Privacy Policy

Remac Technologies Inc. is a Delaware corporation. In this policy, “Remac,” “we,” “us,” and “our” refer to Remac Technologies Inc. Contact us at hi@remac.io.

This policy applies when Remac decides why and how personal information is processed. This includes the public website, waitlist, account administration, billing, security, support, and product communications.

When a customer connects a data source, stores context, or sends data to a destination, the customer decides what data Remac processes and why. For that Customer Data, Remac acts on the customer's instructions. The customer's privacy notice and any applicable data processing agreement govern that processing. If your information appears in a Remac customer's data, contact that customer first.

This policy does not govern websites, models, databases, storage systems, or other services operated by someone else.

Depending on how you use Remac, we collect:

• Account and profile information. Name, email address, avatar, authentication method, verification state, accepted terms, and account status.
• Authentication and security information. Password hashes, OAuth account identifiers, session and refresh token hashes, API key names and hashes, verification and reset records, login attempts, IP addresses, browser or device data, and security events.
• Billing information. Plan, billing interval, subscription status, trial and billing dates, Stripe customer, subscription, checkout, price, and webhook identifiers. Stripe handles payment card details in its hosted checkout and billing services.
• Service configuration. Source, saved operation, Collection, Pipeline, and Destination settings; encrypted connection credentials; schedules; selected destinations; and usage limits.
• Customer Data. Data read from or sent by connected sources, Context Records, selected fields, text, tags, source identifiers, stored record versions, embeddings, destination payloads, and delivery results. Customer Data can contain personal information chosen by the customer.
• Usage and diagnostic information. Request time, route, response status, account or API-key identity, service events, audit records, error details, execution state, delivery attempts, and related operational metadata.
• Waitlist and communications. Name, email address, company, use case, submission source, priority-access request, messages, support requests, and feedback.

Fields identified as required are needed to create or secure an account, configure the requested service, or complete a payment. If you do not provide them, Remac may be unable to provide that part of the service.

We receive information:

• directly from you or your organization;
• from GitHub or Google when you use OAuth sign-in;
• from Stripe when you start or manage a subscription;
• from sources, webhooks, files, APIs, and other systems that a customer connects to Remac;
• from destinations and infrastructure involved in processing a request or delivery; and
• automatically from browsers, devices, network requests, and service operation.

We use information to:

• create, verify, secure, and administer accounts;
• retrieve data, create context, store selected records, create embeddings, run Pipelines, and deliver prepared data;
• connect to sources and destinations selected by a customer;
• process subscriptions and maintain billing records;
• provide support, send service messages, and respond to requests;
• detect fraud, enforce limits, prevent misuse, investigate failures, and protect the service;
• maintain, test, and improve Remac;
• manage the waitlist and requested product communications; and
• comply with law, enforce agreements, and establish or defend legal claims.

Where law requires a legal basis, we rely on performance of a contract, steps requested before entering a contract, consent, compliance with legal obligations, and our legitimate interests in operating, securing, and improving Remac. The basis depends on the information, purpose, and applicable law.

For Customer Data, Remac uses information only to provide, secure, support, and maintain the services under the customer's instructions, our agreement, and applicable law.

Remac creates and retrieves data for customer workflows. Remac does not make legal, credit, employment, insurance, medical, or similarly significant decisions about individuals on its own.

Remac processes only the sources, operations, fields, records, and destinations selected by the customer. The customer is responsible for having a lawful basis and the required rights to connect and process that data.

When a workflow requires embeddings, Remac sends the selected text to OpenAI, the current embedding provider, and stores the returned embedding with the related Context Record. When a customer selects an external destination, Remac sends that destination the prepared payload and connection metadata required to complete the delivery.

An immediate context request with saving disabled does not add the returned records to a Remac Collection. Security, operational, and provider records associated with the request can still be retained as described in this policy.

We disclose information to:

• infrastructure, database, security, logging, and support providers that help operate Remac;
• email providers that send verification, reset, account, and product messages;
• Stripe for checkout, subscriptions, and billing management;
• GitHub or Google when you choose their sign-in service;
• OpenAI when selected text must be converted into embeddings;
• customer-selected sources, destinations, endpoints, models, agents, and applications as required by the configured workflow;
• professional advisers, auditors, insurers, and transaction advisers under appropriate duties of confidentiality; and
• courts, regulators, law enforcement, or other parties when law requires it or when reasonably necessary to protect rights, safety, and service integrity.

