Privacy Policy

1. Who is responsible for your data

Customer accounts and ragforgeai.com. RagForge AI is the controller of the data we collect to run customer accounts, billing, support and our own website. Company details are at the end of this page. Contact: support@ragforgeai.com.

Visitors and callers of our customers. When you chat with or call an AI assistant on a business's website or phone number, that business is the controller of your data and RagForge AI processes it on the business's behalf as a processor, under our Data Processing Agreement. Questions or requests about that data should go to the business first; we will help them answer. If you cannot reach the business, write to us and we will pass your request on.

2. What we collect

From customers: name, email address, password (stored only as a secure hash) or Google sign-in identity, business name and details, team members and their roles, billing details (collected and held by Stripe, our merchant of record; we keep only the Stripe customer and subscription references, the plan and its billing dates — never card numbers), settings, and the website content and documents a customer adds to train their assistant.

From visitors and callers, through a customer's assistant:

• Messages typed in the chat and the assistant's replies.
• For voice and phone calls: the audio of the call while it happens (converted to text in real time), the transcript, and — only if the customer has turned recording on — a recording of the call.
• For phone calls: the caller's phone number and call details (time, duration).
• Anything the visitor chooses to give, such as a name, email address, phone number, company or a meeting booking.
• Live presence: that someone is on the page now, the current page and the approximate country.
• Visit activity, where allowed (see section 5): pages viewed, previous page, how the visitor arrived (traffic source), device and browser type, approximate city, time on site, whether they visited before, and an intent score.

From visitors to ragforgeai.com: the pages requested and basic technical data needed to deliver them, the answer given in our cookie banner, and anything sent through our contact form. We do not use analytics, advertising or social-media tracking on ragforgeai.com.

IP addresses. Your IP address is used only to work out your approximate city and country and to protect the service (rate limits and abuse prevention). It is never shown to our customers, is not stored with your visit activity, and security records keep it for no more than 30 days. The country and city come from a database stored on our own servers, so your IP address is not sent to any other company for this.

3. AI assistant, recording and human takeover

You are always told when you are talking to an AI. The chat shows a notice at the top: "You're chatting with an AI assistant. A member of our team may join. Messages are stored to help you." Before a voice call on a website you see a notice saying you are about to speak with an AI assistant; phone callers hear the same at the start of the call.

Recording. Calls are recorded only when the business has turned recording on. You are told before the call ("This call may be recorded for quality and support purposes and a member of our team may join"). On a website you choose to continue or cancel before anything is recorded; on the phone the notice is spoken at the start of the call. Recordings are deleted automatically 45 days after the call.

Human takeover. A member of the business's team may join a chat or call and reply instead of the AI. You are told when this happens. The business is responsible for how its team uses this feature.

Profiling (intent score). The assistant may give a visit a simple Low, Medium or High intent score, based on the pages viewed and what was said in the conversation, so the business can prioritise follow-ups. It does not produce legal or similarly significant effects for you, and no decision about you is made by it automatically.

No AI training. We do not use the content of chats, calls or documents to train AI models, and neither do our AI providers: training and data sharing are switched off on our OpenRouter account, and our AI and speech providers process conversation content only to generate a reply or transcribe or voice it.

4. Why we use data (and our legal bases)

• To provide the service a customer signed up for, and to answer visitors and callers on the customer's behalf — performance of a contract (for customers) and the customer's instructions (for visitors).
• To keep the service secure — detecting abuse, spam and fraud, rate limiting — legitimate interests.
• To support customers and improve reliability — fixing faults, measuring performance — legitimate interests.
• Visit tracking for UK and EU visitors — consent (see section 5).
• Billing, tax and accounting — legal obligation and contract.
• Service emails (sign-up, security, notifications the customer turned on) — contract. We send marketing emails only with permission, and every one has an unsubscribe link.

5. Visit tracking and consent

Visitors in the UK and the European Economic Area (and Switzerland): live presence (that you are on the page, the current page and your country) and proactive messages always work. Fuller visit tracking — page history, previous page, time on site, traffic source, device, returning-visitor recognition and the intent score — happens only after you consent, either in the website's own cookie banner or in the small RagForge AI consent bar. If you decline, chat, calls, human takeover and bookings keep working normally.

