Privacy Policy

I. INFORMATION WE COLLECT

We collect “Non-Personal Information” and “Personal Information.” Non-Personal Information includes anonymous usage data, general demographic information, referring/exit pages, platform types, and preferences. Personal Information includes your email address, name, company legal name, job title, billing details, typed signature, IP address, user agent, and any other information you provide during registration or while using our services.

1. Information collected via Technology

To activate the Service you do not need to submit any Personal Information other than your email address. We track information provided by your browser or our application when you use the Service, using cookies and similar technologies. We may collect:

• User authentication status
• Site usage patterns and interaction data
• Preferred settings and customization options
• Referring/exit pages and URLs
• Device information, browser type, and operating system

We also collect technical data related to our services:

• Model selections, settings and the jobs you run, with their results
• API usage logs and request metadata
• Messages you send in-product assistant features, and their replies
• Billing and plan data: credit purchases, balances and expiry dates; auto-recharge settings (Stripe holds the card); coding plan tier, status and usage against its limits; and your choice to keep full speed on credits, with who made it, when, and the terms version shown
• Session ids sent by coding agents such as Claude Code, Codex and OpenCode, used to keep a session on one server and stored only as hashes scoped to your workspace
• API keys and credentials (encrypted)
• Error logs and debugging information

This technical data is essential to provide the Service and is treated with the same security as your personal information.

2. Information you provide by registering

To become a subscriber, you will need to create a profile by registering with an email address and password. By registering, you authorize us to collect, store, and use your email address in accordance with this Privacy Policy.

3. Enterprise License Signatures

When you sign an enterprise license, we retain a signature record containing the company legal name, signer full name, signer email, typed signature string, IP address, user agent, and signature timestamp. The record also identifies the package and license version and stores the SHA-256 hash of the exact license text accepted.

We use this record for performance of the enterprise license contract and for our legitimate interest in enforcing the enterprise license terms. We retain the full record as contract evidence for the life of the license plus any applicable limitation period.

4. Children's Privacy

The Site and Service are not directed to anyone under the age of 13. We do not knowingly collect information from anyone under 13. If you believe we have collected such information, please contact us at osama@rightnowai.co.

II. HOW WE USE AND SHARE INFORMATION

GDPR Lawful Basis for Processing

• Contract Performance: To provide the Service, including the hosted Model APIs and coding plans, and for performance of the enterprise license contract
• Legitimate Interests: To improve our product, ensure security, prevent fraud, and support our legitimate interest in enforcing the enterprise license terms
• Consent: For marketing communications and optional features
• Legal Obligation: To comply with tax laws and legal requests

Personal Information:

We do not sell, trade, or rent your Personal Information to third parties for marketing purposes. We share Personal Information with vendors performing services for the Company only at our direction and in accordance with this Privacy Policy.

California “Do Not Sell” / “Do Not Share” notice. Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, we do not sell Personal Information for monetary consideration and we do not share Personal Information for cross-context behavioral advertising. A Global Privacy Control (GPC) signal asks a site not to sell or share your Personal Information, and we already do neither. California residents who want affirmative confirmation, or who want to exercise their right to opt out of any future sale or share, can email osama@rightnowai.co with the subject line “Do Not Sell or Share My Personal Information”. We will honor opt-out requests as soon as feasibly possible and in any case no later than 15 business days from receipt, consistent with CPRA timing requirements. Requests to access, delete, or correct Personal Information are completed within 45 days from receipt of a verifiable request (extendable once by an additional 45 days where reasonably necessary, with notice to you).

We may share Personal Information with outside parties if we have a good-faith belief that access, use, or disclosure is reasonably necessary to meet legal process, enforce our Terms of Service, address fraud or security concerns, or protect the rights, property, or safety of our users.

Non-Personal Information:

We use Non-Personal Information to improve the Service and customize the user experience. We aggregate Non-Personal Information to track trends and analyze usage patterns. We reserve the right to use and disclose such information to partners and third parties at our discretion.

III. HOW WE PROTECT INFORMATION

We implement industry-standard security controls: TLS 1.2+ in transit, AES-256 at rest, role-based access control, row-level security for tenant isolation, continuous logging and monitoring, CodeQL code scanning on every pull request and push to main, and GitHub secret scanning and Dependabot alerts on our repositories. Engineering access to production is gated by SSO and multi-factor authentication, and third-party penetration testing runs on a recurring cadence covered by our SOC 2 program. The full controls program is documented on the Security page.

Independent attestation. RunInfra is SOC 2 Type II attested. The audit report is available to current customers and qualified prospects under NDA at trust.rightnowai.co or by request to jaber@runinfra.ai.

Breach notification. In the event of a personal data breach affecting your Personal Information, we will notify you without undue delay, and in any case within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures we are taking to contain and remediate. This commitment applies regardless of where you reside and matches the GDPR Article 33 standard.

