Privacy Notice

1. Who is responsible

The controller of the personal data described here is Aliaksandr Zasim, a sole trader entered in the Trade Register (živnostenský rejstřík) kept by Městský úřad Chomutov, IČO 30072638, Bezručova 4201, 430 03 Chomutov, Czech Republic. Privacy questions and requests go to hello@rationode.com.

For the content recorded in a workspace — problems, arguments, evidence, comments and decisions, which can include personal data about members, guests or other people — the customer that holds the workspace is the controller and we process it on its behalf. The terms of that processing are in the Annex to our Terms of Service. This notice covers the data we decide about ourselves: accounts, billing, security and support.

2. What we collect

Account data: your email address, display name, an optional profile picture you upload (or a copy of the one your sign-in provider shares), your email preferences (notification digests, low-credit alerts), how you heard about Rationode, if you answered when we asked after you created your first problem, and when you answered or skipped that question, and the workspaces you belong to with your role in each. If you sign in through Google, Microsoft or GitHub, we receive the identifier, email address, name and profile picture address that provider shares. If you sign in through your organization’s SAML single sign-on, we receive your email address and the name attributes your organization’s identity provider sends. Passwords you set with us are stored only as a salted hash; we never see passwords you use with other providers. A picture you upload (PNG, JPG or WebP, up to 1 MB) is re-encoded in your browser to 256 × 256 pixels, which removes its photo metadata (such as location) before upload. If your sign-in provider has a picture of you, your browser copies it once into our storage in the same way, where the provider allows it, and it is shown from there, so other people never load it from the provider; otherwise your initials are shown. Either picture is stored with the rest of your data, visible to members of your organizations, never to guests, and included in your workspace’s export.

Content: everything you and the other members of your workspace create — problems, options, arguments, evidence including uploaded files and links, comments, votes, decisions and their outcomes, AI analyses, and the connections between problems. Each item records who created it and when.

Billing data: a workspace’s plan, its credits and how they were spent, its spending limit for additional AI usage, and the Stripe identifiers that link to it. For each purchase: the buyer’s name, email, billing address, VAT number if given, and our invoices. On the Business plan we record, per billing period, which people were active in the workspace (opened it in the app, or reached it through their own MCP connection), to count those billed above the included number. Card and bank details go to Stripe directly and never pass through our systems.

Invitations and guests: the email address a member enters to invite someone, who invited them and when; and which guests joined a problem through which link. To send an invitation we store the inviter’s name, the workspace’s name and the role with the invited address until the invitation is accepted, revoked or deleted, and within a day after it expires, and we show the inviter’s name and the workspace’s name to the invited person, in the email and when they sign in.

Connections: for each connected tool, the account or site it is connected to (its name, identifier and address) and who connected it and when. For Jira and Confluence (authorized through Atlassian), GitLab, Bitbucket and Figma, which a member authorizes on the provider’s consent screen, we keep the access token and the refresh token the provider issues for that authorization, and no email address or Atlassian account identifier. Every token is stored encrypted, is never shown again, and is deleted when the connection is disconnected. For GitHub we keep no token: we connect through the Rationode GitHub App and request a short-lived token each time we read.

Tokens for agents: access tokens your members create for AI agents and continuous integration, and who created them.

Feedback: what you write when you send us feedback, the page you sent it from, any screenshots you attach, and our reply.

Error reports: the time, whether the error happened in the browser or on the server, the server function, the error message and stack trace, a fingerprint that groups identical errors, the page address, your user ID, your workspace’s ID, the app version, your browser’s user-agent string, and the operation and record ID involved. They never contain text you wrote.

AI usage records: which operation ran, for which problem and workspace, who started it, how many tokens it used and how many credits it cost.

Server logs: our hosting providers keep standard request and sign-in logs, including IP addresses.

Browser storage: we set no cookies of our own and use no advertising or analytics. Your browser stores the session that keeps you signed in, the workspace you last opened, unsent drafts of comments, problems and skills, whether you collapsed the side panel or the pack explanation, which coding agent you chose to connect, the Problems list filter you last chose, and, for a few minutes during checkout, where to bring you back. Each is needed for a function you use, so we do not ask for consent. If you install the Rationode plugin for Claude Code, it keeps, on your own computer, which files were already changed when a session started, so it checks only the agent’s changes; nothing of it is sent to us and it is deleted after 7 days.

What you must give us: an email address and a display name are needed to create an account. We name your first workspace from them, and you can rename it. Without them we cannot provide the Service. Everything else is optional.

