Privacy Policy

Account data. Your email address (we sign you in with a magic link, no password) and the name you give your workspace, plus the authentication records needed to sign you in.

Connected content. Documents, messages, and files from the sources you connect — for example your Notion pages, Slack channels, Google Drive files, Gmail or Outlook messages, or a code repository. We keep a searchable copy of the text and a link back to the original. We never change or delete the original.

We read connected sources via their APIs, store a derived, searchable copy (text chunks, embeddings, and a knowledge map) plus a pointer back to the original, and re-sync when the source changes.

Files you upload. The text of each file, its search data, and a title. The original file is not kept.

Content connected apps add. If you allow it, an app you connect over MCP can add documents: text it sends, or a web address ran fetches on your behalf. We store these the same way as files you upload, plus, for a fetched page, its address, and which connected app added it.

Settings you choose in ran. Which sources each connected app may see and whether it may add documents; and, if you add your own AI provider key, the key (stored encrypted) and whether ran may finish a job on its key if yours fails.

Usage and technical data. Standard server logs (IP address, browser type, timestamps) and product event records (for example, that a source was connected or a query was served) kept for security, audit, and reliability.

Waitlist signups. If you request early access on this site, we store the email address and company details you submit, and use them only to contact you about ran.

• To provide the product: keeping a derived copy of your connected sources current, answering questions with citations, and serving those answers to the assistants you connect over MCP.
• To secure and operate the service: authentication, audit trails, abuse prevention, debugging.
• To communicate with you about your account or early access.

We do not sell your data. We do not use your content to train AI models — ours or anyone else's. Content is processed for retrieval and inference only: our AI providers receive it when it is indexed and when you ask a question, under contracts that prohibit those providers from training on it.

If you connect Google Drive, Google Docs, Google Sheets, or Gmail, ran accesses that data only to provide user-facing features you request: reading the files and messages in the folders or labels you choose, and answering your questions about them with citations. ran does not send or edit content on your behalf.

ran's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide the features described above — never for advertising, never sold, and never used to train AI or machine-learning models.
• Humans do not read your Google data except with your explicit permission, when required for security or legal compliance, or when the data is aggregated and anonymised.
• Google user data is transferred to third parties only as necessary to provide these features (the subprocessors in §5), for security and compliance, or with your consent.

You can disconnect a Google source at any time in the app (Connections → choose the tool → Disconnect), which stops all access and deletes the derived copy for that source, and you can additionally revoke ran's access at myaccount.google.com/permissions.

The same principles govern every connector (Notion, Slack, Microsoft Outlook, and connectors provided through our integration platform): access is scoped to what you connect, used only for retrieval, and revocable at any time by disconnecting the source, which deletes its derived copy.

ran never sends, changes or deletes anything in your connected tools. If you allow it at consent, an app you connect over MCP can add documents to your ran memory; they land in Uploads, marked as added by a connected app.

We share data only with the service providers needed to run ran, each bound by contract to process it solely on our instructions:

OpenAI is used only if you add your own OpenAI key, under your agreement with OpenAI. With your own key, model inference runs under your provider agreement, unless you allow ran to finish a job on its own key when yours fails; that job then runs on ran's Anthropic account. Embeddings and reranking still go to Voyage AI.

This list matches the in-product Trust page and will be updated there and here before any new subprocessor receives customer data.

Derived copies exist only while their source stays connected: disconnecting a source deletes its documents, chunks, embeddings, map entries, and the access token ran holds for it. You can also revoke ran's access in the tool's own settings. Deleting your account deletes everything ran stored plus your sign-in, including your email; you can sign up again as a new user.

Operational records (records of connections and of queries served) are kept while your account exists and deleted when you delete it. Backups age out on our hosting providers' standard cycles, and waitlist data is deleted on request.

Access tokens for connected sources are encrypted at rest (AES-GCM) and never exposed to the browser. All traffic is encrypted in transit (TLS).

Your data is isolated to you with database-level row security. Report security issues to gabrielezerzer.zam@gmail.com.

Depending on where you live (including under GDPR and UK GDPR), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. Contact gabrielezerzer.zam@gmail.com and we will respond within the legally required window.

If you are unhappy with how we handle your personal data, you can complain to the Information Commissioner's Office, the UK data-protection regulator, at ico.org.uk.

ran is for adults using it for personal or work purposes: you must be 18 or over to use it, and we do not knowingly collect data from anyone under 18.

We will post any changes to this policy on this page and update the date above. Material changes affecting connected-source data will be announced to account holders before they take effect.