Privacy Policy

Rumata LTD (“Rumata,” “we,” “our,” or “us”) operates the Rumata website at rumata.dev, the Rumata platform, APIs, hosted applications, and related services (together, the “Services”). Rumata LTD is the controller of personal information covered by this policy unless a separate agreement says otherwise.

Customer applications may collect information from their own end users. For that information, the customer determines the purposes and means of processing and Rumata generally acts as a service provider or processor under the customer’s instructions. Customers are responsible for giving their end users an appropriate privacy notice.

Depending on how you use the Services, we may collect:

• Account and profile information: name, email address, authentication credentials, profile image, preferences, workspace membership, and permissions.
• Project and service content: prompts, chat messages, source code, generated output, project files, secrets you choose to store, database content, deployment configuration, workflow inputs and outputs, and support materials.
• Billing information: plan, subscription status, purchase and usage records, and payment-related identifiers. Polar and its payment providers process payment card details; Rumata does not store full card numbers.
• Communications: messages, feedback, survey responses, and support requests.
• Technical and usage information: IP address, browser and device information, operating system, timestamps, pages and features used, referral information, request metadata, logs, diagnostics, performance data, and security events.
• Integration information: identifiers, configuration, and content received from services you connect, subject to the permissions you grant.

If you provide personal information about another person, you must have the right to do so and provide any notice or obtain any permission required by law.

We use information to:

• create and secure accounts, authenticate users, and manage workspace access;
• generate, build, host, deploy, monitor, and support projects and workflows;
• process subscriptions, usage allowances, purchases, and account administration;
• respond to support requests and send service, security, and billing notices;
• detect fraud, abuse, vulnerabilities, and violations of our Terms of Service;
• measure reliability and product usage, troubleshoot problems, and improve the Services; and
• comply with law, enforce agreements, and protect Rumata, our users, and others.

Where the GDPR, UK GDPR, or a similar law applies, our legal bases are performance of our contract with you, compliance with legal obligations, consent where requested, and our legitimate interests in operating, securing, supporting, and improving the Services. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

To fulfill AI requests, Rumata sends prompts, relevant project context, and configuration to OpenRouter, which routes requests to the model provider selected by you or by the service configuration. The model provider returns generated output to Rumata. Provider availability and routing may change over time.

If you choose customer-connected Codex, the agent sends prompts, relevant workspace files, tool results, and conversation context to OpenAI under the provider account you connect. Rumata operates the workspace and connection, stores conversation and operational records needed to provide the service, and retains connection credentials for subsequent sessions until disconnected. Disconnect Codex in Factory settings and use the provider account controls to revoke its authorization. The connected account plan and provider settings determine the provider’s training and retention practices; no-training and zero-retention are different controls. See the OpenAI Privacy Policy. Tools and integrations you authorize can transmit data to their own services.

Rumata does not use customer project content or generated code to train models owned by Rumata. OpenRouter and downstream model providers have their own retention and training practices, and some providers may retain or use inputs and outputs when the applicable routing or privacy settings allow it. Review the applicable provider terms before submitting confidential, regulated, or sensitive information. See the OpenRouter Privacy Policy for more information.

We do not sell personal information. We may disclose information to:

• Service providers: hosting, infrastructure, database, storage, observability, security, communications, source-control, and support providers that help operate the Services.
• AI providers: OpenRouter and downstream model providers for managed requests, and OpenAI when you use customer-connected Codex.
• Identity and analytics providers: Google when you use Google Sign-In, Google Analytics when analytics is active, and PostHog EU Cloud for consented Studio usage analytics and masked session replay.
• Billing providers: Polar, which acts as merchant of record for eligible purchases, and its payment partners.
• Your integrations and collaborators: services you connect and people or organizations with whom you share a project or workspace.
• Authorities and transaction parties: when required by law, necessary to protect rights and safety, or in connection with a financing, acquisition, reorganization, or sale of assets.

We may also disclose aggregated or de-identified information that does not reasonably identify an individual.

For processing on a customer’s behalf, see the Data Processing Agreement and provider register.

Rumata uses cookies and similar browser storage for authentication, security, session continuity, interface preferences, and locally saved workspace or chat state. Disabling essential storage may prevent parts of the Services from working. These necessary technologies include short-lived authentication and account presentation cookies, as well as local storage used for your consent choice and workspace interface state.

