agreement (DPA) covering your apps' user data is available to customers; ask for it at tfedorko@stierbuildings.com.

6. Retention

We keep account information, workspace data, and customer content for as long as the account or workspace exists; there is no automatic deletion schedule. Some records are short-lived: emailed sign-in codes expire after 10 minutes, sign-in sessions after 12 hours, invitations after 7 days, and the agent's own verification screenshots after 7 days.

When an app is deleted, its source code, workspace, conversations, published copy, files, the database we created for it, sign-in data, secrets, and custom domains are removed from our active systems straight away. Its usage history is kept as billing evidence, and its address is never given to another app.

After we verify a request to delete an account or workspace, we remove its data from active systems within 30 days. We keep billing, tax, and transaction records for 7 years. We make encrypted backups every night and store them off our servers. Those backups do not yet expire on a fixed schedule, so deleted data can remain in them until they are removed. Our providers keep their own records, such as Stripe's payment records and Resend's delivery logs, under their own policies.

7. Access, export, correction, and deletion

You can change your name in Settings, under Account › Profile. Members of the workspace that owns an app can download its source code and export its database from the app's settings, and its owners and admins can delete the app. RI7U4L does not yet offer self-service deletion of an account, personal workspace, or company. Email tfedorko@stierbuildings.com to request access, correction, export, or deletion of your information. We will verify the requester, identify affected workspaces and providers, and confirm the scope and schedule. Data controlled by a company may require authorization from a company owner.

Depending on the US state you live in, you may have the right to know what personal information we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or sharing; we do not sell or share personal information, so there is nothing to opt out of. Send requests to tfedorko@stierbuildings.com, and you may appeal our answer by replying to it. We will not treat you differently for using these rights.

8. Security and location

We use access controls, workspace boundaries, encryption of app secrets and backups, restricted worker environments, and audit records to protect information. No method is completely secure. Our servers are in Singapore, and our service providers process information in the United States and other countries where they operate. RI7U4L does not currently let you choose where your data is stored. RI7U4L is not offered in the European Union, the European Economic Area, the United Kingdom, or Switzerland (see the Terms of Service).

9. Cookies and local storage

RI7U4L sets cookies needed for sign-in and session security, and uses your browser's storage for preferences such as theme and for a working copy of your workspace data, which is kept in sync with our servers. We do not use advertising or third-party tracking cookies. Published apps' visit analytics use no cookies.

10. Children

RI7U4L is for people 18 and older and is not directed to children. You may not use it to build apps directed to children, or to collect children's personal information.

11. Changes and contact

We will post the revised date, and we will give account holders at least 30 days' notice before a material change takes effect. Privacy and security questions may be sent to tfedorko@stierbuildings.com.