Privacy Policy

• Account information: name, email address, account identifiers, and authentication information, including information supplied through GitHub.
• Billing information for paid plans: plan, subscription and payment status, invoices, and the card brand, last four digits, and expiry date that Stripe shares with us. Stripe collects full payment card details directly; we do not receive or store full card numbers.
• Technical and usage information: IP address, browser and device information, service activity, diagnostics, and session recordings.
• Customer Content: applications, source code, builds, test inputs and outputs, logs, and other materials processed through the Services.
• Communications: support requests, messages, and attachments you provide.

We collect information when you register, use the Services, submit content, contact us, or authorize an integration, and automatically through logs, cookies, and similar technologies. Customers may supply information about authorized users and others.

We use information to provide and administer the Services, authenticate users, maintain security, troubleshoot, respond to requests, and comply with law. Customer Content is used only for requested Services and troubleshooting, subject to legally required disclosures described below, and never for advertising, model training, general product development, or unrelated purposes. We do not sell personal information.

Where required by applicable law, we may disclose your information to law enforcement in response to a valid subpoena, court order, or other binding legal process. We will notify you of such disclosure unless legally prohibited from doing so.

Where required, our legal bases are contractual necessity for requested Services, legitimate interests in administration, security and support where permitted, legal obligations, and required consent. Our Data Processing Agreement ("DPA") governs personal data processed in Customer Content on a customer's instructions; that customer is responsible for its notices and lawful instructions.

PostHog provides analytics and automatic session replay, including the emulator display. Account users may disable future browser product analytics and replay from PostHog and Google in Settings → Account. The choice applies across signed-in browsers when they refresh their account preference (within 30 seconds while open, or on focus). Operational service logs are not covered. If your browser sends Do Not Track or Global Privacy Control, we turn off PostHog and Google on ramus.dev entirely. Your preference does not control another participant's capture. Sensitive Data is prohibited.

We use hosting, storage, authentication, analytics, payment, and support providers. Stripe processes payments for paid plans and may act as merchant of record for them, handling payment and tax information under its own privacy policy. OpenAI and Anthropic may receive relevant support material for troubleshooting through Ramus-dedicated accounts, with model-training use disabled through available controls. Our Subprocessor List identifies providers and their functions.

We disclose information to authorized recipients, including shared-session participants, integrations, app backends, and agents; to necessary confidential advisers; or in a confidential business transaction. Successors remain subject to existing use restrictions. Independent services have their own privacy practices.

We use reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and loss. Administrative access to customer information and sensitive logs is limited to authorized founders who require access to provide, secure, or troubleshoot the Services. We periodically review our security safeguards and address material security vulnerabilities promptly, taking account of their severity, risk, and available remediation. No system guarantees absolute security.

Ramus uses U.S.-hosted infrastructure and appropriate safeguards; providers may process information elsewhere. Transfers require an applicable adequacy decision, contractual safeguards, or another lawful mechanism where legally required. Contact us for safeguard information.

• APKs are retained until user deletion or account closure. Build logs are retained for 30 days; session replay is configured for 30-day retention.
• Temporary device and build environments are discarded at session or build completion. Closing a browser tab does not necessarily end a session.
• Your dashboard keeps a small, low-resolution picture of each session's screen, visible only to you. It is never taken while a camera is live on the session, and it is deleted 7 days after the session ends.
• Other account, support, security, and analytics records are retained as needed for the stated purposes, subject to closure deletion. Replay retention does not cover every analytics record.
• Billing and invoice records are retained as long as tax, accounting, and other legal obligations require, which may extend beyond account closure.

Within 30 days after account closure, we delete associated Ramus-controlled information, copies, and backups, except required legal preservation, and take deletion action in provider accounts, including AI conversations and files. Residual provider copies may remain under applicable terms or law, subject to stricter DPA or mandatory duties. Independent recipient copies are not deleted by Ramus.

You must not upload, enter, display, or otherwise store Sensitive Data through the Services. "Sensitive Data" means information revealing racial or ethnic origin, political or religious beliefs, trade-union membership, health, genetic information, biometric identification, sex life or sexual orientation; government identification numbers; payment-card authentication data; or production passwords and secret keys. Limited test or integration credentials expressly required by a supported feature are excluded from the credential restriction.

We promptly remove detected prohibited Sensitive Data from active systems and delete it under the deletion provisions above, except required legal preservation. We do not guarantee detection; applicable data-protection duties remain.

We use cookies and similar technologies for authentication, functionality, and analytics. Browser controls may restrict storage and affect functionality. If your browser sends Do Not Track or Global Privacy Control, we turn off PostHog and Google on ramus.dev entirely.

We process personal information only for the purposes described in this Policy. To request deletion of information we already hold, or to restrict or object to further processing, contact us as described below. Such requests are subject to applicable law and do not prevent processing required by law.

Depending on applicable law and the circumstances of the processing, you may have the following rights:

• Right to access: Request confirmation of whether we process your personal information and obtain a copy of that information.
• Right to rectification: Request correction of inaccurate personal information and completion of incomplete information.
• Right to erasure: Request deletion of your personal information in certain circumstances, subject to applicable retention requirements and legal exceptions.
• Right to restrict processing: Request that we limit the processing of your personal information in certain circumstances.
• Right to object to processing: Object to processing based on our legitimate interests, or on other grounds provided by applicable law.
• Right to data portability: Receive personal information you provided to us in a structured, commonly used, machine-readable format and request its transfer to another organization where the right applies and direct transfer is technically feasible.

To exercise these rights, contact legal@ramus.dev. We may request information reasonably necessary to verify your identity or authority. Where we process information on behalf of a customer, we will coordinate with that customer as required by law and our DPA.

We respond without undue delay and within the period required by applicable law. Where the EU or UK GDPR applies, the response period is generally one calendar month, subject to legally permitted adjustments. Where necessary because of the complexity or number of requests, we may extend that period by up to two further months, with notice and an explanation within the initial response period.

Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may appeal a refusal where applicable law provides that right by contacting legal@ramus.dev, and may complain to a competent data-protection authority. We will not unlawfully discriminate against you for exercising your rights.

Users must be 18 or older. Customers need lawful authority for information about others, including children. Material changes are notified by email and in-product notice, with 30 days' advance notice where practicable, except urgent legal or security changes. Required additional consent will be obtained; updates do not themselves authorize incompatible reuse.