Privacy Policy

Last updated: August 4, 2026

This Privacy Policy explains how Rafta ("we", "us", or "our") collects, uses, stores, and protects information when you use the Rafta inventory management platform at rafta.ai.

1. Information We Collect

1.1 Account Information

When you register, we collect your name, email address, and organisation name. Passwords are stored as one-way hashes (bcrypt) and are never readable by us.

1.2 Customer Data

All inventory data you enter — items, locations, custom fields, attachments, and audit logs — is Customer Data. We process this data only to provide the Service. We do not analyse or mine Customer Data for our own purposes.

1.3 Usage and Technical Data

We collect server logs (IP address, browser/OS type, pages accessed, timestamps) for security and troubleshooting. These logs are retained for 30 days. We do not use third-party analytics trackers (e.g., Google Analytics).

1.4 Cookies

We use one first-party session cookie and one persistent login cookie for authentication. No advertising cookies or third-party tracking cookies are used.

2. How We Use Your Information

To authenticate you and maintain your session.
To deliver and improve the Service.
To send transactional emails (password resets, invitations, stock alerts) that you have triggered or opted into.
To investigate security incidents or abuse.
To comply with legal obligations.

We do not sell your information to third parties or use it for advertising.

3. Data Sharing

We share data only with the following categories of sub-processors, and only to the extent necessary:

Hosting provider (VPS/server): stores the application and database.
Backup storage (Backblaze B2): encrypted database backups.
Transactional email (Resend): sends system emails on our behalf. Your email address is shared only when an email is sent to you.
Error monitoring (Sentry): receives application error reports, which may contain anonymised stack traces. No Customer Data is intentionally sent to Sentry.

4. Data Retention

Active accounts: data is retained for as long as your account is active.
Deleted items: soft-deleted items are retained for 90 days to allow recovery, then permanently deleted.
Account termination: upon account cancellation, all Customer Data is deleted within 30 days of your request.
Backups: automated backups are retained for 30 days.

5. Security

We protect your data using TLS encryption for all data in transit, bcrypt password hashing, tenant-isolated database queries, role-based access controls, and regular automated backups. We maintain an application error log and monitor for anomalies.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate data.
Erasure: request deletion of your personal data ("right to be forgotten").
Portability: request your Customer Data in a machine-readable format (CSV export is available in-app).
Objection / Restriction: object to or request restriction of certain processing activities.
Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@rafta.ai. We will respond within 30 days.

7. Data Transfers

Our servers are located in the EU. Backup data stored in Backblaze B2 may be replicated across regions within Backblaze's infrastructure. Resend and Sentry may process data outside the EU; both maintain standard contractual clauses (SCCs) for GDPR compliance.

8. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email or in-app notice before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

Questions or data requests: privacy@rafta.ai