Privacy Policy

Two different kinds of data are involved, and our role differs for each:

• Account and authentication data (described in Section 2). For this data we act as a data controller: we decide how and why it is processed to operate the Service.
• Customer Data — extracted content, references, metadata, chunks, embeddings, and configurations that you connect or process. We do not store your original files in RAGfly Cloud. We act as a data processor on your behalf and you retain ownership. RAGfly does not use this data for advertising or to train RAGfly-owned models; model-provider processing is limited to delivering the Service and is subject to the applicable provider's policies.

Account and profile information. When you create an account or sign in through an identity provider, we collect identifiers such as your name, email address, and a unique user identifier. When you sign in with Microsoft, Google, GitHub, or Supabase, we receive this limited profile information from that provider to create and secure your account. We do not receive or store your identity-provider password.

Usage and device information. We collect technical data such as IP address, browser/device type, log data, timestamps, and actions taken within the Service (audit logs), to operate, secure, and improve the Service.

Customer Data. The documents and content you process through the Service. We handle this as a processor on your behalf (see Section 1). It may incidentally contain personal information that you choose to include; you are responsible for the lawfulness of that content.

Billing information. If you purchase a paid plan, payment is handled by Paddle; we receive limited transaction data, not full card numbers.

We use personal information to:

• Create, authenticate, and secure your account.
• Provide, maintain, and improve the Service.
• Communicate with you about the Service, including security and service notices.
• Process payments and manage subscriptions.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell personal information or use Customer Data for advertising or to train RAGfly-owned models. Model providers may process content strictly to perform the requested operation, under their own terms and policies.

Where required by applicable data-protection law, we rely on the following legal bases: performance of a contract (to provide the Service), our legitimate interests (to secure and improve the Service), your consent (where requested, e.g., certain cookies), and compliance with legal obligations.

We share personal information only as needed to operate the Service:

• Subprocessors and service providers — such as cloud hosting, database, and infrastructure providers — bound by confidentiality and data-protection obligations.
• AI model providers — content strictly required for an operation may be processed by the configured provider. Providers and models may change. RAGfly selects providers whose terms exclude training on your data; plans that allow it support selecting or supplying your own providers, whose policies then apply.
• Identity providers — to authenticate your sign-in (for example, Microsoft Entra ID).
• Legal and safety — when required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or reorganization, with the protections of this policy preserved.

A current list of subprocessors is available on request at admin@ragfly.ai.

The Service may process data in countries other than yours. Where applicable law requires, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers. On every plan, Free included, RAGfly Desktop keeps the processing of your original files within your own infrastructure; derived representations of their content (chunks, embeddings, and metadata) may still be processed by the Service as described in this policy.

We retain account and usage data for as long as your account is active and as needed to provide the Service, then for the period required by law or for legitimate business purposes. Customer Data is retained according to your instructions and the Terms of Service: after termination you have a grace period to export it, after which we delete it, subject to legal retention obligations.

We apply reasonable technical and organizational measures, including encryption of document data at rest, encrypted communications (HTTPS), role-based access control (RBAC) with granular permissions, multi-factor authentication, structural isolation between organizations, and audit logging. No system is completely secure, but we will notify you without undue delay of any breach affecting your personal information or Customer Data, as required by law.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, contact us at admin@ragfly.ai. If your personal information is contained in Customer Data controlled by an organization, please direct your request to that organization; we will assist them as their processor. Note on portability: RAGfly does not store your original files (only encrypted derivatives such as text, chunks, and embeddings) — your original documents remain in your own possession at all times, so there is no separate data export for us to provide.

The Service uses cookies and similar technologies that are necessary for authentication and security, and, where applicable, optional analytics cookies subject to your consent. You can manage cookies through your browser settings.

Our website (ragfly.ai) also measures visits in aggregate through our hosting provider's web analytics service. This measurement does not use cookies or store identifiers in your browser, and it records only the page visited, approximate country, device and browser type, and the link or campaign that brought you (for example, UTM parameters). We use it to understand which pages and campaigns work. If you then create an account, we save the campaign that brought you (its UTM parameters) in the sign-up record of that account.

The Service is not directed to children under 18 (or the age of majority in your jurisdiction), and we do not knowingly collect their personal information.

When you connect a Google Drive folder, RAGfly requests read-only access (the `drive.readonly` scope) to read the documents in the folder you select and turn them into retrievable context for your own AI agents. RAGfly never modifies, creates, or deletes anything in your Google Drive.

File bytes are downloaded into the user's browser, text is extracted locally, and only the extracted text (encrypted) is sent to our backend; the original file is not stored on RAGfly's servers.

RAGfly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data and do not use it to train generalized AI models.

Who receives this data. The text extracted from your Drive documents, and the information derived from it (such as document types, features, summaries, a glossary, and search vectors), is stored with RAGfly's hosting and database providers and, only as strictly required to process it, may be processed by the AI model providers configured for the operation. RAGfly selects providers whose terms exclude training on your data. We do not transfer this data to any other third party, except where required by law.

Retention and deletion. This data is retained according to your instructions and as described in Section 7. You can delete documents from RAGfly, disconnect Google Drive, and revoke RAGfly's access at any time from your Google Account at https://myaccount.google.com/permissions. You can also ask us to delete the Google user data we hold by writing to admin@ragfly.ai (see Section 9). Section 8 describes how this data is protected.

We may update this Privacy Policy. We will post the updated version with a new "Last updated" date and, for material changes, provide reasonable notice.

RAGfly publishes this Privacy Policy in several languages. The English version is the authoritative version; translations are provided for convenience only, and in case of any discrepancy the English version prevails.

For privacy questions or to exercise your rights:

CAB Ltd. (RAGfly)

Website: ragfly.ai

Email: admin@ragfly.ai