Privacy
Policy

We collect information you provide directly to us:

• Contact Information: Name, email, company, role when you submit forms or contact us.
• Account Information: If you create an account, we store credentials and preferences.
• Usage Data: Aggregated, anonymized usage metrics (API calls, storage, search queries) for product improvement.
• Technical Data: IP address, browser type, OS, referrer for security and analytics.

We do not collect: Your Stash contents, memory data, embeddings, search queries, or any customer data processed by Recall Racoon. That data never touches our systems on Private/Enterprise deployments. On Cloud Managed, we process but do not retain, aggregate, or train on it.

• Respond to inquiries and provide support
• Send product updates, security advisories, changelog (opt-in only)
• Process transactions and manage subscriptions
• Improve our website and products (aggregated, anonymized)
• Comply with legal obligations
• Security monitoring and fraud prevention

On Cloud Managed deployments:

• We process your data to provide the service (ingestion, search, steward)
• We do NOT retain, aggregate, or train models on your data
• We have NO access to your Stash, queries, or embeddings
• This is enforced by architecture: tenant isolation, encryption keys you control, audit logs you own
• Data residency: US-East (default), EU-West (on request)

On Private VPC, On-Premise, and Air-Gapped deployments:

• We operate ZERO infrastructure that touches your data
• Control Plane and Data Plane run entirely in your environment
• We never see your Stash, queries, embeddings, or logs
• License validation occurs offline (signed license file, 30-day grace)
• No telemetry, no phone-home, no usage reporting to us

We use minimal cookies:

• Essential: Session management, CSRF protection, form state
• Analytics: Privacy-friendly (Plausible/self-hosted), no personal identifiers
• No: Third-party advertising cookies, cross-site tracking, fingerprinting

See our Cookie Policy for details.

We do not sell your personal information. We may share with:

• Service providers (email, hosting, analytics) under strict DPAs
• Legal authorities when required by law (we'll notify you unless prohibited)
• Acquirers in a merger/acquisition (with notice and consent where required)

We do NOT share with: advertisers, data brokers, AI training companies.

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent (for marketing)

To exercise rights: email privacy@recallracoon.com. We respond within 30 days.

• Contact form data: 3 years after last contact
• Account data: Until deletion + 90 days grace
• Marketing preferences: Until withdrawn
• Security logs: 1 year (anonymized after 90 days)
• Customer Stash data: Never retained by us (see sections 3 & 4)

We implement appropriate technical and organizational measures:

• TLS 1.3 for all data in transit
• AES-256 for data at rest
• Regular penetration testing and vulnerability scanning
• Incident response plan with 72-hour notification
• Employee training and access controls

We use Standard Contractual Clauses (SCCs) for any transfers outside your jurisdiction. For EU customers, we offer EU data residency on Cloud Managed (Business/Enterprise).

Our services are not directed to children under 16. We do not knowingly collect children's data. Contact us if you believe we have.

We'll notify you of material changes via email (if you have an account) or website banner 30 days before effective date. Continued use constitutes acceptance.

Questions about this policy or your data:

• Email: privacy@recallracoon.com
• Mail: Recall Racoon, [Address]
• DPO: dpo@recallracoon.com