Privacy Notice.

Who this notice covers

Rcall operates Rcall, a service for intentionally saved memories and project context that you can retrieve through connected assistants. This notice explains our handling of personal information in that service. Our privacy contact is hello@rcall.app.

Rcall does not automatically copy your entire chat history. The connected assistant sends the information included in its authorized tool requests. Review what you ask it to save and what appears in your workspace.

Information we handle

• Account details: your email address, display name, account identifier, and authentication/session information. Supabase handles password authentication. Rcall does not retain your password for prefill.
• Saved content: memories, project names and descriptions, associated project data (including previously saved content), titles, source labels, timestamps, versions and identifiers. These can contain personal information you choose to provide.
• Permissions and acceptance: assistant connections, granted scopes, authorization/revocation records, and versioned terms/privacy and adult-eligibility declarations. Current signup does not collect your country of residence. Any country declared under a previous version remains part of that historical acceptance record; it is not inferred for new agreements.
• Operations and support: bounded usage counts, request/error references, and correspondence you send to support. In-app requests include your chosen category, subject, message, account link, timestamps and handling status. Authorized operators can see that request and your verified contact address, not unrelated saved content. Hosting, authentication and email providers may also process network details such as IP addresses and delivery logs.

Please do not save secrets, government identification, payment-card information, or sensitive health information. Keep unnecessary personal information about other people out of saved content and support messages.

Why we use it

We use this information to authenticate you, store and retrieve what you save, enforce account limits and permissions, deliver confirmation and recovery emails, provide exports and deletion, investigate problems, prevent abuse, and respond to support or legal requests.

This release has no advertising or marketing-subscription feature. Signing up is not an opt-in to promotional emails. Rcall does not operate a model-training feature; how an assistant provider handles material in its own service is governed by that provider's policies, not by this notice.

Service providers and assistants

Supabase

Database storage, account authentication and associated security operations.

Vercel

Website/API hosting and request processing.

Resend

Delivery of transactional email configured through Supabase, including your recipient address and the message. When support notifications are configured, an operator notification contains a request reference and an authenticated inbox link, not the submitted message body. Saving a request is separate from email delivery.

Claude and ChatGPT

When you authorize a host, its requests and responses can contain saved information allowed by the granted scopes. Each host has its own policies, settings, and account requirements.

Stripe, if an account already has a billing link

Existing billing lifecycle information may be handled by Stripe. Early access does not offer new paid checkout or collect a payment card.

We may disclose information when legally required or necessary to investigate abuse or protect rights and security, subject to applicable law. The owner dashboard exposes aggregate operations rather than a browser of customers' private content; restricted infrastructure access can still be needed to operate or troubleshoot the service.

Processing across borders

International registration is not a promise of local data residency. Our providers and the assistants you choose may process information outside your province, state, or country, where different laws and lawful-access rules apply.

We do not advertise Canadian-only storage or a particular regional compliance certification. Contact our privacy address before using Rcall if you have a residency requirement or need more information about the service providers.

Cookies and browser storage

The website uses necessary session and authentication cookies, short-lived confirmation state and an email-only sign-in hint. These support sign-in, confirmation and safe return destinations. Your password is not stored in a cookie or browser storage for autofill.

Demo and design-preview edits are sample state, not account data. A password manager belongs to your browser or its provider. This release does not add advertising trackers or a separate marketing cookie-consent preference.

Retention and deletion

Saved information remains in your account until you delete it or the account is removed. Some operational records, such as retry receipts and audit events, are retained for service integrity until maintenance or account deletion. Memory retry receipts do not contain memory bodies; record/project deletion replaces retained receipt content with deletion markers.

Successful account deletion removes account-linked application data from the live database through the application's deletion process. A failed deletion is not reported as success; you may need to retry or contact support. Billing-linked and verified-MFA accounts require assisted handling.

In-app support requests remain available in your account history when marked closed; closing is not deletion. Account deletion also removes these account-linked requests and their notification records from the live application. Separate email correspondence and provider delivery logs follow their own retention handling; contact us about a request that needs earlier removal.

Backup copies, provider security/delivery logs, and legally required records have separate retention. They are not necessarily erased at the moment you delete live data. Rcall does not promise immediate deletion from every backup or provider system. Information copied to an AI host, downloaded, or shared outside Rcall must be addressed with the holder of that copy.

Read the export, revocation and deletion steps. Keep a separate copy of important information; account export is not a verified backup-restore service.

Your choices and privacy requests

You can review, correct, export or delete saved data in the website, and revoke each assistant's access. To ask about access, correction, deletion, consent withdrawal or another privacy right, email hello@rcall.app.

Available rights, exceptions and response deadlines depend on the law that applies to you. We may need to verify your authority before acting; never email your password, access token, or complete sensitive records. Withdrawing a connection stops future authorized access but does not retract earlier disclosures. You may also contact the relevant privacy regulator where applicable.

Security, age and updates

We use account-scoped access controls and explicit connection permissions, but no online system can guarantee absolute security. If an incident affects personal information, we will assess applicable reporting and notification obligations. Report a suspected issue privately through our security contact instructions.

Rcall is for adults at least 18 and of the age of majority where they live, not a service directed to children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

This notice is versioned. Material changes will be explained through the service, and additional consent will be requested when required. Acknowledging that you have read a notice is not a blanket waiver of privacy rights.