Privacy Policy

PRIVACY POLICY

Last Updated: April 21, 2026

Introduction

RamAIn, Inc. ("RamAIn," "we," "us," "our") is committed to protecting your privacy and being transparent about how we handle information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in connection with the RamAIn AI application, our website (RamAIn.ai), and any related services (collectively, the "Service").

RamAIn is built on a local-first architecture. This means most of the information the Service processes stays on your device and is never uploaded to our servers. Where cloud features are used, they are activated only by your deliberate action, and we apply strict technical and contractual controls to minimise data exposure.

This Policy should be read together with our Terms of Service and Acceptable Use Policy. By accessing or using the Service, you acknowledge that your information will be handled as described here.

1. Key Concepts

1.1 Local Processing and Storage

"Local Processing" means that the RamAIn application performs all data capture (including screen reading and optical character recognition ("OCR")), AI draft generation, and suggested actions directly on your device. "Local Storage" means that all captured inputs -- including raw screen images, extracted text, and interaction logs -- as well as AI-generated outputs, user preferences, and contextual data, are stored exclusively on your device. RamAIn does not transmit or store such data on its own servers unless expressly required for maintenance, diagnostics, or legal compliance as described in this Policy.

1.2 Transient Cloud Processing

Certain features may use "Transient Cloud Processing." This occurs when you intentionally activate a function (typically by pressing a hotkey) that requires inference through third-party AI infrastructure (such as AWS or Google Cloud). In these cases, only the limited snippets of input data necessary to generate a real-time response are transmitted securely to those subprocessors. Such data is processed solely in volatile memory, used only to complete your request, and is not stored by RamAIn or its subprocessors as User Content or otherwise retained after processing is complete.

1.3 Local-First Design Principle

This bifurcated model -- local processing as the default, with Transient Cloud Processing activated only by your deliberate action -- is fundamental to RamAIn's design and distinguishes the Service from cloud-first products that permanently store or index user content on central servers. RamAIn enforces this principle through both its technical architecture and contractual zero-data-retention obligations imposed on its subprocessors.

2. Information We Collect

The information we process depends on how you use the Service and the settings you choose. Because RamAIn is local-first, most information processed by the Service remains on your device. This section describes: (a) information we collect directly; and (b) information the Service processes locally or transmits for Transient Cloud Processing when you activate cloud inference features.

2.1 Information You Provide to Us

We may collect the following when you interact with us or create an account:

• Account information: your name, email address, authentication credentials, and sign-in tokens (including tokens from an SSO provider such as Google or Apple, if you choose to use SSO).

• Payment and subscription information: subscription status, billing address, transaction history, and payment method tokens provided by our payment processor. We do not store full payment card numbers.

• Communications: information you include in support tickets, emails, or other direct communications with us.

2.2 User Content Processed on Your Device

The Service may process content that you permit the application to access in order to perform tasks. This includes screen content, OCR text, AI-generated drafts, and other information visible on your device (together, "User Content"). Consistent with RamAIn's local-first design, User Content is processed and stored locally on your device by default and is not uploaded to RamAIn's servers as content stored at rest. User Content may incidentally include content from third-party applications visible on your screen (for example, messages, emails, or documents), but only to the extent such content is visible and you have initiated the workflow.

2.3 Transient Cloud Processing -- Zero-Data-Retention

If you enable a feature requiring cloud inference, the Service may transmit limited snippets of User Content to cloud inference providers solely to fulfil your request. We do not upload your full screen history, and we do not store that transmitted content on RamAIn servers as content at rest. We configure and contractually require our cloud inference subprocessors to process such content only to generate the response and not to retain it, use it to train general models, or share it with third parties. This zero-data-retention approach applies to all Transient Cloud Processing. Note that your device and third-party services may have their own storage, logging, or retention practices that RamAIn does not control.

2.4 Inferred Intent and Personalisation

"Inferred Intent" refers to functional inferences derived from your commands and immediate context, such as interpreting which recipient you mean or adapting drafting style to your preferences. Inferred Intent is used solely to deliver the Service to you, remains local to your device, and does not result in automated decisions with legal or similarly significant effects. We do not use your User Content to train a general model for other users.

