Privacy Policy

I. INFORMATION WE COLLECT

We collect “Non-Personal Information” and “Personal Information.” Non-Personal Information includes information that cannot be used to personally identify you, such as anonymous Site usage data, general demographic information we may collect, referring/exit pages and URLs, platform types, preferences you submit and preferences that are generated based on the data you submit and number of clicks. Personal Information includes your email address, name, company name, IP address, and any other information you provide during the registration process or while using our services. Additionally, if you contact us for support, we may collect information related to your inquiry.

1. Information collected via Technology

When you sign in to the dashboard, you provide your email address, and the sign-in method you choose may share further Personal Information, as described in section 2 below. The Site also receives information from your browser when you visit or use it, such as the website you came from (known as the “referring URL”), the type of browser you use, the device from which you connected to the Site, the time and date of access, and other information that does not personally identify you. To count visits, Vercel Web Analytics receives the address of each page you open, the page that sent you and the time; it works out your country, region and city from your IP address, notes your browser, operating system and device type, and tells visits apart with a hash of the request that it discards after 24 hours, without cookies. We see totals, not individual visitors, and the pages of the sign-in and the dashboard are reported, if at all, by their path only.

Vercel keeps logs of requests to the Site and the dashboard, such as the page, query, browser, region and IP address, for the period our hosting plan sets. It also sends the logs of our server code, with those request details, to Better Stack, which removes the IP address from each line as it arrives, keeps the lines for 90 days, and then deletes them.

Apart from the dashboard, the Site's pages set no cookies of their own. If you choose a theme, the choice is saved in your browser's local storage. The dashboard sets only these cookies, which your browser sends only to www.rightnowai.co and only over HTTPS:

• __Host-rn-auth, in one or more parts, holds your signed-in session. The cookie can stay in your browser for up to 400 days, but the session in it ends when you sign out, after 7 days without use, or after 30 days, whichever comes first.
• __Host-rn-auth-code-verifier completes a sign-in. It is removed when the sign-in completes, and otherwise can stay up to 400 days.
• __Host-rn-join keeps an invitation link while you sign in, for up to 15 minutes, and is deleted when you accept the invitation.
• __Host-rn-ws remembers the workspace you opened last, so the dashboard can open it again. It holds only that workspace's id and lasts up to 30 days.
• __Host-rn-link lets an emailed sign-in link work only in the browser that asked for it. It holds a one-way hash of your email address, never the address itself, lasts up to 10 minutes, and is deleted when the link signs you in.

Signing out removes the cookies that hold your session and complete a sign-in, and leaves the other three. The sign-in page also keeps the sign-in method you last used in your browser's local storage, so it can offer that method again. If an attack ever makes us ask your browser to pass a security check on the Site, Vercel may set a cookie that records the check. When you sign in with Google or GitHub, your browser passes through our sign-in host auth.rightnowai.co, which Cloudflare serves, and Cloudflare may set its own security cookies there: __cf_bm, which its bot protection uses and which ends after 30 minutes without use, and cf_clearance, which records that your browser passed its check. Those security cookies are strictly necessary.

RightNow Agent

RightNow runs on your machine. Its configuration, session transcripts, receipts, memory files, and local diagnostic log are stored under your RightNow home directory, which is ~/.rightnow by default. The shipped configuration disables telemetry, so RightNow does not send usage analytics to the Company.

To generate model output, RightNow sends your prompt, relevant contents of files the agent reads, and relevant tool results to the model provider selected in your configuration. The shipped configuration selects RunInfra at api.runinfra.ai, which is the Company's hosted model API. If you select Cerebras, Groq, OpenRouter, or Vercel AI Gateway with your own API key, that provider receives this data under its own terms. When the model uses web tools, web searches are sent through DuckDuckGo and web fetches contact the requested public sites.

RightNow's account sign-in is retired. The published version still has the rightnow login, rightnow status and rightnow logout commands: rightnow login now opens RunInfra's pricing page, and the Site refuses the other account commands and keeps nothing from them beyond its request logs. If you signed in before September 13, 2026, your machine may still hold that account's email address and plan in ~/.rightnow/account.json and its old sign-in tokens in ~/.rightnow/auth.json, until you run rightnow logout or delete them.

An earlier waitlist

An earlier waitlist for RightNow Agent still accepts sign-ups at its web address, although no page links to it. Each sign-up stores the email address, the operating system, a status, and salted one-way hashes of the IP address and browser in Neon, which also counts attempts per hashed IP address to stop floods. Resend sends a confirmation email, which says that we will email updates about RightNow Agent. Entries from an earlier version may also hold an IP address and a GPU model name. We keep the entries and the attempt counts until we delete them.

