Privacy Policy
Last updated
1. What we collect
Account information (name, email), the documents you upload and the outputs generated from them, product usage events, and technical logs needed to run and secure the service.
2. How we use it
To provide the service: storing your documents, processing them with AI models to produce your reports, computing deadlines, and improving reliability. We do not sell personal information. We do not use your documents to train AI models without your explicit written consent.
3. Who processes it
We use the following processors under data processing agreements. Infrastructure and hosting: Supabase (database, authentication, and private file storage), Vercel (application hosting), and Upstash (short-lived cache and rate limiting). AI model processing: OpenAI (document analysis, the in-app assistant, and voice-note transcription). Requests to OpenAI are sent with storage disabled. Document text recognition: Reducto, for scanned pages only. A built-in fallback runs inside RATA. Email delivery: Resend. E-signature: DocuSign, when an agent uses it. Payments: Stripe. Property data and maps: Google (Maps, Places, and the Gmail integration when an agent connects it) and ATTOM Data. Error monitoring and analytics: Sentry, PostHog, and Langfuse (usage and error metadata only, never document text). Each processor receives only what it needs to perform its function.
4. Transaction documents are sensitive
Disclosure packages contain personal information about buyers, sellers, and properties. Access is restricted to your account through row-level security. Documents are retained while your account is active and deleted upon verified deletion requests, subject to legal holds.
5. Your California rights
California residents may request access, correction, deletion, and disclosure of categories of personal information collected, and will not be discriminated against for exercising these rights. Submit requests to privacy@getrata.ai. We respond within the timelines the CCPA requires.
6. Security
Encryption in transit and at rest, hardened authentication, row-level access controls, and least-privilege service credentials. No system is perfectly secure; report concerns to security@getrata.ai.
7. Changes and contact
We will notify you of material changes. Questions: privacy@getrata.ai.