Privacy

Last updated 2026-10-11

This policy covers the Rindo cloud service at app.rindo.io, the website at rindo.io, our documentation, the emails we send and the support conversations we have with you. It does not govern a self-hosted instance of Rindo or the local operation of the open-source clients (see “Self-hosted instances” below). It is written to be read; if anything is unclear, write to privacy@rindo.io.

Who is responsible

Rindo is built and operated by the Rindo team, which is not yet incorporated. The company that takes over this policy will be named here when it exists. Until then the team is the party responsible for the data described below. Our data protection officer can be reached at privacy@rindo.io.

Our two roles

For your account, your visits to the website, our billing records, support conversations, security logs and the emails we send, we decide why and how personal data is used: we are the organisation responsible under Singapore’s Personal Data Protection Act (PDPA) and, where it applies, the controller under the GDPR or UK GDPR.

Content means what is inside a project: tasks, documents, comments, files, test cases, chat, skills and what agents write. A project Owner controls the product’s permissions; that role alone does not fix the legal roles. Where an organisation — including an individual acting in a business capacity — engages us to process personal data on its behalf under our written Terms, we act as its data intermediary under the PDPA and as its processor where the GDPR or UK GDPR applies, for that processing. For a project used in a personal capacity, and for everything we process for our own purposes, we carry the obligations of an organisation or controller ourselves. You can contact us about personal data in any project; where we process on another organisation’s behalf, we help you reach it and help it answer, and we do not make contacting the project Owner a condition of exercising your rights against us.

Paddle, our merchant of record, is a separate organisation and controller for what it collects at checkout (see “Payments”).

The website (rindo.io)

The site sets no cookies and runs no analytics or tracking scripts. It is served by Cloudflare, which keeps short-lived request logs (IP address, user agent, requested URL) to operate and protect the service. Rindo does not use those logs to identify visitors.

What we collect, and where it comes from

Account data — from you: username, display name, email address and when it was verified, your password stored only as a bcrypt hash (not in readable form), interface and content language, preferences, the Terms version you accepted and when, last-seen time, and any lock or closure.
Sign-in through a provider — from the provider: its name, its identifier for you, the email address it says is verified, and your name, used as your display name if you have not set one. We keep no token and no profile picture (see “Signing in with Google”).
Credentials you create — refresh tokens (hashed, valid 7 days), personal access tokens (hashed, with a last-used time), and grants to MCP clients you connect (hashed tokens and the scope you chose).
Content — from you, your project’s members and the agents you connect: projects, tasks, documents and every revision, comments, files, test cases, translations, chat threads, skills, reviews, and the embedding vectors we derive from some of it (see “Search”).
People you invite — the invitee’s email address and the invitation’s state.
Other people’s data in your projects — when a project connects a git repository: commit authors’ logins and names, an excerpt of each linked commit message, and the raw webhook payloads for 30 days.
Agent jobs — the job’s payload (the triggering comment and snapshots of the entities it names), its log output for 30 days, and the registration of the runner that took it.
Security and audit — an audit log of who did what to which entity, over which channel, with a request id; it holds no IP address. The security events shown on your account.
Technical data — your IP address and browser identification in the web server’s access log and in Cloudflare’s edge logs; your IP in short-lived rate-limit counters and in the log of failed provider sign-ins; the browser signals the Turnstile widget sends to Cloudflare on sign-up, sign-in and password reset.
Billing — from Paddle and the Service: your plan and its state, the seat count we report to Paddle, any scheduled cancellation date, and Paddle’s identifiers for your customer record, subscription and checkouts. Never card or bank details.
Support and email — what you write to support@, privacy@, security@ or hello@; when we email you we keep no copy and no per-message record beyond Amazon SES’s own delivery logs.

We run no analytics, behavioural tracking or advertising technology in the product or on the website. We do not ask for precise location, government identifiers or special categories of data; if you put such data in Content, you must have the authority and any legal basis the law requires.

Signing in with Google

If you sign in with Google, Rindo asks Google for the openid, email and profile scopes. Google then shares your Google account identifier, your email address (with whether it is verified), and your basic profile such as your name and picture, as permitted by your Google settings.

