Privacy Policy

Information we collect

• Account information. Your name and email address when you sign in (via Google, GitHub, or a magic link), and the workspaces and teams you belong to.
• Content from the tools you connect. When you link a source — such as Google Drive, Slack, Jira, or Notion — Rafter accesses content that the account you sign in with is allowed to read, so it can index that content and make it searchable and available as context inside Rafter and the AI tools you connect to it. Rafter only ever requests the access it needs, and for sources like Google Drive that access is strictly read-only.
• Content you create in Rafter. The memories, skills, agents, and other material you and your team add.
• Usage and technical data. Product-analytics events, along with standard server logs (such as IP address and browser type) used to run and secure the service.

How we use information

• To provide Rafter: shared memory, skills, agents, and search across the tools you connect.
• To operate, maintain, secure, and improve the service.
• To communicate with you about your account and important changes.

We do not sell your personal information or the content of your connected tools, and we do not use that content to train generalized or foundation AI models.

Google user data

When you connect Google Drive, Rafter requests read-only access (drive.readonly) so you can search and reference your Drive files from within Rafter and the AI tools connected to it. We access this data only to provide the features you have asked for.

Rafter’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features you request; we do not use it for advertising; we do not sell it; we do not use it to train generalized AI models; and no human reads it except with your consent, where necessary for security or to comply with the law, or on data that has been aggregated and anonymized.

How we share information

We share data with service providers that help us run Rafter — for hosting, email delivery, product analytics, and the AI model providers that process your requests — and only to the extent needed to operate the service on our behalf. When you make a request that an AI model fulfills, the content needed to answer it may be sent to a reputable model provider for processing. We may also disclose information where required by law. We never sell your data.

Storage, retention, and deletion

OAuth tokens for your connected sources are encrypted at rest. We retain your information for as long as your account is active. You can disconnect any source at any time, which revokes Rafter’s access to it, and you can delete your account, which removes your personal data and connected-source tokens. You can also revoke Rafter’s access to your Google account at any time from your Google Account permissions.

Security

We protect your information with encryption in transit (HTTPS) and encryption of sensitive credentials at rest, and we restrict access to production data. No system is perfectly secure, but we work to protect your data and to limit what we collect in the first place.

Your rights

Rafter is based in Norway and applies European (GDPR) data-protection standards. You have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at the address below.

Children

Rafter is a workplace product and is not directed to children under 16.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Continued use of Rafter after a change means you accept the updated policy.

Contact

Questions about this policy or your data? Email us at [email protected] — Rafter, Bergen, Norway.