Privacy Policy

Ruwwad LLC ("Raqi.io", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (raqi.io) and use our platform services (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Data Controller

The data controller responsible for your personal data is:

Ruwwad LLC
Email: info@raqi.io
Support: support@raqi.io

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Profile picture (via Google OAuth)
• Organization/workspace name
• Password (if applicable, stored in hashed form only)

2.2 Messaging Data

When you connect messaging channels (Instagram, Facebook Messenger, WhatsApp, Telegram, Email), we process:

• Conversation messages: text, media, and attachments
• Contact information: name, profile picture, and platform identifiers of your customers/leads
• Message metadata: timestamps, read receipts, delivery status
• Channel credentials: access tokens, stored in our database and encrypted at rest

2.3 Usage Data

We automatically collect:

• IP address and approximate location
• Browser type, version, and operating system
• Pages visited, features used, and time spent
• Referring URL and exit pages
• Device identifiers and screen resolution

2.4 AI-Processed Data

When you use our AI features (AI agents, automated responses, content generation), we process:

• Conversation context provided to AI models
• AI-generated responses and suggestions
• Custom training data and brand voice settings you configure

2.5 Payment Information

Payments are processed by Dodo Payments, our payment partner and merchant of record. You enter your card or other payment details on Dodo Payments' checkout, and they never reach our servers. We keep the billing records needed to run your account: your plan and billing cycle, your purchase history, and the customer and subscription references Dodo Payments gives us.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service: deliver omnichannel messaging, AI agent functionality, workflow automation, and analytics
• Process conversations: route messages between your connected channels and your team inbox
• Power AI features: generate AI responses, suggestions, and automated workflows using third-party AI providers
• Manage your account: authenticate users, manage subscriptions, process payments
• Communicate with you: send service updates, security alerts, and support notifications
• Improve the Service: analyze usage patterns, debug issues, and develop new features
• Ensure security: detect fraud, prevent abuse, and enforce our Terms of Service
• Comply with legal obligations: respond to lawful requests from authorities

4. Legal Bases for Processing

We process your personal data under the following legal bases (as applicable under GDPR and similar regulations):

• Contract Performance: processing necessary to provide the Service you subscribed to (Article 6(1)(b) GDPR)
• Legitimate Interest: processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security (Article 6(1)(f) GDPR)
• Consent: where you have given explicit consent for specific processing activities, such as marketing communications (Article 6(1)(a) GDPR)
• Legal Obligation: processing necessary to comply with applicable laws and regulations (Article 6(1)(c) GDPR)

5. Data Sharing & Third Parties

For a complete and up-to-date list, visit our Subprocessors page. We may also disclose your information if required to do so by law, in response to a valid legal process, or to protect the rights, property, or safety of Ruwwad LLC, our users, or the public.

6. Meta Platform Data

When you connect your Facebook Page, Instagram Business Account, or WhatsApp Business Account to our Service, we access and process data through Meta Platform APIs in accordance with the Meta Platform Terms and Meta Developer Policies.

Specifically:

• We access only the data necessary to provide the messaging and automation features you configure.
• We do not sell Meta Platform data to third parties.
• We do not use Meta Platform data for purposes unrelated to the Service.
• We do not use Meta Platform data to build user profiles for advertising.
• Access tokens are stored securely and are never exposed to unauthorized parties.
• We comply with all Meta Platform rate limits and data handling requirements.

User Data Deletion

7. Google User Data

This section explains how Raqi.io accesses, uses, stores, shares, and deletes data we receive from Google when you sign in with Google or connect a Google app to your workspace.

7.1 Data we access

• Sign in with Google: your name, email address, and profile picture (the openid, email, and profile permissions). We use them to create your account, sign you in, and show your name and picture inside Raqi.io. We show the picture from Google's servers and do not copy it.
• Google Sheets (only if you connect it): the rows of the spreadsheets you choose. Raqi.io can read those rows, add new rows, and create a new spreadsheet for you. The drive.file permission limits us to files you pick or create with Raqi.io.
• Google Docs (only if you connect it): the text of the documents you choose, or of the documents in a folder you choose. Raqi.io can read that text, add text to the end of a document, and create a new document for you.
• Google Calendar (only if you connect it): the list of your calendars, so you can pick one, and the events on a given day, so an AI agent can find free times. Raqi.io can create new events, for example when a customer books a meeting.
• Gmail as an email sender (only if you connect it in Apps, Email): your email address and the permission to send email on your behalf (gmail.send). Raqi.io uses it only to send the email campaigns and test emails you create, from your own address. It cannot read, list, or delete the email in your mailbox.
• Gmail inbox (only if you connect it with your own Google Cloud app): the email you receive, which Raqi.io brings into your team inbox, and the ability to send email and replies from your address.