Rindo uses this data for one purpose: to sign you in and link the Google account to your Rindo account. Concretely, Rindo:

stores your Google account identifier and your email address, so that the same Google account reaches the same Rindo account next time, and your name as your display name if you have not set one;
checks that the email address is verified;
does not store your profile picture, and does not store any Google access or refresh token — the sign-in exchange is completed and discarded;
does not use Google user data for advertising, does not sell it, and does not use it to train machine-learning or AI models.

Rindo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can see and remove the link between your Google account and your Rindo account under Account → Linked sign-ins. Removing the link deletes the stored Google identifier.

Why we use personal data

Accepting the Terms acknowledges this policy; it is not blanket consent to every purpose. For Content we process on a customer’s behalf, that customer decides the purpose and we follow its instructions. For what we decide ourselves:

To provide the Service — accounts, projects, sync, search, agent jobs, the MCP endpoint. Basis: your use of the Service after notice of this policy (PDPA); performance of our contract with you (GDPR Art 6(1)(b)), or our legitimate interest in providing the service a customer asked for where you use it as that customer’s member.
To send transactional email — sign-up, sign-in and reset codes, invitation and reset links, email-change and closure codes, security notices, project invitations, the closure schedule. Basis: the same, with security notices under our legitimate interest in keeping accounts safe.
To keep the Service secure — rate limits, the Turnstile challenge, lock-outs, session revocation, the audit log, abuse handling. Basis: the PDPA’s legitimate-interests exception; legitimate interests under the GDPR.
To bill — pushing the seat count to Paddle, applying billing restrictions, honouring cancellations. Basis: contract.
To comply with the law — the records the law requires us to keep, valid legal requests, and incidents we must report. Basis: legal obligation.
To answer you — support, data requests, security reports. Basis: contract or legitimate interests, and legal obligation for statutory requests.
To keep the Service working — operational counts and error logs, never a tracking profile. Basis: legitimate interests.

We send no marketing (see “Marketing”). Where we rely on your consent, you can withdraw it by writing to privacy@rindo.io without closing your account; we explain what stops working before we act, and earlier processing stays lawful.

Search: the one model call

The Rindo server generates nothing with AI. Its only call to a language-model provider turns text into embedding vectors for search. For that we send the titles and text of tasks, documents (including pages made from uploaded files and promoted skills), test cases and their translations, and your search queries, to OpenAI’s embeddings API in the United States. The embedding pipeline does not send comments, chat threads or raw attachments; a file you turn into a page is a page. The vectors are stored with the Content they describe and deleted with it.

We do not use Content, prompts, search queries or agents’ output to train, fine-tune or improve any AI model, ours or anyone else’s. Under OpenAI’s API terms, what we send is not used to train OpenAI’s models and may be kept by OpenAI for up to 30 days for abuse monitoring. Model services you choose for your own agents are governed by their own terms; this policy does not promise that every provider you choose offers the same.

Agents and the services you connect

Agents you connect — through an MCP client such as Claude or ChatGPT, or through a runner you register — read and write only what the token you gave them allows, under your account. The model behind an agent is your choice and your agreement with that model’s provider: data an agent reads from Rindo goes where you have sent it. Managed runners, offered by arrangement, run each job in an isolated sandbox at E2B (FoundryLabs, Inc.) in the United States; the sandbox receives the job, a one-job credential and the environment you configured, which may include your model API credentials, and is terminated when the job ends. Disconnecting a service stops future access through that connection; it does not recall data the service already received.

Payments

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Paddle collects your name, email address, billing address, country, tax identifier if you give one, and your payment details on its checkout and in its customer portal, as a separate controller under Paddle’s privacy policy. We never see your card or bank details.

We send Paddle the items you are buying (the Team plan and the number of additional People) and a signed reference to your Rindo account. Paddle sends us the state of your subscription and the events that change it; it may also email you about a failed payment on its own behalf. We keep Paddle’s identifiers for your customer record, subscription and checkouts, the plan and its state, and any scheduled cancellation date; the seat count is computed when needed, not stored.