Use a strong, unique password or sign in with Google or GitHub, and keep your API keys secret. We urge you to keep your credentials safe and to log out after each session on shared devices. No method of transmission over the Internet or method of electronic storage is 100% secure, and the controls above mitigate but do not eliminate risk.

IV. YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION

You have the right to prevent us from contacting you for marketing purposes at any time. You can opt out by following unsubscribe instructions in promotional emails or by emailing osama@rightnowai.co. We may continue to send administrative emails regarding your account or service usage.

V. LINKS TO OTHER WEBSITES

We may provide links to third-party websites or applications. We are not responsible for their privacy practices. This Privacy Policy applies solely to information collected by us through the Site and Service.

VI. CHANGES TO OUR PRIVACY POLICY

We reserve the right to change this policy at any time. Significant changes will be notified via email or a prominent notice on the Site and will go into effect 30 days following notification. Non-material changes take effect immediately.

VII. CONTACT US

If you have any questions regarding this Privacy Policy, please contact us at osama@rightnowai.co.

VIII. DATA SUBJECT RIGHTS (GDPR)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format (JSON)
• Restrict processing of your data
• Object to processing of your data
• Withdraw consent for marketing

To exercise these rights, email osama@rightnowai.co. We will respond within 30 days.

Data Deletion

You can delete your account yourself in Settings, Account. That deletion is immediate and permanent. If you cannot, email osama@rightnowai.co with subject line “Account Deletion Request”. We will:

1. Confirm your identity
2. Permanently delete your account, the settings and content you saved, and personal information that we are not required or permitted to retain within 30 days
3. Send confirmation once deletion is complete

Exceptions: Payment records (charges and invoices) stay with our payment processor, Stripe. We keep a deletion record (your email, your user and account ids, Stripe customer and subscription ids, and the credit balance at deletion) as evidence of the deletion. Enterprise license signature records are retained as contract evidence for the life of the license plus any applicable limitation period. Pseudonymous analytics and error events at PostHog and Sentry are not deleted and remain until those providers' retention periods end.

IX. THIRD-PARTY SERVICE PROVIDERS (SUBPROCESSORS)

We use the following third-party services to operate our platform:

Supabase

Purpose: Database, authentication

Data Shared: Account data, usage data

Location: US (AWS)

Vercel

Purpose: Hosting of the website, dashboard and the api.runinfra.ai gateway; Web Analytics and Speed Insights

Data Shared: Model APIs prompts and completions in transit, request logs, page views, referrer, device and country

Location: US

Fly.io

Purpose: Backend API hosting

Data Shared: API requests, assistant conversations, job settings and results

Location: US (IAD)

Lambda

Purpose: GPU servers that run the hosted Model APIs

Data Shared: Prompts, completions and cached prompt prefixes, held in server memory

Location: US

Amazon Web Services

Purpose: GPU servers for some hosted Model APIs (EC2), and storage of files you upload (S3)

Data Shared: Prompts, completions and cached prompt prefixes in server memory; files you upload

Location: US (EC2), EU (S3, Stockholm)

Modal

Purpose: GPU compute for model jobs and, when a model runs there, hosted Model APIs serving

Data Shared: Model identifiers; prompts and completions of the requests it serves

Location: US

RunPod

Purpose: GPU compute for dedicated model endpoints

Data Shared: Inputs and outputs routed to your endpoint

Location: US / EU (region-selectable)

Upstash

Purpose: Rate limiting, sign-in cache and idempotent-retry cache

Data Shared: Request counters, including by IP address; account id, email, name and avatar for up to 5 minutes; non-streaming Model APIs responses for up to 24 hours when you send an Idempotency-Key

Location: US

Stripe

Purpose: Payment processing

Data Shared: Billing info, payment methods

Location: US

Resend

Purpose: Outbound transactional email delivery

Data Shared: Email addresses, transactional content

Location: US

Google Workspace

Purpose: Inbound email handling and internal collaboration

Data Shared: Inbound emails sent to jaber@runinfra.ai and osama@rightnowai.co

Location: US / EU (Google global)

Hugging Face

Purpose: Model registry

Data Shared: Model selection, download requests

Location: US / EU

OpenAI

Purpose: Language models for in-product assistant features

Data Shared: Messages you send those features, tool results and replies

Location: US

Anthropic

Purpose: Fallback language models for in-product assistant features

Data Shared: Messages you send those features, tool results and replies

Location: US

Fireworks AI

Purpose: Last-resort language models for in-product assistant features

Data Shared: Messages you send those features, tool results and replies

Location: US

OpenRouter

Purpose: Language model routing for in-product assistant and evaluation features, never the hosted Model APIs

Data Shared: Messages you send those features, tool results and replies

Location: US

PostHog

Purpose: Product and billing analytics, and browser error reports

Data Shared: Events tied to pseudonymous user and workspace ids: page and feature use (after cookie consent), per-request Model APIs usage (model, tokens, cost, latency, status), payment and plan events, browser errors, and in-product assistant messages and replies. Never the text of Model APIs prompts or completions.