We can disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of our business. The recipient must use personal information consistently with this policy unless law permits otherwise.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use personal information for targeted advertising.

Remac uses strictly necessary cookies for session and refresh credentials, CSRF protection, and OAuth state. Authentication cookies are HTTP-only. In production, browsers send them only over HTTPS. Cross-site restrictions help prevent unauthorized requests.

The public website currently does not use advertising cookies, analytics cookies, or cross-site tracking cookies. Other parties do not collect information through Remac about your activity over time across unrelated websites for advertising purposes.

During account verification, sign-in, or password recovery, the frontend can temporarily keep the submitted email address in the browser's session storage to prefill the next step. Session storage is limited to the browser tab and clears when the tab is closed, unless the application removes it sooner.

Browsers can send Do Not Track or Global Privacy Control signals. Because Remac does not currently sell or share personal information for cross-context behavioral advertising, there is no advertising sale or sharing to opt out of through those signals. We will honor any signal that applicable law requires for other covered processing.

We retain information for the time needed to provide the service, maintain security and delivery records, comply with law, resolve disputes, and enforce agreements. Retention depends on the data and the customer's configuration.

• Waitlist entries are deleted after 90 days.
• Login-attempt records are deleted after 30 days.
• Sessions remain until they expire or are revoked, then a scheduled cleanup removes them.
• Stored context can retain current and prior record versions. Removing the related Source, Collection, or Pipeline can remove linked records, subject to backups and legal holds.
• Destination payloads and execution records remain while needed to complete, inspect, and resolve deliveries.
• A completed webhook delivery can retain its delivery identity and request hash to detect duplicates after its payload is no longer needed.
• Billing, audit, security, tax, and legal records can remain longer when required for their purpose.

Deleting an account revokes its active sessions and disables access. A privacy deletion request can require additional steps to remove or de-identify personal information. Some information can remain in backups until those backups expire, or longer when law or a legal hold requires it.

Remac uses administrative, technical, and organizational measures designed for the information and risk. Account names and email addresses, source and destination credentials, saved operation bodies, selected Pipeline input, session device information, and hosted checkout URLs are encrypted in application storage. Passwords, API keys, session credentials, and verification codes are stored as hashes. A new API-key secret is returned once when it is created and is not stored in retrievable form.

Remac uses transport encryption, access controls, request-size and rate limits, credential separation, audit records, and bounded service operations. No security measure prevents every incident. Contact hi@remac.io if you believe an account or API key has been compromised.

Remac and its providers can process information in the United States and other countries where they operate. Those countries can have different privacy laws. Where required, we use an approved transfer mechanism or other lawful safeguard for international transfers.

Depending on where you live and the role Remac has for your information, you can have the right to:

• know whether and how we process your information;
• access it or receive a portable copy where required;
• correct inaccurate information;
• delete information;
• restrict or object to certain processing;
• limit covered uses or disclosures of sensitive personal information;
• withdraw consent where processing relies on consent;
• appeal a decision about a privacy request;
• opt out of covered sale, sharing, or targeted advertising; and
• complain to a privacy or data protection authority.

Send a request to hi@remac.io. State your request and the email associated with your account or submission. We can ask for information needed to verify identity and authority. An authorized agent can submit a request where law permits. We will not discriminate against you for exercising a privacy right.

If Remac processes your information for a customer, send the request to that customer. We will assist the customer as required by our agreement and applicable law.

During the preceding 12 months, Remac can collect the categories described in Section 3, including identifiers, account and authentication data, commercial and subscription data, internet or network activity, professional information submitted for the waitlist, and sensitive account credentials. Customer Data can contain other categories selected by a customer. We use and disclose these categories for the purposes and to the recipients described in Sections 5 through 8.

Remac uses sensitive account credentials only to provide, authenticate, secure, and administer the service. Remac does not use them to infer characteristics about a person. Remac has not sold personal information or shared it for cross-context behavioral advertising during the preceding 12 months.

Remac is a business service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. Contact hi@remac.io if you believe a child provided personal information directly to Remac.

We can update this policy when our services, providers, or legal obligations change. We will post the revised policy, update the effective date, and provide additional notice when law requires it. If consent is required for a new processing purpose, we will request it before that processing begins.

Send privacy questions, rights requests, and complaints to Remac Technologies Inc. at hi@remac.io.