Who else sees data

Suppliers that process data on our behalf, for the purposes above and only the data each needs:

Cloudflare, Inc. — edge network and DDoS protection in front of rindo.io and app.rindo.io, and the Turnstile challenge on the sign-in, sign-up, code sign-in and password-reset forms. The widget sends Cloudflare technical signals about your browser and connection, including your IP address, normally shows no puzzle and sets no tracking cookie; Cloudflare processes those signals under its own privacy policy.
Amazon Web Services (Amazon SES), United States — delivers the emails we send. Your email address and the content of each message pass through it; we keep no copy of the message and no per-message record beyond Amazon SES’s own delivery logs.
Amazon Web Services (AWS), Singapore — the servers, database, file storage and backups on which the product runs.
OpenAI, United States — search embeddings, as described above.
E2B (FoundryLabs, Inc.), United States — managed-runner sandboxes, by arrangement only.

We post a change to this list here at least 30 days before a new supplier handles your data, except where a replacement is needed at once for security, in which case we post it as soon as we can.

Others:

Paddle — as described under “Payments”.
Services you connect — a git provider, an identity provider, an MCP client, your own runners and the model providers behind them — receive what the connection’s permissions allow, under their own terms.
People in your projects — members see your display name and username on what you do there. Owners and Admins of a project, and anyone else allowed to manage its members, see the email addresses of pending invitations; the member list shows usernames and display names, not email addresses.
Authorities and others when the law requires — to comply with a binding legal duty, to establish or defend legal claims, or to respond to a substantiated threat to people or the Service. We check the validity and scope of a request, disclose only what is justified, and tell affected customers where the law permits.
A successor — if the business is transferred, including to the company that incorporates it, personal data goes to the successor under this policy with notice to you, and your rights are unchanged.

We do not sell personal data and do not share it for advertising.

Where data goes

The product, its database, your files and our backups run on AWS in Singapore. Amazon SES, OpenAI and E2B process data in the United States, and Cloudflare across its global network. Personal data that leaves Singapore goes to those suppliers under their data-processing terms; once the successor company takes over, such transfers will be made under arrangements that give the data comparable protection, as the PDPA’s transfer-limitation obligation requires. If you are in the EEA, the UK, Japan or Korea and the law that applies to you requires a specific transfer mechanism or disclosure for your data, write to privacy@rindo.io for the arrangement that applies to you; we put the required terms in place before relying on them.

How long we keep data

Your account — while it is open, then a 14-day window after you close it during which signing in with your password or an emailed code (not single sign-on) reopens it. After that the closure process removes your email address and display name, replaces your password with one nobody can use, removes your sign-in links, and replaces your username with a placeholder; a keyed hash of your former username stays so nobody can take it. Teammates see “Deleted user” from the moment you ask to close. The account record, your memberships, your identifier on audit entries and on Content you contributed, the record of which Terms you accepted, and your preferences stay: they keep your teammates’ project history intact and let us prove what was agreed. The process does not remove mentions of you that other people typed into Content. An account lock or a legal hold can delay it. If you want more removed, ask us (see “Your rights”).
Content — until the project’s owner deletes it; revision history stays with its document. Deleted tasks, documents and test cases stay in the trash for 30 days before a background purge (a document still referenced by a Library pack version is kept). A deleted project has a 7-day window in which the operator can restore it, then it is purged.
Files nothing references any more — 30 days.
Export archives — 7 days; each download link 10 minutes.
Embedding vectors — with the Content they describe.
Audit log — entries about a project go when the project is purged, except instance-level entries about the project’s own lifecycle. Entries about your account stay while the account exists: credential revocations, locks, Terms acceptance, closure and billing changes stay for the life of the account; other entries are kept unless the operator sets an expiry.
Notifications — 90 days.
Agent job logs and git webhook payloads — 30 days.
Idempotency records — 7 days. Refresh tokens — valid 7 days. MCP client (OAuth) tokens — 30 days past their expiry.
Server logs and rate-limit counters — short-lived. Cloudflare’s edge logs follow Cloudflare’s retention.
Billing records — for as long as accounting, tax, refund and legal-claim rules require.
Backups — expire on a fixed schedule; deleted data stays in backups only until the backups holding it expire.

Beyond these periods we keep personal data only while a specific legal or business purpose requires it, for example an open dispute or a legal hold, and we review such holds.

How data is protected, and what happens if something goes wrong

All traffic is encrypted in transit. Passwords are stored as bcrypt hashes; authentication tokens are stored as hashes; secrets you give us for integrations are encrypted at rest with a key kept outside the database. Changing your password signs out every other session; closing your account ends every session, token and connected app. The product has no support impersonation and no “support read” of your Content; authorised access to infrastructure for operation, security or recovery is controlled and logged. Every administrative action is in the audit log. Security reports go to security@rindo.io.