Location: US

Sentry

Purpose: Error and performance monitoring

Data Shared: IP address, page URLs, browser and error details; user and workspace ids with server errors

Location: US

Cloudflare

Purpose: Bot checks (Turnstile) on sign-in, sign-up, password reset and account deletion

Data Shared: IP address and browser signals

Location: Global

Mintlify

Purpose: Documentation hosting and the docs API playground

Data Shared: Visitor IP address and pages viewed; the API key and request body you send from the playground

Location: US

Google Fonts

Purpose: Font delivery on documentation pages

Data Shared: Visitor IP address and browser details

Location: Global

These providers access your data only to perform services on our behalf and are contractually obligated to protect your data. For questions about our subprocessors, contact osama@rightnowai.co.

X. DATA RETENTION

Active Accounts

• Account data: Retained while account is active
• Saved settings, jobs and assistant conversations: Retained while account is active
• Usage records and their keyed prompt digests: Retained while account is active
• Audit logs: Retained while account is active
• Enterprise license signature records: Retained as contract evidence for the life of the license plus any applicable limitation period
• Usage analytics: 2 years
• Error logs: 90 days

Deleted Accounts

• Account data and saved content not covered by a stated exception: Deleted at once when you delete your account yourself, or within 30 days of an emailed request
• Enterprise license signature records: Retained as contract evidence for the life of the license plus any applicable limitation period
• Pseudonymous analytics and error events: Kept until PostHog's and Sentry's retention periods end
• Payment records: Kept by our payment processor, Stripe
• Deletion record: Kept as evidence of the deletion

Backups

• Automated backups retained for 90 days
• Data in backups permanently deleted after retention period

X-A. MODEL APIs DATA POLICY

This section covers the hosted Model APIs served from api.runinfra.ai. It is stated separately from the rest of this policy because inference prompts are the most sensitive data our customers send us, and because aggregators and enterprise buyers ask for this commitment explicitly.

Training

• We do not train models on your prompts or completions.
• We do not use your prompts or completions to fine-tune, distill, evaluate or otherwise improve any model.
• We do not sell, share or license your prompts or completions to any third party for training.

Storage

• Prompt text is never written to our databases or analytics. It exists on the serving machine while the request runs. Repeated leading context can stay in that machine's prefix cache after the response, until it is evicted or the model's keep window ends. Which models isolate that cache per workspace, and how long each keeps it, is listed on our data retention page.
• One narrow exception exists for completions, by design: when you send an Idempotency-Key header with a non-streaming request, the response body is held in a replay cache for up to 24 hours, used only to return the same answer to a retry carrying that key, then it expires. Streaming responses are never stored. Requests without an Idempotency-Key leave no stored prompt or completion text.
• What we record per request is metering metadata: the model identifier, input and output token counts, latency, HTTP status, the billed amount and the price basis applied. This is what a usage record and an invoice are built from.
• Usage records of chat requests also keep keyed one-way digests of the prompt, the system prompt and the tool definitions, with the client type (such as Claude Code or Codex) and message and tool counts, so we can recognize a later request in the same conversation for pricing and billing checks. The digests cannot be turned back into text, but we hold the key, so we can test whether a given prompt matches one.
• Outside the 24-hour replay window, we cannot retrieve, replay or export the text of a past request, including on your own request.

Inference Location

• Hosted Model APIs inference is served from GPU hardware located in the United States.
• Models run on GPU servers we rent from the cloud providers listed in Section IX and operate with our own serving software. Your prompts are not forwarded to a third-party model provider to be served.

Independent Attestation

RunInfra is SOC 2 Type II attested. The controls governing the handling, retention and deletion of the data described in this section are covered by that audit, which evaluates operating effectiveness over a defined window rather than at a single point in time. The most recent report, the auditor's identification and the period covered are available to current customers and to qualified prospects under NDA at trust.rightnowai.co.

The language model providers listed in Section IX serve in-product assistant features only and never receive hosted Model APIs traffic. Where the two differ, this section governs the hosted Model APIs.

XI. INTERNATIONAL DATA TRANSFERS

Our services are primarily operated from the United States. The primary database, web tier, and engine API are hosted in US regions. A dedicated model endpoint can run in a region you select, including EU regions; its inputs and outputs are then processed there, while account data, telemetry, and billing remain in the US. If you access our services from outside the United States, your data will be transferred to and processed in the US. We implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) with all vendors
• Encryption in transit and at rest
• SOC 2 Type II attested infrastructure

For EU users: By using our services, you consent to this transfer. You have rights under GDPR including the right to lodge complaints with your local data protection authority.

Last Updated: September 26, 2026