2.5 Non-User Data (Third-Party Information on Screen)

Because RamAIn processes what appears on your screen, User Content may incidentally include information about third parties (for example, contact details, email threads, or content visible in your workspace). We refer to this as "Non-User Data." RamAIn processes Non-User Data only as necessary to perform the task you request. We do not identify, profile, or market to such third parties. Where Non-User Data is included in a cloud inference request, it is subject to the same controls in Section 2.3.

2.6 Operational and Diagnostic Data

We may collect limited operational and diagnostic data to keep the Service stable and secure. This may include crash logs, performance metrics, and device or application diagnostics. We design telemetry to be proportionate and focused on what we need to operate the Service responsibly. We do not collect screen content through telemetry.

3. How We Use Your Information

The table below sets out our processing purposes, the legal bases we rely on under GDPR, the equivalent lawful purposes under India's DPDPA, and the applicable California categories under CCPA/CPRA.

Purpose of Data Used Legal Lawful California Processing Basis Purpose Category (GDPR) (DPDPA)

Account creation & Account Contract Contract / Identifiers management information (Art. Consent
6(1)(b))

Authentication & Account Contract Contract Identifiers, session management information, (Art. Network device 6(1)(b)) Activity identifiers

Service Account Contract / Contract Identifiers communications information Legitimate
(notices, alerts) Interests
(Art.
6(1)(f))

Payment processing Payment & Contract Contract Commercial & subscription subscription (Art. Information management information 6(1)(b))

Billing records & Payment & Legal Legal Commercial receipts subscription Obligation Obligation Information information (Art.
6(1)(c))

Customer support & Communications, Contract / Legitimate Customer troubleshooting support content Legitimate Use / Service Info Interests Contract
(Art.
6(1)(f))

Security, fraud Operational & Legitimate Legitimate Identifiers, prevention & abuse diagnostic data, Interests Use Network detection account data (Art. Activity 6(1)(f))

Service stability Operational & Legitimate Legitimate Network & reliability diagnostic data Interests Use Activity (diagnostics) (Art.
6(1)(f))

Terms & policy Account data, Contract / Contract Identifiers enforcement usage signals Legitimate
Interests
(Art.
6(1)(f))

Transient cloud Limited User Contract Contract / N/A -- not inference Content snippets (Art. Consent stored at rest (user-activated) 6(1)(b))

Aggregate De-identified / Legitimate Legitimate N/A -- analytics & aggregated data Interests Use de-identified service (Art.
improvement 6(1)(f)) /
Consent

Compliance with As required by Legal Legal Varies legal obligations law Obligation Obligation
(Art.
6(1)(c))

Where we rely on Legitimate Interests as a legal basis, we have assessed those interests against your rights and freedoms. Where the law requires consent, or where we offer optional data-sharing features, we will provide appropriate controls. We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

4. How We Disclose Your Information

We do not sell your personal data. We do not share your personal data for cross-context behavioural advertising. We disclose information only as set out below.

4.1 Service Providers and Subprocessors

We share information with vendors and subprocessors that help us operate the Service. These parties may process information only to provide services to us and are contractually required to protect it in accordance with this Policy and applicable law. A full, named Subprocessor List is published separately and hyperlinked from our website. The categories of recipients are set out in the table below.

Category Purpose Data Shared Location / Transfer Mechanism

Identity / SSO Authentication Account USA / SCCs or providers (e.g. identifiers, tokens adequacy Google, Apple)

Payment Payment processing Payment tokens, USA / SCCs or processor (e.g. transaction adequacy Stripe) metadata

Cloud inference Transient cloud Limited User USA / SCCs; providers (e.g. processing Content snippets zero-data-retention AWS, Google (user-activated) (volatile memory contract Cloud) only)

Database Database / storage Account & USA / SCCs or provider (e.g. operational data adequacy Supabase)

GRC compliance Compliance & Operational data USA / SCCs or (e.g. Sprinto) evidence adequacy collection

Cloud hosting / Service operation Account & USA / SCCs or infrastructure operational data adequacy

4.2 Legal, Safety, and Compliance Disclosures

We may disclose information if we believe in good faith that it is reasonably necessary to: (a) comply with applicable law, legal process, or lawful governmental requests; (b) protect the rights, safety, or security of RamAIn, our users, or others; or (c) prevent fraud or abuse, or enforce our agreements.

