Privacy Policy

1. About this policy

This policy explains how Rabbitblaze (“we”, “us”) handles personal data when you visit rabbitblaze.com, sign up for or use the Rabbitblaze dashboard, or contact us. In these cases we decide why and how the data is used, so we’re the controller.

Businesses use Rabbitblaze to talk to their own customers, for example through the Messenger on their website, by email or in their Help Center. For that data we act as a processor on the business’s behalf, under our Data Processing Addendum. If you chatted with a company that uses Rabbitblaze, that company’s privacy policy explains how it uses your data, and you should contact it with any requests. We’ll help it respond.

2. Data we collect

Account and workspace data. Your name, email address, password (stored only as an Argon2 hash), profile picture, time zone and preferences, two-factor authentication settings, your role, and the workspaces and teams you belong to.

Billing data. Your plan, invoices and billing address, and the details our payment processors share with us, such as the card brand and its last four digits. Card numbers and PayPal credentials are handled by Stripe and PayPal; we never see or store them.

Usage and device data. When you use the dashboard, our servers log technical information such as your IP address, browser and device type, the pages and features you use, and security events like sign-ins and changes to sensitive settings. We use it to keep the Service secure, fix problems and understand which features are used.

Communications. What you send us by email, through the contact form on our website or in support conversations, and records of the service emails we send you.

Website visits. Our marketing website doesn’t use advertising or third-party analytics trackers. Our hosting and network providers keep standard server logs, including IP addresses, to deliver the site and protect it from abuse.

3. How we use it

We use personal data to:

• provide, maintain and secure the Service, including authenticating you and preventing fraud and abuse;
• process payments, send invoices and manage your subscription;
• send service messages, such as verification emails, security alerts, billing notices and notifications you’ve turned on;
• respond to questions and support requests;
• understand how the product is used, in aggregate, so we can improve it;
• comply with our legal obligations and enforce our terms.

We don’t sell personal data, we don’t share it for cross-context behavioral advertising, and we never use your data or your customers’ data to train AI models.

4. Legal bases

Where the GDPR or similar laws apply, we rely on:

• Contract: to provide the Service you signed up for and to bill for it;
• Legitimate interests: to keep the Service secure, prevent abuse, improve the product and respond to enquiries, balanced against your rights;
• Consent: where the law requires it, for example for optional emails, which you can withdraw at any time;
• Legal obligation: for tax, accounting and other records the law requires us to keep.

5. Cookies and local storage

The dashboard uses one essential session cookie, rb_sid, to keep you signed in. It is HttpOnly, sent only over HTTPS in production, and expires after 30 days without use. The dashboard also stores your interface preferences, such as the theme, in your browser.

Our marketing website doesn’t set cookies for tracking or advertising. Our developer docs remember the code language you pick in your browser’s local storage, and that never leaves your device.

The Messenger on our customers’ websites stores an anonymous visitor ID in the browser, so a visitor’s conversations survive page loads. We do this as a processor for the website owner.

6. Who we share data with

We share personal data only with service providers that help us run Rabbitblaze, under contracts that limit their use of it to providing services to us:

Provider	What they do for us	Location
Hetzner	Application servers and databases	Germany (EU)
Cloudflare	DNS, content delivery, network security and backup storage	Global network
Backblaze	File storage (attachments, images, exports)	United States
Resend	Sending and receiving email	United States
AI model provider	AI processing for Blaze and Copilot	United States
Stripe	Card payments and invoices	United States
PayPal	PayPal payments	United States

We may also share data when the law requires it, to protect the rights, safety and property of our users or the public, or as part of a merger, acquisition or sale of assets, in which case we’ll tell you before your data becomes subject to a different privacy policy.

7. International transfers

Our application servers and databases are in Germany (EU). Several of our providers are in the United States, and some process data in other countries. When we transfer personal data from the European Economic Area, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the equivalent UK and Swiss mechanisms, together with the safeguards described on our security page.

8. How long we keep it

• Account data: while your account is active. When you delete your account or workspace, we delete it from our live systems within 30 days and from backups within 90 days.
• Billing records: as long as tax and accounting laws require, usually up to seven years.
• Logs: security and server logs for up to 12 months, unless we need them longer to investigate abuse.
• Messages to us: for as long as needed to help you and keep a record of our conversation.

9. Security

We protect personal data with encryption in transit and at rest, strict access controls, two-factor authentication for teammates, audit logging and regular updates. Read more on our security page. No system is perfectly secure, so if you believe your account has been compromised, contact [email protected] right away.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data;
• export your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on it;
• not be discriminated against for exercising these rights.

Most account data can be viewed and changed in your profile settings. For anything else, email [email protected]. We’ll respond within 30 days and may need to verify your identity first. You also have the right to complain to your local data protection authority.

California residents. We don’t sell personal information or share it for cross-context behavioral advertising, and we don’t use sensitive personal information to infer characteristics about you.

11. Children

Rabbitblaze is a business tool and isn’t directed at children. We don’t knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we’ll delete it.

12. Changes to this policy

We’ll update this policy when our practices change. If a change is significant, we’ll tell workspace owners by email or in the dashboard before it takes effect. The date at the top shows when it was last updated.

13. Contact

Questions or requests about privacy: [email protected].