Privacy Policy

1. Who we are

RightNow AI, Inc. ("RightNow", "we", "us") is a company registered in Delaware, United States, at 131 Continental Dr, Newark, DE 19713, US. For any privacy question or request, email jaber@rightnowai.co.

We are responsible for the personal information we collect to run our website, accounts and services. This policy covers www.rightnowai.co, our decision model API and its console, and the public status page. A business customer is responsible for the information it chooses to submit and for its own privacy notices. Any signed agreement about processing that information also applies. The payment and credit processing described in this policy applies to billing.

Other services and linked websites have their own privacy notices. Following a link can disclose our domain as the referring site and tags identifying where the link appeared on our site. Those tags identify the link location, not the person following it.

2. The website

Visits and analytics

Our cloud hosting providers receive page addresses, IP addresses, browser headers and the information submitted through forms to deliver the website. Website analytics receives page addresses without queries or fragments, referring pages, visit times, browser and device details, and approximate country, region and city derived from the IP address. It distinguishes visits without cookies and discards the temporary visit identifier after 24 hours. We see totals, not individual visitors.

Website analytics also counts plays of research videos using the video's identifier and the page path. Its script does not load on console pages, but can continue counting console page paths if you enter the console from the website in the same tab.

Product analytics for our API docs and console is described here for when collection is enabled after the applicable notice period. The analytics preference on this page shows whether browser collection is active. Docs events include page addresses without queries or fragments, a launch campaign tag, the referring domain or previous page on our site, time on page, scroll depth, actions such as copying an example, browser and device details, screen and window size, time zone and language. The provider receives the IP address to determine country and region and does not store that address.

Docs analytics sets no cookies and uses no persistent browser storage. Its temporary visitor identifier lasts only for the page load. Visits can carry your sign-in identity identifier if you enter the docs from the console in the same tab. Product analytics does not record your screen or what you type.

Do Not Track and Global Privacy Control signals stop product analytics in your browser and stop the console's servers from sending product analytics about that visit. You can also turn browser product analytics off with the analytics preference on this page. The browser keeps that choice until you change it or clear its storage. These controls do not switch off the separate website visit totals described above.

Cookies and browser storage

Website pages set no cookies of their own. The console shares this site and uses the cookies in section 3. Your browser sends its site-wide console cookies to website pages too, but those pages do not read them. A chosen theme stays in local storage until changed or cleared, including after console sign-out. Hosting and human verification services may also set necessary security cookies to record a browser check or prevent automated misuse.

We do not use the website or console for advertising or to follow your activity across other websites. Google or GitHub learns that you use the console when you choose its sign-in method. The human verification service receives the sign-in page visits on which its check runs.

Forms, email and logs

Contact and access forms collect your email address, message and, where offered, optional company details. The enterprise form asks for work email, company, team size, preferred model location, your interest and details, and optionally your name. Email delivery sends these messages to our company mailboxes. The website does not keep a separate copy of form messages. Our mailboxes keep messages and correspondence for up to 3 years after the last message.

To limit misuse, we keep request counts associated with identifiers derived from IP addresses. Those identifiers remain personal information and can be associated with an address; they are not anonymous.

Hosting request logs can contain page addresses, queries, IP addresses, browser details and location. Our website's application logs contain fixed labels and error codes and can retain derived network identifiers from the closed waitlist. Logging and monitoring also receives request paths and browser connection information, with IP addresses removed when the application logs arrive. Section 8 describes retention.

3. The console: sign-in, cookies and email

You can sign up with Google, GitHub or your email address. There is no password or invitation requirement. We require a verified email address and a human check, and refuse suspended addresses.

Google or GitHub shares the account email, verification status, name, profile picture link and account identifier when you approve sign-in, and GitHub also shares your username. From Google we ask only for the openid, email and profile permissions. Email sign-in sends a link and code through our authentication and email delivery services. The link and the code expire after 10 minutes. We limit sign-in email requests to prevent misuse.

