Privacy Policy

Effective Date: March 2, 2026 · Last updated: September 29, 2026 (v3)

This Privacy Policy explains how we collect, use, and protect your information when you use https://rakaai.com.

1. Information We Collect

We may collect:

• Name and profile picture (via Meta Login)
• Email address
• Facebook Page ID and metadata
• Instagram Business Account ID
• Access tokens required for publishing and for reading comments and messages
• Comments and direct messages that customers send to your connected social accounts (Instagram, Facebook Page, Messenger, YouTube)
• Google user data when you connect Google services — see section 4b for the exact list
• Shopify store data when you install the Raka AI app on Shopify — see section 4e
• User-generated content
• Analytics and usage data
• Advertising measurement cookies (Meta Pixel on rakaai.com) — set only after you accept cookies; you can decline at any time
• Device and browser information

We do NOT collect social media passwords.

2. Legal Basis for Processing (GDPR)

For EU users, we process data based on:

• Contract performance
• Legitimate interest
• User consent
• Legal compliance

3. How We Use Information

We use data to:

• Authenticate users
• Retrieve managed Pages
• Publish and schedule content
• Display engagement metrics
• Show you comments and messages from your connected accounts and send the replies you write or approve
• Show which posts and channels bring visits to your website (Google Analytics)
• Provide customer support
• Improve platform performance

4. Data Sharing

We do not sell personal data.

We may share data with:

• Meta Platforms, Inc.
• AI service providers — see section 4.1 for the full list and what exactly is shared
• Hosting providers
• Analytics providers
• Payment processors

4.1. Third-Party AI Providers

Raka AI generates content (captions, images, videos, marketing plans, chat answers) using third-party artificial intelligence services. When you use an AI feature, the following data is transmitted to one or more of these providers, solely for the purpose of generating the content you requested:

• Text you enter: prompts, product names and descriptions, captions, chat and support messages
• Photos and videos you upload for generation, analysis or editing
• Your brand settings: brand name, tone of voice, target audience, call-to-action style
• Product information from your connected store or product feed (titles, descriptions, images, prices)

The AI providers we use are:

• Google LLC (Gemini models) — text and image generation, content analysis
• OpenAI, L.L.C. (GPT models) — caption and text generation
• Anthropic, PBC (Claude models) — text generation and assistants
• Features and Labels Inc. (fal.ai) — image and video generation models

Important limits on this sharing:

• Data is sent only when you actively use an AI feature — never in the background
• In the mobile app, no data is sent to AI providers until you explicitly agree to AI data processing; you can give or withdraw this consent at any time in More → Privacy & AI
• We do not send your password, payment details, or social media access tokens to AI providers
• These providers process the data as our processors to fulfil your request; we use API terms under which the data is not used to train their public models
• We never sell your personal data

4a. Sign in with Google and Apple

If you sign in with Google or Apple, we receive your name and email address from the provider to create or match your account. We never see your Google or Apple password. Apple users may use "Hide My Email"; the relay address then serves as your account email.

4b. Google user data: YouTube, Google Analytics, Google Drive

When you connect a Google service, Raka AI asks for specific permissions (OAuth scopes) and receives only the data listed below. Raka AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

• YouTube channel (youtube.readonly, youtube.upload): your channel id, title and picture, the list of your own videos and their public statistics, and the ability to upload the videos you create in Raka AI to your own channel.
• YouTube comments (youtube.force-ssl): comments that people leave under your own videos and Shorts, shown in your Raka Chat inbox together with Instagram and Facebook, and the replies you write or approve, posted under those comments on your behalf. We never like, hide, moderate or delete comments and never act on other channels.
• Google Analytics (analytics.readonly): the list of your GA4 properties so you can pick one, and aggregated, read-only metrics of that property (sessions, conversions, traffic sources) to show which social posts bring visits to your website. We do not access user-level or personal Analytics data.
• Google Drive (drive.file): the ability to create a Google Sheet for exporting your own leads and to update only that file. We cannot see any other file in your Drive.
• Sign in with Google: your name, email address and profile picture, to create or match your Raka AI account.