4.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or a portion of our assets, information may be disclosed as part of that transaction, subject to appropriate confidentiality obligations and customary diligence practices. We will notify you of any such change as required by applicable law.

4.4 Third-Party Services You Choose to Use

The Service may interact with third-party applications at your direction (for example, to send an email or complete an action within another application). In those cases, information may be transmitted to and from those third parties as needed to complete the task you initiated. Those third parties process information under their own terms and privacy policies, and RamAIn does not control their practices. You are responsible for reviewing third-party terms before directing the Service to interact with them. Restrictions on using RamAIn to violate third-party terms are addressed in the Terms of Service and Acceptable Use Policy.

5. Data Retention

The table below sets out our retention periods by data category.

Data Category Retention Period Storage Basis Location

User Content (screen Not retained by User's device Local-first captures, OCR, AI RamAIn; stored (local only) architecture drafts) locally on device
only

Transient cloud Not retained; Cloud inference Zero-data-retention processing snippets processed in volatile provider design memory only (ephemeral)

Account information Duration of active RamAIn servers Contract / Legal subscription + 3 (USA) Obligation years

Payment & billing Duration of active Payment Legal Obligation records subscription + 3 processor /
years (or as required RamAIn servers
by tax law)

Customer support Duration of active Support tooling Legitimate Interests communications subscription + 2 / RamAIn
years servers

Operational & Up to 90 days (unless RamAIn servers Legitimate Interests diagnostic logs extended for active / Security security
investigations)

De-identified / Indefinite (no longer RamAIn servers Legitimate Interests aggregated analytics attributable to any
individual)

Upon expiry of the applicable retention period, we will securely delete or irreversibly anonymise your personal data so that it can no longer be associated with you, unless further retention is required by a specific legal, regulatory, or contractual obligation. Where we are unable to immediately delete certain information (for example, because it is stored in backup archives), we will isolate it from further processing and delete it as soon as practicable.

6. Security

We maintain administrative, technical, and organisational safeguards designed to protect personal data from unauthorised access, disclosure, alteration, and loss. Our security measures are proportionate to the nature of the data we handle and the risks associated with the Service. Examples include encryption in transit, access controls, and monitoring for anomalous activity.

Because RamAIn is local-first, your device security is an important part of the overall security model. You are responsible for maintaining reasonable security measures on your device, protecting your credentials, and limiting access to your account. No system is completely secure; if you become aware of a security issue, please contact us at security@ramain.ai.

7. International Data Transfers

RamAIn, Inc. is based in the United States. We and our service providers may process personal data in the United States and in other jurisdictions where we or our subprocessors operate. Cloud services are globally distributed, so processing locations may vary.

Where required by applicable law, we use appropriate safeguards for cross-border transfers:

• EEA, UK, and Switzerland → USA: We rely on Standard Contractual Clauses (SCCs) adopted by the European Commission. We intend to additionally certify under the EU-US Data Privacy Framework (DPF), UK Extension, and Swiss-US DPF and will update this Policy once certification is complete.

• EEA, UK, and Switzerland → Other third countries: We use SCCs or other appropriate transfer mechanisms as required.

• India → Other countries: We process transfers in accordance with India's Digital Personal Data Protection Act, 2023 and any applicable rules or government notifications.

8. Your Rights and Choices

8.1 In-Product Controls

You control whether and when cloud inference features are activated. If you do not press the hotkey, your use of the Service remains local. You can review and update your in-app preferences and permissions at any time through the application settings.