Every visitor to the sign-in page encounters a human verification service, whichever sign-in method they later choose. It receives the IP address, browser and connection signals and the check result, and also uses those signals under its own terms to improve verification. The email sign-in request proceeds only after the check passes.

Authentication services keep your profile and sessions and record sign-in events with email, IP address and browser details. Our sign-in event records have a 90-day retention period, subject to the cleanup qualification in section 8. The authentication provider's own request logs can also contain IP addresses. The console uses your verified addresses, sign-in methods and, for the welcome email, your shared name. It displays an address, uses it as the first billing email of workspaces you create, and checks verified addresses against invitations and our invite list.

If you belong to no workspace and enter the console without an invitation link, we create a Personal workspace for you, subject to workspace limits. We make none if your sign-in identity is suspended. At open sign-up, a waiting workspace becomes active after a sign-in that passes the human check or after you choose Confirm to start and pass that check. Opening sign-up does not approve a waiting workspace automatically.

For starting-credit verification and abuse prevention, we record derived network identifiers, the human-check result and the time of the check.

When the starting-credit policies apply, we also record observations of workspace membership and role changes for promotional-credit abuse checks.

Cookies and local storage

Console cookies are sent only to www.rightnowai.co over HTTPS. Their names, purposes and lifetimes are:

Local storage keeps your theme, last sign-in method and analytics preference until changed or cleared. A signed-in display preference is removed on sign-out. Sign-in and sign-out times remain for up to 7 days so other tabs can follow the change. Playground drafts and temporary page state stay in session storage until the tab closes. When you add funds, this tab's session storage keeps the amount you chose, the payment attempt with its workspace, options, country and payment identifiers, and the state of a payment still being confirmed. Each is used for at most 30 minutes and is removed when it is used up, when you sign out or when the tab closes. It also marks a billing action in progress and a saved-card consent awaiting an answer until they end, and whether the tab uses the payment page instead of the embedded form. Signing out clears the current page's console storage apart from those sign-in times, and removes the session, sign-in completion and Get started cookies. It leaves the other three console cookies until their own expiry, and does not clear the theme or last sign-in method.

When enabled, product analytics runs in the console as section 4 describes. The console loads no other analytics script of its own; section 2 explains the website analytics that can continue in the same tab. Browser product analytics does not run in the console in the European Economic Area or Switzerland. Browser security reports retain the type of problem and the console area, not the addresses reported.

Email and feedback

We send a welcome email when you first belong to an active workspace and send workspace invitations. Email delivery receives the recipient address, message and any shared name, workspace name or inviter address the message contains. These emails contain no tracking pixels and no tracked links. A logo loaded by your email app discloses its IP address and user agent to our file delivery service. Our website's demo video, its poster images and captions also load from assets.rightnowai.co; when your browser loads them, Cloudflare receives your IP address and the browser's user agent. Replies to the welcome email reach our team.

We queue welcome emails in our database with your address and, if provided, your name, together with delivery attempts and their outcome. The queued record stays until the send ends in success or failure, then for 30 days; deleting your sign-in identity removes it sooner. The marker that prevents a second welcome stays with your sign-in identity until that identity is deleted.

Our email delivery service also delivers our billing emails, which can include your workspace name, credit balance, payment amounts, receipt details and a saved-card summary.

Console feedback includes your message, category and sign-in identity and, if you include page details, your workspace, page type and browser. It is stored in the console database and emailed to our team with your reply address. The mailbox copy follows the correspondence retention period in section 8.

4. The console: workspaces, keys and usage

Workspaces keep their name, creator, status, limits, dates, billing email and members' roles. Members of a workspace can see each other's email addresses, roles and join dates; owners and admins also see its open invitations.

A workspace's billing email starts as its creator's address, and among its members only owners can see it. It stays until it is changed or the workspace is deleted, even after the creator leaves the workspace or is removed from it, or we delete the creator's sign-in identity.

