Privacy Policy

1. What Information Do We Collect?

Information You Provide Directly

• Phone number — collected for OTP-based authentication via Twilio. Your phone number is stored as a one-way cryptographic hash (PBKDF2-SHA256). The original phone number is discarded immediately after hashing. We do not store your raw phone number in our database.
• Billing information — payment card data is processed directly by Stripe. Resh Consultancy LLC does not store card numbers.
• Face photos — voluntarily uploaded for AI image generation. Transmitted directly to fal.ai for processing. Not stored by Resh Consultancy LLC. fal.ai stores generated media files on their CDN for a minimum of 7 days, after which files may be deleted. Request data (including prompts) is retained by fal.ai for up to 30 days. See fal.ai/legal/privacy-policy for full details.
• Uploaded files and documents — processed to deliver the requested service during your active session only. Not stored beyond the session.
• Conversation content — prompts and responses are stored in your conversation history to enable session continuity. They are not used to train AI models.

Automatically Collected Information

• Log data: IP address, browser type, operating system, pages visited, usage timestamps
• Usage metrics: message counts, feature usage, tier activity
• Device data: device type, screen resolution (for UI optimization)

2. How Do We Process Your Information?

We process your information to:

• Deliver AI-powered services through the R.ai platform
• Authenticate users via phone OTP (one-time password)
• Process payments and manage subscriptions (via Stripe)
• Maintain conversation history for session continuity
• Respond to support inquiries and administrative communications
• Protect the platform against fraud, abuse, and security threats
• Maintain forensic audit and governance logging (D.A.V.I.D. Forensic Spine — see Section 14)
• Comply with legal obligations
• Analyze usage trends to improve the service

3. Legal Bases (EU/UK GDPR)

4. When and With Whom Do We Share Your Information?

We share personal information only with service providers who perform services on our behalf under data processing agreements. We do not sell your personal information.

We may also disclose your information: (a) to comply with applicable law, regulation, or legal process; (b) to protect the rights, property, or safety of Resh Consultancy LLC, our users, or the public; (c) in connection with a merger, acquisition, or sale of all or a portion of our assets, with advance notice to affected users.

5. Artificial Intelligence Products

R.ai provides AI-powered services including conversational AI, image generation, document analysis, image analysis, AI-powered search, and natural language processing.

All AI inference is routed through a 15-tribe governance architecture. Prompts are processed by third-party AI providers (Novita AI/DeepSeek, Google Gemini, OpenAI, Together AI, fal.ai, Tavily) solely to deliver requested services and, for select responses, to independently verify accuracy through automated cross-checking before you see them. Third-party AI providers do not receive your account identity, phone hash, or billing information.

To opt out of AI processing, contact privacy@resh-ai.com or delete your account. Note that opting out of AI processing means you cannot use the core R.ai service.

6. International Transfers

Our servers are located in the United States (DigitalOcean). All listed third-party processors are US-based. If you access R.ai from the European Union or United Kingdom, your data is transferred to the United States.

Transfers from the EU/UK to the US are governed by European Commission Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with service providers. For questions about international data transfers, contact privacy@resh-ai.com.

7. How Long Do We Keep Your Information?

8. Security

We implement the following technical and organizational security measures:

• AES-256-GCM encryption — data encrypted at rest
• TLS 1.3 — data encrypted in transit
• Docker secrets management — credentials never in environment variables or source code
• Cloudflare WAF — web application firewall and DDoS protection
• JWT authentication — session tokens with short expiry
• UFW egress controls — network-level traffic controls on infrastructure
• D.A.V.I.D. Forensic Spine — immutable HMAC-signed audit trail on all governed inference calls
• Phone credential hashing — PBKDF2-SHA256 one-way hash; raw phone number discarded immediately
• Two-step verification — all platform access requires Phone OTP

9. Minors

R.ai is intended for users 18 years of age and older. We do not knowingly collect personal information from users under 18. By using R.ai, you confirm you are at least 18 years of age.