How Google user data is used, stored and shared

• It is used only to provide the features you switched on: publishing to your channel, answering your comments, showing your website analytics and exporting your leads. It is never used for advertising, never sold, never used to train AI models, and never shared with other businesses.
• Access tokens are stored encrypted in our database (Supabase, EU region) and are used only by Raka AI's own servers to call Google APIs on your behalf. Comments and their replies are stored so that you can see the conversation in your inbox; aggregated Analytics metrics are cached for reporting.
• Google user data is not transferred to other apps and is not shared with third parties, except the hosting and database providers that run our service under data-processing agreements. The text of a comment is sent to our AI providers (section 4.1) only when you ask Raka AI to draft a reply.
• Only you and the team members you invite to your workspace can see this data.

Retention, deletion and revoking access

• When you disconnect a Google service in Channels, its tokens are deleted immediately and we stop accessing that data.
• Stored comments, replies and analytics for that service are deleted within 30 days of disconnecting, or immediately on request to support@rakaai.com; deleting your account deletes everything.
• You can also revoke Raka AI's access at any time in your Google security settings.

Connecting a YouTube channel uses YouTube API Services. By connecting, you agree to the YouTube Terms of Service; Google's handling of data is described in the Google Privacy Policy.

4c. Mobile Applications

• Camera, microphone and photo library are used only when you shoot or pick product photos and videos for content creation; nothing is accessed in the background.
• Biometric app lock (Face ID / fingerprint) is optional and processed entirely on your device by the operating system; we never receive biometric data.
• Session tokens on mobile are stored in the operating system's secure keychain.

4d. Payments

Website payments are processed by Stripe; Shopify app charges are billed by Shopify. We never receive or store full card numbers. Billing records are retained as required by Czech accounting law.

4e. Shopify stores and their customers

When a merchant installs the Raka AI app on Shopify, the merchant is the data controller for their customers' data and Raka AI acts as their data processor under our Data Processing Addendum.

• Store data we copy: products, collections, prices, stock levels and discounts — to create and publish posts about them. Shop contact details (shop name, shop email, owner name) are used for the account and billing.
• Customer data we read but do not store: when a customer asks Raka Chat or the voice agent about an order, we read that one order from Shopify at that moment (order number, payment and fulfilment status, carrier, tracking number and link) and check that the person asking is the buyer by comparing the email or phone number they give with the order. Customer name, email and phone are used only for that check and are not copied into our database.
• Marketing messages. If a merchant turns on marketing messages (for example a reminder about an abandoned cart or a request for a review), they are sent only to customers whose Shopify marketing consent is "subscribed".
• We never sell Shopify merchant or customer data, never use it to train AI models and never use it for anyone other than the merchant who installed the app.
• Deletion requests from Shopify are carried out automatically: a customer data-erasure request deletes that customer's Raka Chat conversations and call transcripts in the merchant's account; a shop data-erasure request (sent 48 hours after the app is uninstalled) deletes the store connection, its access token and all copied store data. A customer data request is answered to the merchant within 30 days.

5. International Transfers

Data may be processed outside the EU. We implement appropriate safeguards such as Standard Contractual Clauses where required.

6. Data Retention

We retain data only while it is needed for the Service or required by law:

• Account, content and connected-platform data — while your account is active; deleted when you delete the account.
• Access tokens — deleted immediately when you disconnect a platform or uninstall the Shopify app; the remaining Shopify store data is deleted when Shopify sends its shop data-erasure request, 48 hours after uninstalling.
• Shopify order and customer data — not stored; read from Shopify only at the moment a customer asks about an order.
• Voice-call transcripts — deleted automatically after 90 days by default (you can choose 1–365 days); call metadata used for billing is kept with billing records.
• Raka Chat conversations — kept while your account is active so that you can see the history; you can delete a conversation at any time, and conversations of a customer are deleted when a data-erasure request for that customer is received.
• Server logs — kept by our hosting provider for a limited period (days to weeks) and then deleted.
• Database backups — encrypted, kept by our hosting provider for 7 days and then overwritten.
• Billing and tax records — 10 years, as required by Czech accounting and tax law.

7. User Rights

EU users may:

• Request access
• Request correction
• Request deletion
• Object to processing
• Request data portability

California residents may:

• Request disclosure of collected data
• Request deletion
• Opt out of sale (we do not sell data)

To exercise rights: support@rakaai.com. You also have the right to lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (uoou.gov.cz).