We ask for each Google permission only when you turn on the feature that needs it. Raqi.io never reads Google data you have not connected.

7.2 How we use it

We use Google data only to provide the features you set up in Raqi.io: signing you in, letting your AI agents and workflows read and update the sheets, documents, and calendars you connected, sending the email campaigns you create from your Gmail address, and sending and receiving email in your inbox.

When you let an AI agent or workflow use a connected Google file or calendar, we send the relevant part (for example the matching rows, the document text, or the free and busy times) to our AI provider, OpenAI, to write the reply or result you asked for. We do not use Google data to develop, improve, or train generalized AI or machine learning models.

7.3 What we never do with Google data

• We do not sell it.
• We do not use it or transfer it for advertising, including retargeting, personalized ads, or interest-based ads.
• We do not use it to decide credit-worthiness or for lending.
• Our staff do not read it unless you ask us to (for example in a support request), it is needed to investigate abuse or a security issue, or the law requires it.

7.4 Storage, security, and sharing

The access tokens Google gives us are stored in our database (Supabase), which is encrypted at rest, and are sent only over encrypted connections (TLS). They are used only by our servers and are never shown back to your browser. We share Google data only with the service providers needed to run the feature you use (Supabase for storage, Railway for our servers, and OpenAI for AI replies), and with others only when the law requires it or you ask us to.

7.5 Retention and deletion

We keep Google access only while the connection is active. Most Google content is read when a feature needs it and is not stored separately. Some content is saved in your workspace because the feature needs it, for example email brought into your inbox. That content follows the retention periods in section 8.

• You can disconnect any Google app in Raqi.io at any time. For connections made through Raqi.io's own Google app, disconnecting also revokes our access at Google.
• You can also remove Raqi.io's access from your Google Account at myaccount.google.com/permissions.
• To delete Google data we have stored, email info@raqi.io. We delete it within 30 days unless the law requires us to keep it.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service:

Upon account termination, you may request an export of your data before deletion by contacting support@raqi.io.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: all data transmitted to and from our Service uses TLS 1.2 or higher.
• Encryption at rest: database records and file storage are encrypted using AES-256.
• API key security: API keys are hashed using SHA-256 before storage; raw keys are displayed only once at creation.
• Authentication: we support Google OAuth and secure session management via Supabase Auth.
• Access controls: role-based access control (RBAC) with workspace-level data isolation.
• Infrastructure: our backend runs in isolated Docker containers with automated deployments.

For more details, visit our Security page. While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access (Article 15 GDPR):request a copy of the personal data we hold about you.
• Right to Rectification (Article 16 GDPR):request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17 GDPR):request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing (Article 18 GDPR):request that we limit how we use your data.
• Right to Data Portability (Article 20 GDPR):receive your data in a structured, machine-readable format.
• Right to Object (Article 21 GDPR):object to processing based on legitimate interest.
• Right to Withdraw Consent (Article 7(3) GDPR):withdraw consent at any time for consent-based processing.

To exercise any of these rights, contact us at info@raqi.io. We will respond within 30 days.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.
• Right to Opt-Out of Sale: we do not sell your personal information.

12. International Data Transfers

Your data may be transferred to and processed in the United States and in the other countries listed for our service providers in section 5 and on our Subprocessors page. If you are located in the European Economic Area (EEA), United Kingdom, or other regions with data protection laws, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements with all subprocessors.
• Compliance with the EU-U.S. Data Privacy Framework where applicable.

13. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such data promptly. If you believe a child under 16 has provided us with personal data, please contact us at info@raqi.io.

14. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience with the Service. For detailed information about the types of cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. If we make material changes, we will notify you by posting a prominent notice on the Service or by sending you an email notification. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: info@raqi.io
• Support: support@raqi.io
• Website: raqi.io

Raqi.io is a product of Ruwwad LLC.