Privacy Policy

1. What we collect

Account: your name, email, and avatar from Google sign-in.

Your content: the tasks and instructions you submit, files you upload, conversations, and the files Rarvis produces for you; SSH server details you choose to register (used only to run the tasks you direct); voice recordings when you use voice input (used only for transcription).

Desktop app: we read files in the folders you authorize only as needed to run the tasks you start; nothing else on your machine is uploaded.

Payments: order and transaction records. Card details are collected by Stripe — we never see them.

Support: messages and attachments you send us. Device and logs: IP address, browser and device information, usage and error logs, kept for security and debugging.

Cookies: only to keep you signed in and remember preferences — no advertising or third-party analytics cookies.

2. How we use it

To run your tasks: the relevant content is sent to the model provider powering each step, solely to generate that response (see section 4).

We do not use your content to train our models. We do not sell personal data, and we do not use it for advertising.

For safety and abuse prevention; for support (authorized staff may access relevant content when handling your ticket or reviewing suspected abuse, under least-privilege access with audit logs); to improve the product using aggregated or de-identified data; and to meet legal obligations.

We do not use your data for automated decisions that produce legal or similarly significant effects on you.

3. Legal bases

Where laws like the GDPR apply, we process personal data on these bases: performance of our contract with you (providing the Services you ask for); our legitimate interests (keeping the Services secure, preventing abuse, and improving the product), balanced against your rights; your consent where we ask for it, which you can withdraw at any time; and compliance with legal obligations.

4. Who we share it with

Model providers, for the steps your tasks run on — for example Anthropic PBC and OpenAI, L.L.C. (United States), depending on the models you choose. Voice transcription and image generation likewise run on specialized model providers. Which model ran each step is always visible in the product.

Infrastructure: Alibaba Cloud (servers and storage in Hong Kong). Payments: Stripe. Sign-in: Google.

Our providers process data under contracts that limit what they may do with it and require appropriate security.

Teammates can see content in your team’s workspace. Share links you create are viewable by anyone with the link. We disclose data to authorities where the law requires, and may transfer it as part of a merger, acquisition, or sale of assets — in which case this policy continues to apply and we will post notice.

5. International transfers

We operate from Hong Kong, and model providers process task content in the United States and elsewhere. Where transfer rules apply to you (for example under the GDPR), we rely on appropriate safeguards such as contractual protections with our providers.

6. Retention

Your tasks and deliverables are kept while your account exists, so you can always return to and cite them. Logs are kept for shorter periods appropriate to security and debugging. Beyond that, we keep personal data only as long as needed for the purposes above, considering the amount and sensitivity of the data and what the law requires.

“Hiding” content in the product removes it from view; deleting your account removes your personal data, except what we must keep to meet legal obligations.

7. Your rights

You can access, export, and correct your data — most of it inside the product. To delete specific content permanently or to delete your account, contact us and we will verify your identity and act within a reasonable time.

Depending on where you live, you may have further rights: under the GDPR, these include access, rectification, erasure, restriction, portability, and objection; under the CCPA, the rights to know, delete, and correct. You may also complain to your local data protection authority. We do not sell or share personal data for targeted advertising, and we do not discriminate against you for exercising your rights.

8. Security

Data is encrypted in transit and at rest; production access follows least privilege and is audit-logged. No system is perfectly secure — if an incident affects your data, we will notify you promptly and explain what we are doing about it.

9. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal data from them.

10. Changes to this policy

Updates are posted on this page with their updated and effective dates, taking effect no earlier than 7 days after posting; we will notify you of material changes.

11. Contact

BitMiracle Technology Limited (data controller) · contact@rarvis.ai.