8. Security and data protection

We protect all personal data, and in particular sensitive data received from Google, Meta and other connected platforms (access tokens, comments, messages, analytics), with the following technical and organisational measures:

• Encryption in transit. All traffic between your browser, our servers and third-party APIs uses TLS (HTTPS). Plain HTTP is not accepted.
• Encryption at rest. Our database and file storage (Supabase, hosted on AWS in the European Union) encrypt all stored data at rest with AES-256, including OAuth tokens, comments, messages and uploaded media.
• Token handling. OAuth access and refresh tokens for Google, Meta and other platforms are stored in our database, are used only by our own server-side functions to call the platform APIs on your behalf, are never written to logs, and are never shared with third parties. Tokens are deleted immediately when you disconnect the platform or delete your account.
• Access control and isolation. Every record is tied to your account and workspace; database row-level security ensures that a user can only read their own data. Server functions run with least-privilege credentials kept in the hosting provider’s secret store. Production access is limited to the operator’s authorised staff with individual accounts; there is no shared administrator login.
• Logging and monitoring. Requests to platform APIs are logged with request identifiers and error categories, without tokens or message contents, so that we can detect abuse and diagnose failures. Changes to advertising campaigns are recorded in an audit log (who, what, when).
• Minimisation and retention. We request only the permissions needed for the features you enable, read only your own assets, and keep data only while your account is active. Disconnecting a platform deletes its tokens at once and the related stored data within 30 days; account deletion removes everything.
• Sub-processors. Hosting and database (Supabase, EU), web hosting (Vercel), payments (Stripe), email (Resend) and the AI providers listed in section 4.1 process data under data-processing agreements and the EU Standard Contractual Clauses where applicable.
• Backups and resilience. The database is backed up automatically by the provider; backups are encrypted and retained for a limited period, then deleted.
• Incident response. If we become aware of a personal-data breach, we assess it without undue delay and notify the affected users and, where required, the supervisory authority within 72 hours as required by the GDPR.
• Secure development. Code changes go through automated checks before deployment; dependencies are kept up to date; secrets are never committed to source code.

You can revoke our access to your Google data at any time in your Google security settings and to Meta data in your Facebook and Instagram settings; the Service also lets you disconnect any platform in Channels.

9. Data Deletion

Instructions available at: https://rakaai.com/data-deletion

10. Children's Privacy

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us at support@rakaai.com and we will delete it.

11. Push Notifications and App Diagnostics

If you enable notifications in our mobile app, a push token is stored with your profile and used only to deliver notifications through Apple Push Notification service or Google's push service; you can disable them at any time in the app or device settings. We also collect application logs and usage diagnostics (features used, errors, performance) to keep the Service reliable and improve it.

11a. Text Messages (SMS) for Bookings

Businesses that use Raka AI can send their customers text messages about a booking: a confirmation, reminders and notices when the booking is moved or cancelled. A customer receives these messages only after entering their phone number when booking on the business's booking page, in a chat or on a phone call, and only about that booking. The messages are sent on behalf of the business named at the start of each message. Message frequency depends on the booking, usually two to four messages per booking. Message and data rates may apply.

Reply STOP to any message to stop receiving text messages, or HELP for help; you can also write to support@rakaai.com. Mobile phone numbers and SMS consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. Phone numbers are passed only to the carriers that deliver the messages (Twilio, BulkGate) and are kept for as long as the business keeps the booking history.

12. Disclosures Required by Law; Business Transfers

We may preserve or disclose personal information where required by applicable law, regulation, legal process or enforceable governmental request, or where necessary to prevent fraud, enforce our agreements, or protect the safety of our users.

We do not intend to sell the business; in the unlikely event of a merger, acquisition or sale, the acquiring entity will be bound to honour the commitments of this Privacy Policy, and you will be notified by email or a prominent notice of any change in ownership or in the use of your personal data, together with any choices you have.

13. External Links and Social Platforms

Our website and blog may link to external sites, and connected social platforms operate under their own privacy policies. Information you submit to third parties is governed by their policies — review them before sharing personal information.

14. Do Not Track

Some browsers send "Do Not Track" signals. As there is currently no accepted standard for responding to them, we do not act on DNT signals; we will follow a standard if one emerges.

15. Changes to this Privacy Policy

We may update this Privacy Policy. For material changes that affect your rights we will give at least 14 days' notice by email or a notice in the Service before the changes take effect; the "Last updated" date at the top always reflects the current version. Continued use after the effective date constitutes acceptance of the updated policy.

16. Contact

support@rakaai.com