8.2 Account Settings and Communications

You may update certain account details through your account settings. If you have opted in to marketing communications, you can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us. We will not send marketing communications without your prior opt-in consent. We may still send non-marketing communications that are necessary to provide the Service, such as billing, security, and operational notices.

8.3 Device and Third-Party Controls

Your device security settings and third-party application settings are an important part of the local-first model. You control what is displayed on your screen, what permissions you grant to the RamAIn application, and how third-party applications handle information. Third-party applications process data under their own terms and policies.

8.4 Exercising Your Privacy Rights

To submit a privacy request (including to access, correct, delete, or port your personal data, or to exercise any other right described in this Policy or in Section 9), please contact us using the details in Section 13. We will verify your identity before processing your request, which may include confirming control of the email address associated with your account. If you use an authorised agent (where permitted by law), we may require proof of authorisation and may still verify your identity directly.

8.5 Response Timelines

We will acknowledge your request promptly and respond within the timeframe required by applicable law. For GDPR requests, we will respond within one month (extendable by a further two months for complex requests, with notice). For DPDPA requests, we will acknowledge grievances within 7 days and resolve them within 30 days. For CCPA/CPRA requests, we will respond within 45 days (extendable by a further 45 days, with notice).

8.6 Limits and Exceptions

We may deny or limit requests where permitted by law, including where fulfilling a request would adversely affect the rights of others, compromise security, require disproportionate effort, or conflict with legal or contractual obligations. Where we deny a request in whole or in part, we will provide an explanation as required by applicable law.

9. Jurisdiction-Specific Disclosures

This Section applies only to residents of the relevant jurisdiction. Where there is a conflict between this Section and the rest of the Policy, this Section controls for users in that jurisdiction.

9.1 California (CCPA and CPRA)

Categories of Personal Information

Depending on how you use the Service, we may collect the following categories of personal information as defined by California law:

• Identifiers: name, email address, account IDs, device identifiers.

• Commercial information: subscription status, transaction records, billing history.

• Internet or other electronic network activity: basic usage signals and diagnostics.

• Customer service information: support requests and communications.

We do not intentionally collect or store screen content, OCR content, or other User Content on RamAIn servers as content stored at rest (see Sections 1 and 2).

Sale or Sharing

We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

Sensitive Personal Information

To the extent we process sensitive personal information as defined by California law, we do so only as reasonably necessary to provide the Service, ensure security, prevent fraud, and comply with law. We do not use sensitive personal information beyond these purposes.

California Rights

Subject to verification and applicable exceptions, California residents have the right to: (a) know what personal information we collect, use, disclose, and share; (b) access specific pieces of personal information we hold about you; (c) correct inaccurate personal information; (d) delete personal information; (e) opt out of the sale or sharing of personal information (RamAIn does not sell or share); and (f) not be discriminated against for exercising these rights.

To exercise these rights, contact us using the details in Section 13.

9.2 Europe (GDPR -- EEA, UK, and Switzerland)

Data Controller

The data controller is RamAIn, Inc., 505 Montgomery Street, San Francisco, CA 94111, USA. For users in the EEA, UK, and Switzerland, please contact us using the details in Section 13. RamAIn has appointed an EU/UK representative under GDPR Art. 27, please contact privacy@ramain.ai.

Legal Bases for Processing

We process personal data under the following GDPR legal bases (see the table in Section 3 for the basis applicable to each purpose): Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)); Legal Obligation (Art. 6(1)(c)); and Consent (Art. 6(1)(a)) where specifically indicated.

Your GDPR Rights

Subject to applicable exceptions, you have the following rights under GDPR:

• Right to be Informed: to receive clear, transparent information about how we process your data.

• Right of Access: to obtain a copy of your personal data and information about how we process it.

• Right to Rectification: to have inaccurate or incomplete data corrected.

• Right to Erasure (Right to be Forgotten): to request deletion of your data where there is no compelling reason to retain it.

• Right to Restrict Processing: to request that we limit processing in certain circumstances.

