Privacy Policy

Rumata LTD (“Rumata,” “we,” “our,” or “us”) operates the Rumata website at rumata.dev, the Rumata platform, APIs, hosted applications, and related services (together, the “Services”). Rumata LTD is the controller of personal information covered by this policy unless a separate agreement says otherwise.

Customer applications may collect information from their own end users. For that information, the customer determines the purposes and means of processing and Rumata generally acts as a service provider or processor under the customer’s instructions. Customers are responsible for giving their end users an appropriate privacy notice.

Depending on how you use the Services, we may collect:

• Account and profile information: name, email address, authentication credentials, profile image, preferences, workspace membership, and permissions.
• Project and service content: prompts, chat messages, source code, generated output, project files, secrets you choose to store, database content, deployment configuration, workflow inputs and outputs, and support materials.
• Billing information: plan, subscription status, purchase and usage records, and payment-related identifiers. Polar and its payment providers process payment card details; Rumata does not store full card numbers.
• Communications: messages, feedback, survey responses, and support requests.
• Technical and usage information: IP address, browser and device information, operating system, timestamps, pages and features used, referral information, request metadata, logs, diagnostics, performance data, and security events.
• Integration information: identifiers, configuration, and content received from services you connect, subject to the permissions you grant.

If you provide personal information about another person, you must have the right to do so and provide any notice or obtain any permission required by law.

We use information to:

• create and secure accounts, authenticate users, and manage workspace access;
• generate, build, host, deploy, monitor, and support projects and workflows;
• process subscriptions, usage allowances, purchases, and account administration;
• respond to support requests and send service, security, and billing notices;
• detect fraud, abuse, vulnerabilities, and violations of our Terms of Service;
• measure reliability and product usage, troubleshoot problems, and improve the Services; and
• comply with law, enforce agreements, and protect Rumata, our users, and others.

Where the GDPR, UK GDPR, or a similar law applies, our legal bases are performance of our contract with you, compliance with legal obligations, consent where requested, and our legitimate interests in operating, securing, supporting, and improving the Services. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

To fulfill AI requests, Rumata sends prompts, relevant project context, and configuration to OpenRouter, which routes requests to the model provider selected by you or by the service configuration. The model provider returns generated output to Rumata. Provider availability and routing may change over time.

Rumata does not use customer project content or generated code to train models owned by Rumata. OpenRouter and downstream model providers have their own retention and training practices, and some providers may retain or use inputs and outputs when the applicable routing or privacy settings allow it. Review the applicable provider terms before submitting confidential, regulated, or sensitive information. See the OpenRouter Privacy Policy for more information.

We do not sell personal information. We may disclose information to:

• Service providers: hosting, infrastructure, database, storage, observability, security, communications, source-control, and support providers that help operate the Services.
• AI providers: OpenRouter and the downstream model providers needed to process an AI request.
• Identity and analytics providers: Google when you use Google Sign-In and Google Analytics when analytics is active.
• Billing providers: Polar, which acts as merchant of record for eligible purchases, and its payment partners.
• Your integrations and collaborators: services you connect and people or organizations with whom you share a project or workspace.
• Authorities and transaction parties: when required by law, necessary to protect rights and safety, or in connection with a financing, acquisition, reorganization, or sale of assets.

We may also disclose aggregated or de-identified information that does not reasonably identify an individual.

Rumata uses cookies and similar browser storage for authentication, security, session continuity, interface preferences, and locally saved workspace or chat state. Disabling essential storage may prevent parts of the Services from working. These necessary technologies include short-lived authentication and account presentation cookies, as well as local storage used for your consent choice and workspace interface state.

With your permission, we load Google Analytics to understand visits and feature usage. Analytics remains blocked until you select “Allow analytics.” Google may then receive device, browser, page, approximate location, and interaction information and set the _ga and _ga_* identifiers, which Google documents with a default duration of up to two years. We keep advertising storage, advertising user data, and advertising personalization disabled.

You can allow or withdraw analytics at any time through “Cookie settings” in the footer. Withdrawing consent disables collection and removes known Google Analytics cookies from this site. You can also limit cookies through your browser settings and use Google’s available opt-out controls. Google describes its practices in the Google Privacy Policy.

We keep information only for as long as reasonably necessary for the purposes described in this policy. Our current baseline schedule is below. A shorter product setting, deletion request, contract, or legal requirement may change a specific period.

Residual copies may remain in backups until they are overwritten under normal schedules. When immediate deletion is not possible or appropriate, we isolate the information and restrict further use to the applicable retention purpose.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and protections for data in transit and at rest where appropriate. No internet service is completely secure. You are responsible for protecting your credentials, configuring project access, and promptly telling us about suspected unauthorized use.

Rumata and our providers may process information in Israel, the United States, the European Economic Area, and other countries where we or they operate. Those countries may have different data-protection laws. Where required, we use recognized safeguards for transfers, such as adequacy decisions, contractual protections, and vendor security commitments. Contact us if you want more information about an applicable transfer safeguard.

Depending on your location and subject to legal exceptions, you may ask to access, correct, delete, or receive a copy of your personal information; object to or restrict processing; withdraw consent; or appeal a decision about a request. You may also opt out of marketing communications using the link in the message. Service and security messages are not marketing and may continue while you use the Services.

Submit a request to privacy@rumata.xyz. We may need to verify your identity and authority before acting. You may also complain to the Israeli Privacy Protection Authority or your local data-protection regulator. We will not discriminate against you for exercising a privacy right.

The Services are not directed to children under 16, and we do not knowingly collect their personal information. If local law requires a higher age to consent to data processing, that higher age applies. Contact us if you believe a child has provided personal information without valid authorization.

We may update this policy to reflect changes to the Services, our practices, or the law. We will post the revised policy with a new date and, when required, provide additional notice before a material change takes effect. We will request consent if a new use requires it.

Questions, privacy requests, and complaints may be sent to Rumata LTD in Israel at privacy@rumata.xyz.