Everyone else: visit tracking is on, with this notice. You can still say no: declining in a consent prompt is respected wherever you are.

Do Not Track and Global Privacy Control. If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we treat it as a decline of visit tracking, wherever you are, unless you then actively agree on that website. Under US state laws GPC is also a request to opt out of the sale or sharing of personal data; we do neither.

Some businesses ask every visitor (for example in the DIFC or ADGM); then the UK/EU rules above apply to everyone on that site.

Details of what is stored in your browser are in our Cookie Policy.

6. Who we share data with

We use trusted service providers (sub-processors) for hosting, AI processing, speech, phone calls and email. They may only use the data to provide their service to us. The current list, with locations, is in the Sub-processors section below.

We share data with the business whose assistant you used (it is their data), with professional advisers, and with authorities where the law requires. If our business is sold or merged, data may transfer to the new owner under this policy.

We do not sell personal data and do not share it for cross-context behavioural advertising.

Data source credit: IP geolocation by DB-IP, licensed under CC BY 4.0. DB-IP is a database we download and run on our own servers; no personal data is sent to DB-IP.

7. International transfers

Our main database and call recordings are stored in the EU (Ireland), and the application runs in the EU (Netherlands). Some providers — AI models, speech, phone, email — are in the United States. Where data leaves the UK, EEA, Saudi Arabia, the UAE or another country with transfer rules, we rely on the safeguards those laws accept: adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the equivalent mechanisms under the Saudi PDPL, the UAE PDPL and the DIFC and ADGM data-protection laws.

8. How long we keep data

Customers can delete conversations, recordings and contacts sooner in the dashboard, or ask us at support@ragforgeai.com.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, withdraw consent at any time, and not be subject to solely automated decisions with significant effects. Under US state laws (such as California's) you also have the right to know, delete and correct, and not to be discriminated against for using your rights; we do not sell or "share" personal data.

For data held for a business (chats, calls, visits), contact that business; we will support them. For your RagForge AI account or our website, write to support@ragforgeai.com. We reply within one month (or the shorter time your law requires). We may need to confirm your identity.

You can also complain to your data-protection authority — in the UK the Information Commissioner's Office (ico.org.uk); in the EU your local authority; in Saudi Arabia the Saudi Data & AI Authority (SDAIA); in the UAE the UAE Data Office; in the DIFC the Commissioner of Data Protection; in the ADGM the Office of Data Protection.

10. Security and breaches

Data is encrypted in transit (HTTPS/TLS). Access is limited to staff who need it, with strong authentication for administrative access, and every customer's data is kept separate. If a personal-data breach happens we act at once to contain it, notify affected customers without undue delay and in any case within 72 hours of becoming aware of it, and notify authorities and individuals where the law requires.

11. Children

RagForge AI is a business service and is not intended for anyone under 18. We do not knowingly collect data from children. Businesses must not use the service to target children. If you believe a child has given us data, contact us and we will delete it.

12. Laws we follow

This policy is written to meet the UK GDPR and Data Protection Act 2018, the UK PECR, the EU GDPR and ePrivacy rules, the transparency duties of the EU AI Act, US federal and state privacy and call-recording laws, the Saudi Personal Data Protection Law, the UAE Personal Data Protection Law, the DIFC and ADGM data-protection laws, and the data-protection laws of Qatar, Kuwait, Bahrain and Oman.

13. Changes

We will post any change here and update the date at the top. If a change is significant we will tell customers by email before it takes effect.

Sub-processors

RagForge AI uses the providers below to deliver the service. Each is bound by a written agreement with data-protection terms at least as protective as our Data Processing Agreement.

1. Current sub-processors

DB-IP, which we use for approximate location, is a data source and not a sub-processor: no personal data is sent to it (see "Who we share data with" above).

2. Changes

We update this page before a new sub-processor starts processing customer data, and email customers who have asked to be told at least 30 days in advance. A customer may object on reasonable data-protection grounds as described in the DPA. To be notified, write to support@ragforgeai.com.

RAGFORGE AI LTD is a company registered in England and Wales, company number 17524862, registered office 128 City Road, London, EC1V 2NX, United Kingdom. Contact: support@ragforgeai.com.