An invitation email identifies the workspace and inviter, with replies sent to the inviter. Its link works once and expires after 7 days. The invitee sees the proposed role, and only someone who verifies the invited address can accept.

Workspace history records creation, name changes, deletion scheduling, restoration, suspension, membership and role changes, invitations and the related key revocations. It identifies members involved in their changes; administrative changes do not identify the operator. Deleting an identity removes its member references, but invitation email addresses can remain until the workspace is deleted.

API key records include a protected verification record, recognition characters, the key's name, creator and revoker, and creation, use and revocation dates. The full key is shown once, when you create it, and is not stored.

Usage records contain identifiers, time, key, model, route, outcome, error codes, sizes, timings, question and token counts, cost figures and the member responsible for a Playground run. Some records combine multiple calls. A usage record never contains what you sent, the answer, your IP address or your browser. The console's charts use hourly totals built from these records.

When enabled, product analytics receives console page paths with identifiers removed, named actions, visit duration, sign-in outcomes, usage metadata and how requests were served. Records can contain identity, workspace, key and request identifiers and the browser and approximate location details described in section 2. Unsuccessful sign-in events do not carry your identity identifier. These records contain no request content, answer, API key or recognition characters, email address, person name, workspace name, key name or IP address.

Product analytics records are retained for up to 7 years. We request deletion of records tied to a deleted sign-in identity, and the provider removes them in the background. Records of a deleted workspace's requests remain until the retention period ends. You can object as described in section 10.

Suspension revokes the person's keys and open invitations and removes their addresses from our invite list. Workspaces they alone own are suspended and scheduled for deletion 30 days later, or deleted sooner with their identity, unless the suspension is lifted first. We retain derived records of verified addresses to prevent renewed access while suspended. These remain personal information, are reviewed each year and are deleted when the suspension is lifted. Lifting a suspension restores affected workspaces that still exist, but does not restore revoked keys or invitations.

5. The API

We serve our own model, System Zero. Our cloud hosting services process request content and return our model's answers for us. A Playground request also passes through our console hosting service. Requests you send, and any files in them, may be processed in any region where our cloud hosting runs, rather than in one fixed region. The documentation states which inputs are currently available. This location notice does not announce the availability of those inputs.

If you use System Zero through a third-party platform such as OpenRouter, that platform sends us your requests on your behalf. Its own terms and privacy policy govern your relationship with it. We process those requests as described in this policy.

We use the content you send only to answer your requests and to keep the service safe and working. Your Playground draft leaves your browser only when you run it, and a run is then handled like any other request.

We do not log the content you send. If a request includes an Idempotency-Key, as Playground runs do, we retain its answer for retries for up to 24 hours, with a record that checks the retry concerns the same request. That answer repeats the question names, choice labels and score levels from your request. The answer and matching record are deleted about a minute after that period ends. A request sent without an Idempotency-Key leaves no answer stored for retries.

When provenance is enabled, a decision reply includes metadata about its execution: the decision and original request identifiers, creation time, requested model and resolved release, serving and render identifiers, a serving fingerprint, calibration versions by question, attachment classes, and whether the reply was replayed. The identifiers and question names can be linked to records you keep. Attachment classes name only the input types and contain no attachment names, source URLs or content. When we store an answer for a keyed retry, its provenance stays with that answer for up to 24 hours and is deleted about a minute after that period ends, unless the cached answer is evicted earlier. Older retained replies may contain no provenance. This feature creates no separate content store or retention period. Your copies of replies may remain in your own logs or storage after our retry copy expires. Execution evidence is not returned.

Caches that speed up repeated inputs live in memory only, kept apart for each workspace. An optional request routing hint can help related requests reuse that processing, but does not guarantee a particular server or reuse. We do not retain the routing hint after the request.

We never use the content you send, or the answers the API returns to you, to train our models or any other model. As between you and us, those answers belong to you, to the extent the law allows.

Security checks use temporary key and workspace details and request counts associated with derived network, email and user identifiers. Derived identifiers remain personal information. We limit requests and account actions to prevent misuse.

