Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, and profile image, provided directly or through a third-party sign-in provider (Google or GitHub).
• Content you create — feature requests, clarification conversations, PRDs, tasks, comments, organization and team details, and any other material you submit to the Service.
• GitHub data — when you connect a repository through our GitHub App, we access repository metadata, pull requests, branches, commit references, and diffs needed to run AI reviews. We request only the permissions required to operate these features.
• Billing information — subscription and payment records processed by our payment provider. We do not store full card numbers on our servers.
• Usage and device data — log data, IP address, browser type, and interactions with the Service, collected to keep the Service secure and reliable.

• Provide, operate, and maintain the Service, including generating PRDs, tasks, and AI code reviews.
• Authenticate you and secure your account and organization.
• Process transactions and manage subscriptions.
• Send transactional messages such as invitations, notifications, and shared documents.
• Monitor usage, prevent abuse, and improve the Service.
• Comply with legal obligations and enforce our Terms of Service.

Core features of the Service use artificial intelligence. To generate PRDs, break work into tasks, and review pull requests, we send relevant content — such as your feature descriptions, clarification answers, and repository diffs — to our AI provider (OpenAI) for processing. This data is used to produce your requested output. We do not use your private content to train our own models, and our AI provider processes it under its applicable data processing terms.

We rely on trusted third parties to deliver the Service. These providers process data on our behalf under their respective terms:

• GitHub — repository access and pull request review.
• OpenAI — AI generation and review.
• Resend — transactional email delivery.
• Razorpay — subscription billing and payment processing.
• Pusher — real-time updates within your workspace.
• Cloud hosting and database providers — infrastructure that stores and serves the Service.

We do not sell your personal information. We share information only: with the subprocessors listed above to operate the Service; with other members of your organization, who can see content created within that organization; when required by law or to respond to valid legal requests; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain your information for as long as your account or organization is active, or as needed to provide the Service. When you delete content, your account, or your organization, the associated records are removed from our production systems, subject to reasonable backup retention and any legal obligations that require us to keep certain data.

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit, scoped access controls, and least-privilege integration permissions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can update much of your information from your profile and settings, or contact us to exercise these rights. We will respond consistent with applicable law, including the GDPR and CCPA where they apply.

You can permanently delete your account and its data at any time from Settings inside the app. See our Account Deletion page for the exact steps and what is removed.

Your information may be processed in countries other than your own, including where our providers operate. Where required, we use appropriate safeguards for such transfers.

The Service is not intended for individuals under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or our data practices, contact us at privacy@reqraft.in. See also our Terms of Service.