3. Data we receive from others

We receive some personal data from other people and services, not from you:

• From a member of your workspace: your email address when they invite you, and anything they write about you in problems, comments or evidence.
• From Google, Microsoft or GitHub when you sign in with them: your identifier, email address, name and the address of your profile picture there. From your organization’s identity provider when you use single sign-on: your identifier, email address and name.
• From tools your workspace connects (Jira, Confluence, GitHub, GitLab, Bitbucket, Figma): names of authors, reviewers and commenters that appear in issues, pages, pull requests, commits or design files a member links or imports.
• From GitHub, when a member connects it: the name and identifier of the GitHub accounts where the Rationode app is installed.
• From GitLab, when a member connects it: that member’s GitLab user identifier and username. From Bitbucket: the identifier and name of the workspace connected.
• From Stripe: whether a payment succeeded and the subscription status. For each purchase: the buyer’s name, email, billing address, VAT number if given, and our invoices.

4. Why we process it and on what legal basis

To provide the Service you signed up for — creating your account, storing and showing your content to the people allowed to see it, sending the emails the product needs (confirmation, password reset, invitations, digests you can switch off), and processing payments. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

To run AI analyses when a member asks for one, automatically after changes to a problem (unless an owner or admin switches automation off), and to build the search index that finds related decisions. Legal basis: performance of the contract. No AI output is used to make a decision about you that has legal or similarly significant effects; we make no automated decisions within the meaning of Article 22 GDPR.

To keep the Service secure and working: error reports, server logs, abuse prevention and backups. Legal basis: our legitimate interest in running a reliable and secure service (Art. 6(1)(f)).

To count active people on the Business plan and to record AI usage, so we can charge correctly and detect misuse. Legal basis: performance of our contract with the customer that holds the workspace (Art. 6(1)(b)), and for the people counted, our legitimate interest in billing that contract correctly (Art. 6(1)(f)).

To answer feedback and support requests. Legal basis: our legitimate interest in improving the product and helping you (Art. 6(1)(f)).

To send you one short personal note from the founder about an hour after you first sign in, asking what brought you to Rationode, and to count how people hear about us from the optional answer we ask for after a person who created a workspace records their first problem. Legal basis: our legitimate interest in understanding why people sign up (Art. 6(1)(f)). The note is sent once; reply "stop" and we switch off your email notifications, or switch them off yourself in Settings.

To send an invitation email to someone a member invited. Legal basis: we do this as processor for the customer that holds the inviting workspace; see the Annex to our Terms.

To keep a former member’s display name on what they contributed or took part in, so a workspace’s record stays readable. Legal basis: our legitimate interest and the customer’s in a readable decision record (Art. 6(1)(f)); you may object, and deleting your account replaces the name with Deleted user.

To meet legal obligations, such as keeping invoices and tax records (Art. 6(1)(c)).

Where we rely on legitimate interest, we have weighed it against your interests. None of it involves profiling, and you may object (section "Your rights").

We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.

5. Who can see your content

Content belongs to exactly one workspace. It is readable by that workspace’s members and, for a single problem, by guests a member has explicitly invited through a guest link. This is enforced in the database itself through row-level security, not only in the application.

AI agents connected through the MCP endpoint act with the credentials of the member who configured them and see exactly what that member can see.

We access your content only to resolve a problem you reported, to investigate abuse or a security incident, or when the law requires it, and only as far as needed for that.

6. Who receives data

Data is stored in a Postgres database and private file stores hosted by Supabase in the European Union (Frankfurt, Germany).

Our processors handle data only on our instructions, each under a data-processing agreement.

• Supabase — database, authentication, file storage and server-side functions. Location: data hosted in the EU (Frankfurt, Germany); the contracting entity is Supabase Pte. Ltd., Singapore, and support staff may access it from outside the EEA. Safeguard for transfers outside the EEA: EU Standard Contractual Clauses in the Supabase DPA.
• Cloudflare — hosting and delivery of the web application. Location: global network; Cloudflare, Inc. is based in the United States. Safeguard for transfers outside the EEA: EU-US Data Privacy Framework certification, and EU Standard Contractual Clauses in the Cloudflare DPA.
• OpenAI — AI analyses and the search index. Location: we contract with OpenAI Ireland Ltd; processing by its affiliates in the United States. Safeguard for transfers outside the EEA: EU Standard Contractual Clauses in the OpenAI DPA.
• Resend — sending email: confirmations, invitations and notification digests. Location: United States. Safeguard for transfers outside the EEA: EU-US Data Privacy Framework certification, and EU Standard Contractual Clauses in the Resend DPA.

When an AI analysis runs, the content it needs is sent from our server to OpenAI: the problem’s description, options, arguments, evidence text and discussion and, where the analysis calls for it, summaries of the workspace’s earlier decisions or excerpts of its connected repositories and documents. The text of decisions, skills and searches is sent to OpenAI to build the search index. When a connected agent searches decisions or checks its changes, its search text, or its summary of the change and the changed file paths, is sent to OpenAI to find matching decisions; we do not store it. OpenAI may not train on any of this and deletes it after at most 30 days. The check also receives the repository’s address, which can be personal data when it names a person’s account; we use it only to find decisions linked to those files, do not send it to OpenAI and do not store it.

Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments and issues our invoices and receipts. It receives your payment details, name, billing address, VAT number if given, and email at checkout. For billing and invoicing it acts as our processor; for fraud prevention and its own legal duties it acts as an independent controller under its own privacy notice. Its transfers outside the EEA rely on the safeguards in its data processing agreement.

When your workspace connects one of its own tools — Atlassian (Jira, Confluence), GitHub, GitLab, Bitbucket, Figma — we read from it with the authorization a member granted at the provider (Atlassian for Jira and Confluence, GitLab, Bitbucket, Figma), or, for GitHub, through the Rationode GitHub App installed for your workspace, and for Jira and Confluence we write the issues and pages a member asks for. Those providers are not our processors; your organization’s own contract with them governs the data held there.

We will update this list, and notify workspace owners, at least 30 days before adding a processor that handles your content.

7. How long we keep it

Content, members, connections, tokens and feedback are kept while the workspace exists (feedback until its sender deletes their account, if that comes first), because the purpose of the product is that a decision and its rationale stay readable years later. An owner can delete the workspace in Settings at any time: its records are removed at once and its stored files within a day. Backups held by our hosting provider age out within seven days.

An invitation record — the invited address, who invited them, the workspace and when — is deleted within 31 days after the invitation ends (accepted, revoked or expired), or at once with its workspace. If the invited address had no account, the account record our invitation email created for it is deleted within two days after its last invitation ends, unless that person signed up or signed in meanwhile.

A connection in progress — who started it, for which workspace and tool, and the GitHub accounts offered for choice, and for GitLab and Figma a one-time code that proves the request came from us — can be used for ten minutes and is deleted when used, or within a day if abandoned.

Account data is kept while your account exists. You can delete your account in Settings: your profile and profile picture, memberships, votes, MCP connections and the feedback you sent are deleted. What you contributed to workspaces that continue — comments, options, arguments, evidence, files, skills and decisions — stays in that workspace, whose customer is its controller, and is attributed to Deleted user; see section 8 for requests about it. If you leave or are removed from a workspace, your display name stays shown to its members and to the problem’s guests on what you contributed, so the record stays readable (our legitimate interest and the customer’s, Art. 6(1)(f)); deleting your account replaces it with Deleted user.

Error reports are deleted within five weeks: a weekly job removes every report older than 30 days. Pending notification emails are deleted the same way.

Billing records, AI usage records and the Business plan’s activity records are kept while the workspace exists, and invoice-related data for as long as Czech accounting and tax law requires, currently up to ten years.

A guest link stays open for 30 days unless a member renews or revokes it. If the workspace’s plan ends, its guests lose access until the plan is paid again; their links and contributions are kept.

Sign-in records (time, IP address and browser of each sign-in) are deleted after 90 days. Server logs are kept by our hosting providers for their own log retention period.

8. Your rights

Under the GDPR you may ask us for access to the personal data we hold about you, for its correction or deletion, for restriction of processing, for a copy in a portable format, and you may object to processing based on our legitimate interests. Where processing rests on consent you may withdraw it at any time; this does not affect processing that already happened.

You can change your name, profile picture and email preferences in Settings; removing the picture deletes it. A problem can be exported on a paid plan. An owner or admin can export the whole workspace from Settings as a ZIP file, on every plan. You can delete your account, and an owner can delete a workspace, in Settings. You can also ask us at hello@rationode.com; we answer within 30 days.

If you believe we process your data unlawfully, you may complain to a supervisory authority, in particular the one in the EU country where you live or work. Our authority is Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.

Requests about content recorded in a workspace — for example, a comment that mentions you — are decided by the customer that holds the workspace, as controller; we will forward such requests to the workspace’s owners and help them respond.

9. Security

All traffic to and from the Service is encrypted in transit. Data is encrypted at rest by our hosting provider. Every table in the database is protected by row-level security tied to your authenticated identity, and the same rule protects uploaded files. Secrets such as API keys never reach the browser; privileged operations run only on the server.

No system is perfectly secure. If we become aware of a breach that is likely to put your rights at risk we will notify the owners of the affected workspaces and the supervisory authority as the GDPR requires.

10. Workspaces: the customer as controller

When personal data is recorded in a workspace, the customer that holds the workspace is the controller of that data and we are its processor. The terms of that processing, including the list of our sub-processors and how we notify changes to it, are in the "Annex: Data Processing Terms" at the end of our Terms of Service.

11. Children

The Service is a tool for teams at work and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe a child has created an account, contact us and we will delete it.

12. Changes to this notice

We will update this notice when the product or our providers change. Material changes — a new processor that handles your content, a new purpose, a change of region — are announced to workspace owners by email or in the application at least 30 days before they take effect. The date at the top shows the current version.

13. Contact

Privacy questions and requests go to hello@rationode.com.