The console's and the API's log lines never contain request content, email addresses or names. They contain identifiers, counts, error codes, timings and, when a usage record cannot be recorded normally, that usage record. Hosting services can also keep request metadata, as described in sections 2 and 6. Our administrative security records contain the action, time, relevant person or workspace identifiers, counts and outcome, without request content or email addresses. Deletion removes the affected person and workspace identifiers as section 9 describes.

Model processing creates service receipts and crash records containing request and workspace identifiers, timing, route, question counts, token counts, cost figures and diagnostic identifiers. Neither holds content, and neither is deleted automatically yet. Diagnostic records help us investigate failures and temporarily refuse inputs that repeatedly cause them.

6. Who receives information

We use the categories below to provide and protect the services. A category can include more than one provider. Email jaber@rightnowai.co for the named provider list and processing locations. Google and GitHub are named because you choose them for sign-in, and Stripe is named because you use its checkout to pay.

We retain closed waitlist information with database hosting providers until deletion (our records do not specify the processing country), retired website accounts and exported copies in the United States until planned deletion around January 2027, and retired payment records with payment processing providers in the United States for payment and tax retention. These include the contact, device, account, usage and billing categories in section 7. Before account deletion, email delivery (our records do not specify the processing country) sends account holders one notice of retirement, deletion and policy changes; we delete its address list 30 days later.

7. What we collect, its sources and why

The following categories cover our collection in the preceding 12 months, including retained information from retired services. Future media entries apply only when those features become available.

We process information to perform our agreement with you when providing accounts, workspaces, requests, service emails and billing. We rely on legitimate interests in keeping services secure and working, understanding use and performance, answering enquiries, administering retained records and retirement notices, and enforcing our terms. Enquiries can also involve steps you request before an agreement. We process information where necessary to meet legal obligations, including applicable accounting and tax duties.

You do not have to give us personal information, but some things need it: the console needs the email address you sign in with, and we can answer a form only with an email address. Invitations supply addresses from the member who sends them; our team supplies addresses on the invite list. Customer-submitted content can contain information about other people. We make no decision about you based only on automated processing that has legal or similarly significant effects on you.

We do not sell personal information, and we do not share it for advertising. This includes sale or sharing for cross-context behavioral advertising under California law. Sensitive account information is used for access, security and the service purposes described here, not advertising or profiling you for advertising.

We also disclose information to workspace members and invitees as section 4 describes, to authorities or other recipients where legally required or needed to protect people and our rights, and to a buyer or successor in a merger or sale of assets. Those recipients receive only information relevant to that purpose.

8. How long we keep it

The periods below describe the data we retain, including copies and records left after deletion. Rows that expressly mention cleanup may remain until that cleanup completes; other maximum retention periods remain as stated. Periods shown as unconfirmed are unresolved limits, not a promise of prompt deletion.

Starting-credit network linkage and membership observations are eligible for cleanup after 30 days, and verification-attempt linkage after one hour.

Resolved starting-credit case evidence is eligible for cleanup 90 days after resolution unless a recorded retention basis with an end date applies.

Minimal financial and duplicate-award prevention records remain after that cleanup.

Cleanup runs in bounded batches, so eligible records can remain until cleanup completes.

We keep financial records after a workspace or sign-in identity is deleted. These include purchases, refunds, credit movements, monthly billed usage and the payment and tax references tied to the workspace. They are not deleted automatically; our intended retention period is seven years.

9. Deleting your data

An owner can choose Delete workspace in Settings after signing in again. The workspace is then scheduled for deletion. Its keys normally stop working at once, subject to the short propagation delay described in the Terms, and its open invitations are revoked. For 30 days an owner can restore it. A restore brings the workspace back, but not its API keys: they stay revoked, and you create new ones. After that period, cleanup removes its usage and workspace records as section 8 describes. The workspace's financial records are retained separately as section 8 describes.

