Rabel API Privacy Notice

1. Scope

1.1 This Notice applies to personal data processed by Rabel through the Rabel API (the “Service”), which is in beta.

1.2 It does not apply to the rabellabs.com website, which has its own notice.

2. Data processed

2.1 Account data: the email address given at sign-up, whether or not it is confirmed, and the hash of the key issued to it. The key itself is not stored.

2.2 Use data: counts of use, in seconds for which a connection to the Service is open, per key and per day; free and paid use; the time of each request; promotional codes redeemed, with the time; and, for each refused request out of capacity, the key’s email address and the time.

2.3 Payment data: credit purchases are made on Stripe’s hosted payment page. Rabel receives from Stripe the amount, the time and a reference to the payment. Rabel does not receive or store card details.

2.4 Technical data: the IP address of each sign-up and sign-in request, recorded with the email address given and the time, used to apply limits on sign-ups.

2.5 Text: text sent to the Service by the user (“User Text”) is processed in memory by Rabel to produce the output returned to the user. Rabel does not keep it: Rabel does not write it to storage, log it, or use it to train or improve any model.

2.6 Output: the speculative output returned to the user, and the User Text returned with it, are not kept by Rabel.

2.7 Rabel does not process data for advertising, and uses no cookies on the API other than the one in Section 2.8.

2.8 Sign-in with Google: when the user signs up or signs in with Google, Rabel receives from Google LLC the email address of the user’s Google account and keeps it as the account’s email address (Section 2.1). Rabel keeps nothing else from the Google account and does not record the IP address of a sign-in with Google. The sign-in sets one cookie on the API, which ties Google’s answer to the browser that started the sign-in and expires after 10 minutes.

3. Purposes and legal basis

3.1 Account data: to create and confirm the account, issue the key and contact the user about the Service. Basis: performance of the agreement.

3.2 Use data and payment data: to apply limits, to draw down credit, to record purchases, to keep accounts of the business and to follow up where the Service is out of capacity. Basis: performance of the agreement; legal obligation for accounts.

3.3 Technical data: to protect the Service from abuse. Basis: legitimate interest.

3.4 User Text: to produce output requested by the user. Basis: performance of the agreement.

4. Recipients and transfers

4.1 Rabel does not sell personal data and does not share it for advertising.

4.2 Recipients are limited to: Stripe, Inc., for payments; providers of the email delivery used to send the confirmation link; and providers of the infrastructure on which the Service runs, as processors acting on Rabel’s instructions.

4.3 Rabel is established in the United States and data is processed there. Data may also be processed in other countries where its processors operate.

4.4 Data is disclosed where required by law.

5. Retention

5.1 User Text and output: not retained (Sections 2.5 and 2.6).

5.2 Account data: kept while the account is open and for 30 days after closure.

5.3 Use data and payment records: kept for the period required for accounts and tax records.

5.4 Technical data: kept for 30 days.

5.5 Data is deleted on request, except where Rabel must retain it by law.

6. Rights

6.1 A person may request access to, correction of, deletion of, or a copy of their personal data, and may object to or ask for restriction of its processing. A person in a jurisdiction with further rights (including California, and the European Economic Area and the United Kingdom) has those rights.

6.2 Requests are sent to the contact above. Rabel responds within the period required by law. A person may complain to their data protection authority.

6.3 Rabel does not sell or share personal data for targeted advertising, so no opt-out of those is needed.

7. Security

7.1 Keys are stored as hashes. Data is transmitted over encrypted connections. Access to stored data is limited to Rabel personnel who need it.

7.2 No system is completely secure. A breach affecting personal data is notified as the law requires.

8. Children

8.1 The Service is not intended for persons under 18. Rabel does not knowingly collect data from them and deletes it when found.

9. Changes

9.1 Changes are made by posting a revised Notice with a new effective date. Material changes are also sent to the account’s email address.

10. Contact

Rabel Labs Inc., privacy@rabellabs.com.