Legal / Privacy
Privacy Policy.
How Ragionex collects, uses, and protects your data.
Who we are.
Fuad Alizada, trading as Ragionex, operates the public website and Memory service and is the controller for account, website and service-use data. For privacy questions or rights requests, contact [email protected].
What we collect.
Account data
We store your email, account identifier, creation time, status, linked sign-in-provider identifiers, and plan and usage records. We use provider identity and verified-email information to complete sign-in; account records retain the email and provider identifier. We keep temporary sign-in and verification records, including email addresses, verification details and attempt counts, to verify access and prevent misuse. Abuse controls also use IP addresses and identifiers derived from email addresses.
Waitlist and product emails
When you join the Pro waitlist on our pricing page, we store your email address, the version of the consent text you agreed to and the time you joined. We use your email for the Pro invitation, product news and marketing offers from Ragionex that you agreed to receive. You can withdraw consent at any time through our contact form or by emailing [email protected], and every marketing email we send includes a way to unsubscribe. We delete waitlist entries when the waitlist's purpose ends. We retain the records needed to demonstrate consent and respect your choice.
Contact form
When you use the contact form on our website, we receive your email address and message together with your IP address and the time you sent it. We use your email address and message to answer your enquiry. We keep the IP address and time with the message to prevent abuse and, where necessary, to establish, exercise or defend legal claims. Our email delivery provider delivers your message to us.
Memory content
We process content you or your connected tools send to Memory, including edits, retained earlier versions and trashed records, to store, organise and retrieve your memories and operate these functions. We also process your search queries to find relevant memories. We store data derived from your content, together with record identifiers, creation and update times, status, revision, and creator and editor account and API-key identifiers. We do not send Memory content to external AI providers. We use Memory content only to provide and secure the service for you and the people you share a Vault with, and where the law requires it. We do not use it to train AI models.
Vaults and API keys
Vaults belong to your account. We store their names, identifiers, status and creation times. For shared Vaults, owners provide the email addresses of the people they invite and the permissions they offer. We keep invitations and membership information to arrange and manage that access, including before an invitee has an account. For each API key we store its name, permissions, owner, and creation, last-use and revocation times, plus what is needed to authenticate it. Revoked-key metadata remains for account administration and attribution.
Service logs
We log requests and errors to run and secure the service, including time, IP address, client software and version, requested URLs, referrers, status, account or key identifiers, and error details. URLs can include query parameters. Older logs and retained copies can also contain search queries or response excerpts.
Local connector data
Copies on your device are under your control. Deleting your Ragionex account does not erase them. Data sent to Ragionex is processed under this policy.
Why we process it.
We process data to operate, maintain, secure, support and improve the service: authenticating accounts, storing and finding memories, handling support, applying limits, preventing abuse, investigating faults, evaluating reliability, and planning capacity and service improvements from service logs and aggregated usage information, never from Memory content. We also administer requested subscriptions and protect our legal rights.
Where we decide how data is used, each purpose has its own legal basis under the GDPR:
- Where you are personally a party to our contract, providing the service you ask for — account creation, verification and sign-in, storing, organising and finding memories, shared Vaults, support and plan limits: Article 6(1)(b), performing that contract or taking steps at your request before entering into it.
- Managing Vault invitations and providing the service to people acting for an organisation that is our customer: Article 6(1)(f), our and our customers' legitimate interest in arranging and managing authorised access.
- Answering emails and contact-form messages: Article 6(1)(b) where they concern your account or steps you ask us to take before entering into a contract, otherwise Article 6(1)(f), our legitimate interest in answering enquiries.
- Keeping the service secure and reliable — abuse prevention, fault investigation, capacity planning and service improvement from logs and aggregated usage: Article 6(1)(f), our legitimate interest in a safe, working service.
- Analytics and product emails: Article 6(1)(a), your consent, which you can withdraw at any time.
- Meeting legal obligations, such as answering rights requests and keeping consent records: Article 6(1)(c).
- Establishing, exercising or defending legal claims: Article 6(1)(f).
For personal data about other people in content you store, you decide the legal basis and our data processing terms apply. Email is needed for an account and content to save a memory. The contact form needs your email address and a message so we can reply. Analytics and product-email subscriptions are optional.
Who we share with.
We use service providers for the purposes above, including:
- Hosting, database and backup providers — store and run the service and its data.
- Network delivery and abuse-prevention providers — process network requests and verification data, including the bot check that protects sign-in and our website's contact and waitlist forms.
- Sign-in providers — supply identity and verification information for the method you choose.
- Email providers — deliver emails, including contact-form messages, and handle recipient details, messages and subscriptions.
- Analytics providers — process the consented measurements described above.
We may appoint or replace providers within these categories, subject to required safeguards, notices and authorisations. Sign-in providers act as independent controllers under their own privacy policies. Abuse-prevention providers may also use security signals to improve their own threat detection. Account and service-use data may be disclosed to legal advisers, courts or authorities where necessary to comply with law or establish, exercise or defend legal claims; Memory content only where the law requires it.
