Privacy Policy

1. Information We Collect

• Account data: name, email address, company name, login credentials (stored hashed), and session tokens.
• Billing data: subscription status, invoices, and payment metadata processed by Stripe (we do not store full card numbers).
• Product and usage data: product events you send or connect, campaign configuration, API key metadata, send volume, domain configuration, webhook settings, conversion goals, and feature usage logs.
• Message data: email content, recipients, delivery events, suppressions, and replies or inbound messages you route through the Service.
• Integration data: when you connect third-party services (for example GitHub, Google Ads, Google Search Console or Reddit), we receive the data needed to provide the integration, such as repository activity, ad and search performance, and posts you authorize.
• Decision records: when Ranla makes a call (for example, which search terms to block, which page to build, or how to sort a reply), we keep what it decided, the information it used, whether you approved, changed or rejected it, and what happened afterwards (for example, whether the page ranked or the ad led to a sign-up).
• AI assistant data: when you connect an AI assistant (for example ChatGPT, Claude, or Cursor), we receive the requests it sends on your behalf and an access token for your account, and we keep a record of the work it asks for.
• Technical data: IP address, browser type, device information, activity logs, and product analytics events (for example signups, billing actions, and feature usage).
• Waitlist and marketing data: email address and source when you request early access or interact with our public site.

2. Why We Collect Data

We collect and process data to provide and operate the Service, authenticate users, deliver email, attribute conversions, prevent abuse, improve reliability, support customers, and comply with legal obligations. We also use de-identified data to make Ranla better, as section 3 explains.

3. How Ranla Uses Data to Get Better

Ranla learns from how it is used, so it makes better calls for every customer. Your workspace's data stays yours. Here is what we do with it, what we never do, and how to turn it off.

4. Legal Bases for Processing

• Contract necessity: to provide the Service you request.
• Legitimate interests: security, abuse prevention, service improvement, infrastructure operations, and improving Ranla and training its models with de-identified data (section 3). You can object to this at any time, and turning off "Use my data to improve Ranla" stops it for your workspace.
• Consent: where required for optional communications, cookies, or features.
• Legal obligation: to comply with applicable laws and lawful requests.
• Your contacts and the people you email: you are the controller of their personal data and we act as your processor. We process it only to provide the Service to you, and never for the purposes in section 3.

5. How We Use Your Information

• Operate accounts, domains, campaigns, automations, API keys, and billing.
• Analyze product usage to recommend and run lifecycle marketing on your behalf, within limits you set.
• Send, receive, track, and troubleshoot email when you use our sending infrastructure.
• Monitor abuse, enforce guardrails, and protect platform integrity.
• Provide support and communicate about the Service.
• Measure product usage and improve onboarding, reliability, and feature development through analytics.
• Improve Ranla for all customers, train Ranla's own models, and build de-identified data sets, as described in section 3, unless your workspace has turned this off.

6. Data Sharing & Subprocessors

We do not sell personal data.

We use trusted service providers to operate the Service. Categories include cloud hosting (Google Cloud), mail delivery infrastructure, payment processing (Stripe), caching and queues (Redis), error monitoring (Sentry), website and product analytics (PostHog), email address verification before campaign sends (MillionVerifier, which receives the addresses being checked), and other vendors needed to run the Service.

When you connect an AI assistant to your account, we return to that assistant the workspace data its requests ask for, such as contacts and their product activity, campaigns and their results, email content and delivery status, revenue figures, and your conversations with Ranla. The assistant’s provider handles that data under its own terms and privacy policy. You can disconnect an assistant at any time, which ends its access.

We may disclose data when required by law, to prevent fraud or abuse, or to protect rights and safety.

In the future we may license de-identified, aggregated data sets to other companies, including AI companies, as described in section 3. They contain no personal data and nothing that identifies you or your business.

Customer data may be processed in the United States and other regions where our providers operate. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on safeguards recognized by law, such as the European Commission's Standard Contractual Clauses and the UK Addendum to them.

For a Data Processing Agreement or subprocessors list, contact [email protected].

7. Data Retention

• Active accounts: retained while your account is active and as needed to provide the Service.
• Message, event, and campaign logs: retained for operational, billing, attribution, and abuse investigation purposes according to plan and configuration.
• Decision records: retained while your account is active, and deleted with it.
• Deleted accounts: account data is deleted or anonymized within a reasonable period after deletion request, subject to legal retention requirements. A deleted workspace's data is left out of all future training runs and data sets.
• De-identified data: kept only as long as it is useful for improving Ranla. Because it can't be linked back to you, it can't be picked out and removed later (see section 3).

8. Security

We implement technical and organizational measures including encryption in transit, access controls, monitoring, and incident response procedures.

No method of transmission or storage is completely secure. You are responsible for securing your API keys, integration credentials, and account access.

9. Cookies

We use cookies and similar technologies for authentication, session management, essential site functionality, and, with your consent on public marketing and documentation pages, analytics and marketing tags loaded through Google Tag Manager (for example Google Analytics) and PostHog product analytics. The authenticated dashboard may use separate product analytics as described in this policy. We do not use advertising cookies without consent where required by law.

10. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data.

You can object at any time to processing based on our legitimate interests, including the uses in section 3. For those uses, the quickest way is to turn off "Use my data to improve Ranla".

To exercise these rights, email [email protected] or [email protected]. We will respond within applicable legal timeframes. If you are in the EEA or the UK, you can also complain to your local data protection authority.

11. US State Privacy Rights (Including California)

This section applies if you live in California or another US state with a consumer privacy law.

We do not sell personal information, and we have not sold any in the past 12 months.

Data sets we may license (section 3) contain only de-identified information, which is not personal information under these laws. We keep it de-identified, we publicly commit not to re-identify it, and we require anyone who receives it to agree to the same in writing.

Our public website may use advertising tags to measure our own ads, which some state laws call "sharing". They load only if you accept them in the cookie banner, so declining them opts you out.

You can opt out of any sale or sharing, and of the uses in section 3, by turning off "Use my data to improve Ranla" or by emailing [email protected].

You also have the right to know what personal information we collect, use and disclose, to have it deleted, and to correct it. We do not use sensitive personal information to infer things about you. You can use an authorized agent, and we will not treat you differently for using any of these rights.

The categories of personal information we collect are listed in section 1. We collect them from you, from your use of the Service, and from services you connect, for the purposes in sections 2 to 5, and we keep them as section 7 describes.

12. Children's Privacy

The Service is not directed at children under 16 in the EEA/UK or under 13 in the US. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised effective date and communicated as appropriate.