• Right to Data Portability: to receive your data in a structured, machine-readable format.

• Right to Object: to object to processing based on legitimate interests or for direct marketing.

• Rights in Relation to Automated Decision-Making: not to be subject to decisions based solely on automated processing that produce legal or significant effects.

• Right to Withdraw Consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

• Right to Lodge a Complaint: to complain to your local supervisory authority.

EEA residents can find their supervisory authority at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

9.3 India (DPDPA)

Data Fiduciary

Where India's Digital Personal Data Protection Act, 2023 ("DPDPA") applies, RamAIn, Inc. acts as the Data Fiduciary. Our Grievance Officer details are provided in Section 13.

Lawful Purposes

We process personal data for lawful purposes consistent with the DPDPA, including: (a) performance of a contract to which you are a party; (b) Legitimate Use where you voluntarily provide personal data; and (c) compliance with law. We apply purpose limitation and data minimisation consistent with our local-first design.

Your DPDPA Rights

Subject to applicable exceptions under the DPDPA, you have the following rights:

• Right to Access Information: to obtain a summary of your personal data being processed and the identities of third parties with whom it has been shared.

• Right to Correction and Erasure: to correct inaccurate or incomplete data, or to request erasure of data no longer necessary for its specified purpose.

• Right to Withdraw Consent: to withdraw consent at any time through a mechanism as easy as the one used to provide it.

• Right to Nominate: to designate an individual to exercise your rights on your behalf in the event of your death or incapacity.

• Right to Grievance Redressal: to have complaints addressed through our grievance mechanism before escalating to the Data Protection Board of India.

We will acknowledge grievances within 7 days and resolve them within 30 days of receipt.

10. Summary of Rights Across Jurisdictions

The table below provides a comparative overview of your rights across the three primary frameworks covered by this Policy.

Right GDPR (EEA / India California UK / CH) (DPDPA) (CCPA/CPRA)

Right to know / ✔ Art. 15 ✔ S. 11(a) ✔ access

Right to ✔ Art. 16 ✔ S. 12(a) ✔ rectification /
correction

Right to erasure / ✔ Art. 17 ✔ S. 12(b) ✔ deletion

Right to restrict ✔ Art. 18 --- --- processing

Right to data ✔ Art. 20 --- --- portability

Right to object ✔ Art. 21 --- ---

Right to withdraw ✔ Art. 7(3) ✔ S. 6(4) --- (opt-out) consent

Right to nominate --- (via ✔ S. 14 --- probate law)

Opt-out of sale / --- (no sale) --- (no sale) ✔ (RamAIn does not sharing sell or share)

Non-discrimination --- --- ✔

Right to lodge a ✔ Art. 77 (DPA) ✔ (Data ✔ (AG / DPA) complaint Protection
Board)

Right to grievance --- ✔ (7-day ack., --- redressal 30-day
resolution)

Rights re: automated ✔ Art. 22 --- --- decisions

11. Children

The Service is not directed to children under the age of 18 (or such other age as may be required by applicable law), and we do not knowingly collect personal data from children in a manner that would require parental or guardian consent under applicable law. If you believe a child has provided personal data to us without appropriate consent, please contact us using the details in Section 13 and we will take prompt steps to delete such data.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes to the Service, our data practices, or legal requirements. If we make material changes, we will provide notice by posting the updated Policy on our website, sending an in-app notification, or by other reasonable means, prior to the changes taking effect. The Last Updated date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any update constitutes acceptance of the revised Policy to the extent permitted by law.

13. Contact Us

To ask questions, exercise your rights, or submit a privacy complaint, please contact us using the appropriate details below.

EEA, UK, and United States (and all Switzerland other users)

Email privacy@ramain.ai

Mailing Address 505 Montgomery Street, San Francisco, CA 94111, USA

India --
Grievance
Officer

Designation Grievance Officer, RamAIn, Inc.

Name Akshay Vir

Email akshay@ramain.ai

Response Acknowledgement within 7 days; resolution within 30 Timeline days of receipt