Leaving a workspace or being removed revokes your keys and open invitations there. Its billing email can remain your address. Deleting a workspace does not delete your sign-in identity. To delete your identity and profile, or any other personal information we hold about you, email jaber@rightnowai.co.

When we carry out identity deletion, we delete your sole-member workspaces and remove you from others, revoking your keys and open invitations. We delete your sign-in event records and feedback from the console database. If you are the only owner of a workspace with other members, we first ask you to transfer ownership or delete it, except where a suspension already scheduled it for deletion. We may keep what the law requires us to keep, such as payment records.

Backup copies, retry answers, usage records, logs, financial records, correspondence and model diagnostics follow section 8. Pending usage for a deleted workspace is discarded when processed. We request removal of analytics records linked to your sign-in identity; workspace request analytics can remain for their retention period. Administrative security records remain for their retention period, with your identity identifier and the identifiers of workspaces you created removed when your identity is deleted, and a workspace identifier removed when that workspace is deleted.

Other workspaces can retain your invitation address in invitations and change history until those workspaces are deleted. A workspace you created can retain your billing email until changed or the workspace is deleted. An address on the invite list remains until removed. Provider logs and team mailbox copies are not erased by deleting your console identity. Suspension identifiers remain while the suspension stands.

10. Your rights

Depending on where you live, you have the right to:

• access your personal information and get a copy of it in a portable form;
• have it corrected or deleted;
• restrict how we use it;
• withdraw your consent where we rely on consent, which does not affect what we did before you withdrew it.

Where we rely on our legitimate interests, you can also object at any time, and we will stop unless we have compelling grounds or need the information for a legal claim. To object to server product analytics, email us; we stop sending records tied to your sign-in identity and workspaces you own and request deletion of records linked to your identity. The browser preference in section 2 controls browser product analytics.

California residents can request the categories and specific pieces of personal information collected, their sources, business purposes and recipient categories, including disclosures during the preceding 12 months. They can request deletion and correction, opt out of sale and sharing for cross-context behavioral advertising, and limit sensitive personal information use where the law gives that right. We do not sell or share personal information for that advertising purpose, including information about people under 16. You may use an authorized agent; we may ask for proof of authority and verification as the law permits.

To use these rights, email jaber@rightnowai.co. We will check that the request comes from you and answer within the time the law sets, and we will not treat you differently for using them. In the European Economic Area, the United Kingdom and Switzerland, you can also complain to your data protection authority.

For console and API records, you can request a machine-readable file of the information our console database holds about you and an export of analytics records associated with your sign-in identity. It names no one else and holds no API key, key hash or sign-in token. Tell us if your request also concerns correspondence, retired services or other personal information so we can address it.

11. Security

We use HTTPS, access controls, protected credential verification records and encrypted database backup copies to protect information. Console cookies are restricted to our site and HTTPS, and workspace access is limited by membership and permissions. We do not store the full API keys shown when you create them.

No system is perfectly secure, so we cannot promise that information will never be accessed without permission. Keep your API keys secret, revoke any key that may be exposed, and sign out of the console on shared computers.

12. International transfers

We are based in the United States. If you use our services from another country, your information is transferred to and processed in the United States. Requests you send, and any files in them, may be processed in any region where our cloud hosting runs, rather than in one fixed region. Website form emails are sent from Japan. Hosting, verification, delivery and other recipients can also process information internationally, as section 6 describes. Data protection law in those places may differ from the law where you live.

You can ask jaber@rightnowai.co for processing locations, information about applicable transfer safeguards and a copy of those safeguards.

13. Children

Our services are not directed to children under 13, and the console is only for people 18 or older, or the age of majority where they live if that is higher. If you believe a child has given us personal information, email jaber@rightnowai.co and we will delete it.

14. Changes to this policy

We post every change on this page with a new date. If a change is material, we will tell console users by email or show a notice on the website at least 30 days before it takes effect. Earlier versions and their separate notice periods are available on request from jaber@rightnowai.co.

15. Contact