Vault sharing. Owners see members' email addresses and permissions. People invited to a Vault see the owner's email address and the Vault's name before they accept. Members can read, create, edit or delete memories according to their permissions. Members also see which account created or last edited a memory, shown by its email address. Copies they export or keep locally are under their control.
Contact [email protected] for recipient information.
International transfers.
Our primary storage for account data and Memory content is in the EU. Some service providers process personal data outside the EU. Where the European Commission has found the recipient's country or framework adequate, these transfers rely on that adequacy decision; otherwise they rely on the Commission's Standard Contractual Clauses. Contact [email protected] for information about the relevant safeguards or how to obtain a copy.
How long we keep it.
The retention periods and criteria below apply to ordinary use. Where the law requires longer storage, we retain the relevant data for the required period. Account and service-use data necessary for a legal claim is retained until the applicable period for bringing that claim ends or, if a claim is brought, until it is finally resolved.
- Account and access records — account, plan, usage and API-key records, including revoked keys, remain until account deletion is completed. Vault records remain until deletion of their Vault or owning account is completed. Membership records remain until membership is removed or the relevant Vault or member account is deleted.
- Vault invitations — pending invitations become unusable after the validity period shown when they are sent or renewed. Invitation records are kept for up to eight days after sending or renewal, and are deleted earlier if accepted, declined or withdrawn, or when deletion of the Vault or the invitee's account is completed.
- Memory — live memories remain until you remove them or close their Vault or account. Replaced versions remain restorable for 30 days after replacement; trashed records remain restorable for 30 days after deletion. Expired history and trash become unavailable for recovery and are then deleted. Vault owners can permanently delete trash sooner in the dashboard. Deleting a Vault removes its memories, history and trash without that recovery window; closing your account does this for every Vault you own. Memories you added to Vaults owned by others stay under their owners' control. Creator and editor identifiers remain with the associated records and versions. Limited deletion records remain until their Vault is deleted.
- Request, error and diagnostic logs — deleted at the latest 91 days after they are recorded. Relevant information may be retained separately where required by law or necessary for a legal claim.
- Sign-in and abuse prevention — sign-in links, connect links and associated attempt records are deleted at the latest 24 hours after use or expiry. Rate-limit records are deleted at the latest 24 hours after their limit period ends.
- Recovery backups — used only to recover from failures. Personal data permanently deleted from the live service is removed from all recovery copies within 90 days.
- Waitlist and product emails — your waitlist entry is kept until you withdraw consent or the waitlist's purpose ends. Unsubscribe records are kept while we send product emails; consent records for the period in which a claim about them could be made.
- Emails, contact-form messages and Discord messages — emails and contact-form messages to us, including the IP address and time kept with a form message, are kept until your request is resolved; any further retention follows the legal-obligation and legal-claim criteria above. Messages you post or send in our Discord community stay on Discord until they are deleted; community posts are visible to its members, and Discord processes messages under its own privacy policy.
- Analytics — measurements linked to a browser are kept for up to three months; new activity does not extend this period. Anonymous aggregated reports may be kept longer.
Deleting an account does not itself erase retained logs, backups, waitlist entries or files on your device. Rights requests also cover remaining personal data, subject to applicable exceptions.
Your rights.
Subject to the conditions in the GDPR, you have rights to:
- Access your personal data and information about its use.
- Rectification of inaccurate or incomplete data.
- Erasure of personal data.
- Restriction of processing.
- Portability of eligible data in a machine-readable format.
- Withdraw consent without affecting earlier lawful processing.
- Automated-decision safeguards for solely automated decisions with legal or similarly significant effects, where applicable.
- Complain to a competent data protection supervisory authority.
Right to object. You can object at any time to direct marketing and, on grounds relating to your situation, to processing based on our legitimate interests.
Contact [email protected] to exercise your rights. Dashboard export covers current memories, retained trash and version history with full text for the Vaults you own; API export covers only current live records in the request's Vault. Expired trash and versions are excluded. Other personal-data requests are handled through the contact above.
You can move memories to trash through the API or dashboard, and restore retained records or versions. Vault owners can permanently delete trash in the dashboard, and you can close your account there. You can also permanently delete any Vault you own except your current default, together with its memories, history and trash; to delete the default, first make another Vault you own the default.
Changes to this policy.
We may update this policy as the service, our processing or the law changes. Where the law requires it, we provide information, notice or a request for consent before new processing. An update to this policy does not itself supply consent or remove your data-protection rights. We post changes on this page with a new effective date. We notify affected users of material changes by email or a prominent notice on the website or dashboard, with advance notice where required by law.
Contact us.
For any privacy-related question, data subject request, or to request a specific subprocessor list, write to [email protected].