If we have credible grounds to believe a personal-data breach has occurred, we assess it promptly. Where we are the responsible organisation under the PDPA, we notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after the day we determine that the breach is notifiable (significant harm, or 500 or more affected people), and we notify affected people where the breach is likely to cause them significant harm. Where we act as a data intermediary, we notify the organisation on whose behalf we process without undue delay, without waiting for the investigation to finish. Where the GDPR or UK GDPR applies, we follow its separate rules, including the 72-hour notice to the authority where we are the controller.

Your rights

Access and correction. Ask us for the personal data we hold about you and how we have used or disclosed it in the past year, or ask us to correct it. We respond as soon as we reasonably can; if we cannot respond within 30 days, we tell you within that time when we will. Where another law sets a different deadline, such as the GDPR’s one month, we follow it. Correction is free; self-service actions are free.
Export. Account → Export gives you your own data without asking us: your account’s rows, your security events, and the comments, revisions and uploads you authored. The archive lives 7 days.
Deletion. Close your account (Account → Close account): sessions and tokens end at once, you have 14 days to change your mind by signing in with your password or an emailed code, then the closure process described above runs. You may also ask privacy@rindo.io for erasure or for us to stop keeping data; we assess the law that applies, our role and any retention exception, and explain any limit. For Content processed on a customer organisation’s behalf, we assist that organisation with your request.
Withdraw consent. Where we rely on consent, write to privacy@rindo.io; closing your account is not required.
If the GDPR or UK GDPR applies to you, you may also have rights of erasure, restriction, portability and objection, including objection to processing based on legitimate interests, and you may complain to your supervisory authority or the UK Information Commissioner. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
If you are in Japan, Korea or Vietnam, you have the disclosure, correction, suspension and deletion rights the APPI, the PIPA and Vietnam’s Law on Personal Data Protection give you; use the same contact.

We use proportionate identity checks: a sign-in or a code to your account’s email for account holders; people without an account, invited people and former users can write to privacy@rindo.io for another method. You may complain to our data protection officer, or directly to the Personal Data Protection Commission (pdpc.gov.sg) or another competent authority; you do not have to complain to us first.

Cookies and browser storage

The website sets no cookies. The app uses only what signing in and working need:

rindo_refresh (httpOnly, SameSite=Lax, sent only to the sign-in paths) — keeps you signed in; 7 days.
rindo_sso_state, rindo_sso_link_state — protect a sign-in through a provider; 10 minutes.
rindo_oauth_flow — protects the connection of an MCP client; 10 minutes.
Browser storage under the rindo. prefix — your theme, language and layout, your recent documents, and locally saved drafts of tasks, documents and test cases so a closed tab loses nothing; drafts are cleared over time and at sign-out, the rest stays until you clear it. Local storage is not a backup.
Session storage — remembers that you skipped the “verify your email” prompt for this tab.

Each of these exists only to provide the function you asked for, so we show no cookie banner. You can clear them with your browser’s controls; doing so may sign you out or remove unsaved drafts.

Marketing

We send no marketing email and run no advertising. We send the transactional notices your account needs — codes, links and security events — and notices of material changes to the Service, the Terms or this policy; Paddle sends billing notices. None carries promotional material.

Children

Rindo is a workplace tool and is not directed at children under 16. We do not knowingly collect their data. If you believe a child has created an account or supplied data contrary to this, write to privacy@rindo.io and we will assess and act.

Self-hosted instances and the open-source clients

A self-hosted instance of Rindo is operated by the person or organisation that installed it, under that operator’s own privacy arrangements; this policy does not govern it. The three open-source clients (rindo-runner, rindo-convert, rindo-provisioner) run on your machines and send data only to the Rindo server you point them at and to the model or sandbox provider you configure. Data we receive from a self-hosted customer through sales, support or the website is covered by this policy.

Changes

This page carries the date it was last updated. For a material change we email account holders at least 30 days before it takes effect, where practicable, and announce it in the product. Before using personal data for a new purpose we give the required information and obtain fresh consent where the law requires it; a change to this notice cannot remove your statutory rights.

Contact

privacy@rindo.io (your data and this policy) · security@rindo.io (vulnerabilities) · support@rindo.io (the Service)