2. Information you provide when you sign in to the dashboard

You sign in to the dashboard with Google, with GitHub or with your email address. There is no password. When you sign in with Google or GitHub and approve the sign-in, the provider shares your account's email address and whether it is verified, your name, your profile picture link, the provider's identifier for your account and, for GitHub, your username. From Google we ask only for the openid, email and profile permissions.

If you sign in with your email address, you type it on the sign-in page, and Supabase Auth emails you a sign-in link and a code from login.rightnowai.co, through Resend. The link and the code expire after 10 minutes. The dashboard's emails may show our logo as an image from assets.rightnowai.co, which Cloudflare serves; if your email app loads it, Cloudflare receives your IP address and the app's user agent.

The sign-in page runs Cloudflare Turnstile for every visitor, in its email form: a check that tells people from automated programs. We send a sign-in email only once that check has passed. For the check, Cloudflare receives your IP address and signals from your browser, such as its user agent and TLS fingerprint, whichever way you sign in, and it also uses those signals, under its own terms, to improve the check.

Supabase Auth, which runs in the United States (AWS us-east-1), keeps your sign-in profile with your sessions, and logs each sign-in event with the IP address and browser it came from, to keep accounts secure. To stop abuse, we count sign-in requests from each network address and for each email address, and the dashboard's other requests from each person, in Upstash, under one-way hashes of the network address, the email address or the account's id; each count lasts at most a day. By signing in, you authorize us to collect, store and use this information in accordance with this Privacy Policy.

3. Children's Privacy

The Site and the Service are not directed to anyone under the age of 13. The Site does not knowingly collect or solicit information from anyone under the age of 13, or allow anyone under the age of 13 to sign up for the Service. In the event that we learn that we have gathered personal information from anyone under the age of 13 without the consent of a parent or guardian, we will delete that information as soon as possible. If you believe we have collected such information, please contact us at jaber@rightnowai.co.

II. HOW WE USE AND SHARE INFORMATION

GDPR Lawful Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide RightNow Agent, the dashboard and related account services
• Legitimate Interests: To improve our product, ensure security, prevent fraud
• Consent: For marketing communications and optional features (you can withdraw anytime)
• Legal Obligation: To comply with tax laws, respond to legal requests

RightNow Agent

RightNow keeps its configuration, session transcripts, receipts, memory files, and diagnostic log on your machine. It does not send those local files or usage analytics to the Company merely because they are stored there.

Model requests are sent to the provider you select. RunInfra is the Company's own hosted model API. Cerebras, Groq, OpenRouter, and Vercel AI Gateway are optional providers that you select and configure with your own API key. Those providers receive the prompts, relevant file contents, and tool results needed for their model requests and handle that data under their own terms. Web searches and fetches also share the query or request with DuckDuckGo or the public site contacted when those tools are used.

Personal Information:

Except as otherwise stated in this Privacy Policy, we do not sell, trade, rent or otherwise share for marketing purposes your Personal Information with third parties without your consent. We do share Personal Information with vendors who perform services for the Company, such as the provider that sends our transactional emails. A model provider that you select for RightNow receives model-request data under that provider's own terms, as described above.

In general, the Personal Information you provide to us is used to help us communicate with you. For example, we use Personal Information to contact users in response to questions, solicit feedback from users, provide technical support, and inform users about promotional offers.

We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce applicable Terms of Use, including investigation of potential violations; address fraud, security or technical concerns; or to protect against harm to the rights, property, or safety of our users or the public as required or permitted by law.

Non-Personal Information

In general, we use Non-Personal Information to help us improve the Service and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns on the Site. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners, advertisers and other third parties at our discretion.

In the event we undergo a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy, and that any acquirer of our assets may continue to process your Personal Information as set forth in this Privacy Policy. If our information practices change at any time in the future, we will post the policy changes to the Site so that you may opt out of the new information practices. We suggest that you check the Site periodically if you are concerned about how your information is used.

III. HOW WE PROTECT INFORMATION

We implement security measures designed to protect your information from unauthorized access. The dashboard uses no passwords: you sign in with Google, GitHub or a link and code sent to your email address, so keep those accounts and your mailbox safe, and sign out of the dashboard on shared computers. We further protect your information from potential security breaches by implementing certain technological security measures including encryption, firewalls and secure socket layer technology. However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such firewalls and secure server software. By using our Service, you acknowledge that you understand and agree to assume these risks.

Our trust center is at trust.rightnowai.co.

IV. YOUR RIGHTS REGARDING THE USE OF YOUR PERSONAL INFORMATION

You have the right at any time to prevent us from contacting you for marketing purposes. When we send a promotional communication to a user, the user can opt out of further promotional communications by following the unsubscribe instructions provided in each promotional e-mail. You can also indicate that you do not wish to receive marketing communications by emailing us at jaber@rightnowai.co. Please note that notwithstanding the promotional preferences you indicate by unsubscribing via email, we may continue to send you administrative emails, including, for example, periodic updates to our Privacy Policy or notifications about your account or service usage.