With your permission, we use Google Analytics and Rumata-operated ClearMetric analytics to understand visits and feature usage. Analytics remains blocked until you save choices that allow it or select “Allow all.” Your choice is shared between rumata.dev, app.rumata.dev, and docs.rumata.dev using a consent cookie. Development sites under rumata.xyz have a separate choice and separate analytics data. Google may then receive device, browser, page, approximate location, campaign, and interaction information and set the _ga and _ga_* identifiers, which Google documents with a default duration of up to two years. We measure actions such as signup, prompt submission, and publishing without sending prompt contents, credentials, or private project details. We keep advertising storage, advertising user data, and advertising personalization disabled.

ClearMetric measures sanitized page paths, public campaign labels, browser/device categories, and actions such as reading guides, using docs search, copying examples, signing up, and publishing. It does not receive search text, copied contents, prompts, credentials, or private project details. Consented random visitor and session identifiers are shared across our marketing, app, and docs subdomains to measure these journeys. The visitor cookie lasts up to one year; the session cookie expires after 30 minutes without a measured event. Production and development identifiers remain separate. ClearMetric respects Do Not Track, Global Privacy Control, and our internal-browser exclusion.

For visitors without a saved choice, we use the country inferred from your IP address by our existing delivery provider, Cloudflare, to choose the initial checkbox settings. Optional choices start unchecked in the EU/EEA and UK, and when the country is unknown; elsewhere they may start checked. Preselected boxes do not start analytics or recording: collection remains blocked until you save the selected choices or choose “Allow all.” “Necessary only” turns both optional features off. Saved choices take precedence over regional defaults.

Studio has a separate, optional session-recording choice. Allowing usage analytics alone on any website does not enable recording. In Studio, “Allow all” enables both choices; on the marketing website it enables only analytics. If you opt in, PostHog EU Cloud records a sample of signed-in sessions and the first available session after a paid plan becomes active to investigate usability problems. Recordings capture navigation, clicks, scrolling, and page layout. Rendered text and input values are masked in your browser; image elements, embedded previews, console logs, and network bodies are excluded. Recordings are associated with your internal account identifier, plan, subscription status, and recording context; we do not send your name or email in new recording profiles. You can decline recording while allowing usage analytics, or allow recording while declining usage analytics. Change or withdraw either choice in Cookie settings. The recording choice is stored in Studio for up to one year, and withdrawal stops further recording. Our initial replay retention is 30 days.

You can allow or withdraw analytics at any time through “Cookie settings” in the website footer or Studio account menu. Withdrawing a choice stops future collection by that feature and clears its browser identifiers; recordings already collected remain subject to retention and deletion policies. You can also limit cookies through your browser settings and use Google’s available opt-out controls. See the Google Privacy Policy and PostHog Privacy Policy.

We keep information only for as long as reasonably necessary for the purposes described in this policy. Our current baseline schedule is below. A shorter product setting, deletion request, contract, or legal requirement may change a specific period.

Residual copies may remain in backups until they are overwritten under normal schedules. When immediate deletion is not possible or appropriate, we isolate the information and restrict further use to the applicable retention purpose.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and protections for data in transit and at rest where appropriate. No internet service is completely secure. You are responsible for protecting your credentials, configuring project access, and promptly telling us about suspected unauthorized use.

Rumata and our providers may process information in Israel, the United States, the European Economic Area, and other countries where we or they operate. Those countries may have different data-protection laws. Where required, we use recognized safeguards for transfers, such as adequacy decisions, contractual protections, and vendor security commitments. Contact us if you want more information about an applicable transfer safeguard.

Depending on your location and subject to legal exceptions, you may ask to access, correct, delete, or receive a copy of your personal information; object to or restrict processing; withdraw consent; or appeal a decision about a request. You may also opt out of marketing communications using the link in the message. Service and security messages are not marketing and may continue while you use the Services.

Submit a request to privacy@rumata.dev. We may need to verify your identity and authority before acting. You may also complain to the Israeli Privacy Protection Authority or your local data-protection regulator. We will not discriminate against you for exercising a privacy right.

Rumata accounts are intended for adults aged 18 or older who are legally able to enter into an agreement. We do not offer accounts to children or knowingly collect personal information from children under 18. Contact privacy@rumata.dev if you believe a child has created an account or provided personal information so we can investigate and take appropriate action. This restriction does not replace the privacy obligations that apply to Customer Applications and their End Users.

We may update this policy to reflect changes to the Services, our practices, or the law. We will post the revised policy with a new date and, when required, provide additional notice before a material change takes effect. We will request consent if a new use requires it.

Questions, privacy requests, and complaints may be sent to Rumata LTD in Israel at privacy@rumata.dev.