If we learn that we have collected personal information from a user under 18, we will delete that information promptly. If you believe we have collected data from a minor, contact us at privacy@resh-ai.com.

10. Your Privacy Rights

To exercise any right, contact privacy@resh-ai.com. We will respond within 30 days. EU/UK users may lodge complaints with their Member State data protection authority.

11. US State Privacy Rights

Submit rights requests to privacy@resh-ai.com. We will respond within 45 days (extendable by 45 days with notice). Appeals may be submitted to your state attorney general.

12. California "Shine the Light"

California Civil Code Section 1798.83 permits California residents to request information about personal data disclosed to third parties for direct marketing purposes. We do not disclose personal data to third parties for their direct marketing purposes. Submit any requests to privacy@resh-ai.com.

13. Breach Notification NEW

In the event of a data security breach that affects your personal information, Resh Consultancy LLC will:

• Notify affected users by email within 72 hours of becoming aware of the breach (consistent with GDPR Article 33/34 requirements)
• Notify applicable regulatory authorities as required by law
• Provide information on: what data was affected, what happened, what we are doing to address it, and what steps you can take to protect yourself
• Maintain a breach response log in the D.A.V.I.D. Forensic Spine

For security-related concerns or to report a vulnerability, contact privacy@resh-ai.com.

14. AI Governance and Biometric Data

R.ai operates under a governed AI architecture covered by USPTO provisional patent applications (7 filed). All user interactions are processed through a 15-tribe intelligence routing system that enforces domain-specific governance mandates at the inference layer.

Biometric Data (Face Photos)

• Face photos are voluntarily uploaded for AI image generation only
• Photos are transmitted directly to fal.ai for processing — not stored by Resh Consultancy LLC
• fal.ai stores uploaded photos on their CDN for a minimum of 7 days, after which files may be deleted. fal.ai request data is retained for up to 30 days
• Prior to uploading any face photo, users must provide explicit consent through an on-screen consent modal
• This consent mechanism complies with the Texas Capture or Use of Biometric Identifier Act (CUBI) and applicable biometric privacy laws
• Users may withdraw biometric consent and request deletion at any time by contacting privacy@resh-ai.com

Forensic Audit Logging

The D.A.V.I.D. Forensic Spine maintains an immutable, HMAC-signed audit record of governed inference calls. This log records governance decisions, gate routing, and response classifications — not the full content of your conversations. Audit logs are retained for up to 12 months for security, compliance, and platform integrity purposes.

Phone Number Handling

Phone numbers collected for OTP authentication are immediately converted to a one-way cryptographic hash (PBKDF2-SHA256). The original phone number is discarded immediately after hashing. The hash is used solely for account identity verification. Phone numbers are never transmitted to AI inference providers.

15. Data Processing Agreement (Enterprise) NEW

Enterprise customers who require a formal Data Processing Agreement (DPA) in accordance with GDPR Article 28, CCPA, or other applicable data protection laws may request one by contacting privacy@resh-ai.com.

The DPA will cover:

• Subject matter and duration of processing
• Nature and purpose of processing
• Type of personal data and categories of data subjects
• Obligations and rights of the controller
• Sub-processor list and notification procedures
• Technical and organizational security measures
• Standard Contractual Clauses for international transfers (where applicable)

Current Sub-Processor List: Novita AI, Google, OpenAI, Together AI, fal.ai, Tavily, DigitalOcean, Twilio, Supabase, Stripe, Cloudflare. We will notify enterprise customers at least 30 days before adding or replacing sub-processors.

16. Updates to This Notice

We may update this Privacy Notice from time to time. The updated version will be indicated by the updated date at the top of this page. For material changes, we will notify active users by email at least 14 days before the changes take effect. We encourage you to review this notice periodically.

17. Contact and Data Protection Officer

How to Review, Update, or Delete Your Data

To request access, correction, or deletion of your personal data, email privacy@resh-ai.com with the subject line "Data Request — [Access / Correction / Deletion]". We will respond within 30 days.