V. LINKS TO OTHER WEBSITES

As part of the Service, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Service. Therefore, this Privacy Policy does not apply to your use of a third party website accessed by selecting a link on our Site or via our Service. To the extent that you access or use the Service through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.

VI. CHANGES TO OUR PRIVACY POLICY

The Company reserves the right to change this policy and our Terms of Use at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary email address specified in your account or by placing a prominent notice on our site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Site and this privacy page for updates.

VII. CONTACT US

If you have any questions regarding this Privacy Policy or the practices of this Site, please contact us by sending an email to jaber@rightnowai.co.

VIII. DATA SUBJECT RIGHTS (GDPR)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format (JSON)
• Restrict processing of your data
• Object to processing of your data
• Withdraw consent for marketing

To exercise these rights, email jaber@rightnowai.co with your request. We will respond within 30 days.

Data Deletion

To delete your account and associated data held by the Company, email jaber@rightnowai.co with subject line “Account Deletion Request”. We will:

1. Confirm your identity
2. Permanently delete your account and the personal information held by the Company within 30 days
3. Send confirmation once deletion is complete

Exceptions: Billing records are retained for 7 years for tax compliance. Anonymized usage data may be retained for analytics. Copies in backups and logs are deleted on the schedules in Section X.

Account deletion does not remove RightNow configuration, session transcripts, receipts, memory files, or diagnostic logs stored locally on your machine. You control and may delete those local files.

IX. THIRD-PARTY SERVICE PROVIDERS (SUBPROCESSORS)

We use the following services and providers to operate our platform and support user-selected model connections:

Fly.io runs the nightly job that makes that encrypted copy; the data passes through it while the job runs.

RunInfra is the Company's own hosted model API. If you select Cerebras, Groq, OpenRouter, or Vercel AI Gateway in RightNow, you choose that provider and its terms govern its handling of model-request data. The other listed providers handle data for the purposes shown in the table.

Google and GitHub act under their own terms when you sign in with them. Accounts of the Site's earlier sign-in, which we closed on September 13, 2026, stay in a separate Supabase database in the US (AWS us-west-1) until we delete it, planned for about January 2027. We keep the copies of them that we exported no longer than that. Stripe keeps the billing records of the paid plans we closed the same day; we take no payments on the Site now.

For questions about our subprocessors, contact jaber@rightnowai.co.

X. DATA RETENTION

We retain your data as follows:

Active Accounts

• Account data: Retained while account is active
• Site usage analytics at Vercel: Kept on Vercel's schedule; the hash that tells visits apart is discarded after 24 hours
• Request logs: 90 days at Better Stack, and the period our hosting plan sets at Vercel
• Rate-limit counters in Upstash: At most a day
• Waitlist entries and attempt counts: Retained until we delete them

RightNow configuration, session transcripts, receipts, memory files, and its diagnostic log remain on your machine unless you remove them.

Deleted Accounts

• Company-held personal data: Permanently deleted within 30 days, except copies in backups and logs, which follow the periods in this section
• Anonymized analytics: May be retained indefinitely
• Billing records: 7 years (tax/legal compliance)

Backups

• Automated backups retained for up to 90 days
• Data in backups permanently deleted after retention period

To request early deletion of specific data, email jaber@rightnowai.co.

XI. INTERNATIONAL DATA TRANSFERS

Our hosted services are operated from the United States. The dashboard's data and our request logs are stored in US-based data centers:

• Dashboard sign-in and account data: AWS us-east-1 (Northern Virginia)
• The dashboard's rate-limit counters: AWS us-east-1 (Northern Virginia)
• Request logs: Vercel in the US, and Better Stack in AWS us-west-2 (Oregon)

Our encrypted nightly backups are kept in Cloudflare R2 in Eastern North America for 7 days.

The Site's form email is sent from AWS ap-northeast-1 (Tokyo), and Vercel and Cloudflare run networks worldwide. We keep the rate-limit counters of the Site's forms in a separate Upstash database, whose region we have not recorded. The table in Section IX shows each provider's location where we have recorded it.

If you access the Company's hosted services from outside the United States, data you provide to those hosted services will be transferred to and processed in the US. We protect it in transit with HTTPS.

For EU users: By using the Company's hosted services, you consent to this transfer. You have rights under GDPR including the right to lodge complaints with your local data protection authority.

RightNow data stored locally stays on your machine unless a feature sends it elsewhere as described in this Privacy Policy. Data sent to a model provider you select may be processed in locations described in that provider's terms.

Last Updated: This Privacy Policy was last updated on Friday, October 9, 2026.