Privacy Policy

1. Where This Policy Applies

This policy covers Recallstack's public website, signed-in web app, API, CLI, customer support, billing, and security processes.

O'CLAN LIMITED decides how most account information described here is used. In legal terms, this makes us the data controller. For content added to a team workspace, the customer or workspace admin may also decide what is added and who can access it inside the workspace.

2. Information We Collect

• Your email address, optional profile name, and account ID from a sign-in provider such as Google or Microsoft.
• Information used to sign you in and keep your account secure. This includes one-way protected, or hashed, versions of session refresh tokens, API keys, magic-link tokens, and recovery codes, plus encrypted two-step verification secrets. We show only the beginning of an API key in the app.
• Workspace and project details, members, roles, invitations, and access permissions.
• Memory content and related information you submit. This includes source content, metadata, numerical representations called embeddings, confidence values, links between memories, generated summaries, feedback, and records of memory searches and processing activity.
• Service activity such as API requests, status codes, response sizes, audit logs, and counters used to enforce request limits.
• Your subscription status, Paystack payment references and codes, and metadata about payment events Paystack sends us.
• Network and device information. We use country information based on your IP address for regional pricing and anonymous request limits. We also use browser or app details and signals created from your IP address to protect accounts and prevent abuse.
• Two cookies, named rsk_at and rsk_rt, which are needed to keep you signed in.

3. How We Use Your Information

• Give you access to your account and let you manage workspaces, projects, permissions, and saved memories.
• Protect Recallstack through sign-in checks, two-step verification rules, and abuse prevention.
• Apply plan limits, process billing, control request rates, and keep the service reliable.
• Use OpenAI's APIs to create memory embeddings, extract information, and combine related memories.
• Process payments and keep subscription information up to date through Paystack.
• Keep records of important account, workspace, and memory activity.

4. AI, Model Training, and Our Providers

OpenAI is currently the only provider used for live AI and embedding work in Recallstack. We use it to extract information, combine related memories, and create embeddings. We use Paystack for payments and email providers to send service messages.

Recallstack processes memory content on our servers so you can search it, connect related memories, improve memory quality, prevent abuse, and get support. We do not use customer content to train Recallstack models.

We send prompts, memory content, and related information to OpenAI through its business API when we need to extract information, create summaries, or create embeddings. As of the effective date above, OpenAI says it does not use API data to train or improve its models unless the customer chooses to share that data. Recallstack has not chosen to share it for training.

Our staff do not routinely read customer memory content. A staff member may access it only for an approved support, security, fraud, or abuse case. We record that access. When protected memory-search records are accessed, the workspace admin is also notified.

We do not sell personal information. We also do not share it so that other companies can target advertising based on your activity across different services.

5. When We Share Information

We may share information:

• With companies that help us run Recallstack, including OpenAI, Paystack, and our email providers.
• With workspace members and admins, based on membership, project access settings, and product permissions.
• With professional advisers, auditors, insurers, payment processors, or a company buying all or part of our business, where reasonably needed.
• When a law, regulation, court order, or valid legal request requires us to share it.
• When reasonably needed to investigate, prevent, or respond to fraud, abuse, a security incident, or a violation of someone's rights.

6. Who Is Responsible for Your Data

O'CLAN LIMITED is the data controller for the information described in this policy.

• Website: oclan.co
• Privacy and data-rights requests: [email protected]

7. How Long We Keep Information

• Magic-link sign-in tokens expire quickly. The usual setting is 15 minutes, though this can be changed.
• Temporary sign-in-provider and two-step verification setup information expires after 10 minutes.
• Temporary authorisation codes used for connected accounts expire quickly, and the related access tokens are designed to be short-lived.
• Session and connected-app refresh records usually expire after 30 days. We regularly remove old, expired, or cancelled sessions.
• API keys stay active until the account owner or an authorised admin cancels them.
• Memory-search audit records and old, expired, or cancelled emergency-access requests are usually removed after 30 days.
• We generally keep workspace, project, and memory records until an authorised user deletes them. We may keep them longer when needed to follow the law, handle a dispute, prevent fraud, or meet a contract requirement.
• We may keep billing, tax, and payment records for as long as laws, accounting rules, or payment-network rules require.
• Deleting a project other than the global project hides it immediately and gives you 48 hours to restore it.
• If the project is not restored within 48 hours, its related data is permanently deleted.
• The global project is reserved for Recallstack and cannot be deleted in the project settings.

Eligible users can delete their account in settings. You may need to contact us if deleting your account would affect other team members, such as when you manage an active team, own its billing, or own shared team resources. Email [email protected] for help. We may ask you to confirm your identity and your authority over the workspace. We may keep limited records when needed for security, legal, tax, or compliance reasons.

8. How We Protect Information

• We store session refresh tokens, API keys, and recovery codes in a one-way protected form that cannot be turned back into the original value.
• We encrypt two-step verification secrets before storing them.
• Browser scripts cannot read our sign-in cookies. Depending on the environment, we also restrict them to secure connections and same-site requests.
• Workspace roles and project permissions control access to team memories.
• We use Redis to enforce service-wide and action-specific request limits that reduce abuse.
• We record important security and memory events in audit logs.
• Access to protected memory-search records requires an approved emergency-access process. We record the access and notify the workspace admin.

9. Your Privacy Rights

Your rights depend on where you live and how you use Recallstack.

Nigeria

Under the Nigeria Data Protection Act 2023, you may ask us for a copy of your data, ask us to correct or delete it, limit how we use it, move it to another service, withdraw consent, or explain how we use it. You may also complain to the Nigeria Data Protection Commission.

EU, EEA, and UK

We rely on a contract, our legitimate business interests, your consent, or a legal duty when we use personal data. Under the GDPR or UK GDPR, you may ask us for a copy of your data, ask us to correct or delete it, limit or object to how we use it, or move it to another service. You may also complain to your local data protection authority.

California

Under the CCPA/CPRA, California residents may ask what personal information we collect, request a copy, ask us to correct or delete it, or ask for it in a portable format. We will not treat you unfairly for using these rights. Recallstack does not sell personal information or share it for advertising based on your activity across different services.

We will confirm your identity before completing a privacy request. To make a request under the NDPA, GDPR, or CCPA/CPRA, email [email protected].

10. Data Processed in Other Countries

Recallstack may process information in countries where we or our service providers operate. Where the law requires it, we use contracts and other safeguards to protect information moved between countries.

11. Children and Sensitive Information

Recallstack is not intended for anyone under 18. Only submit sensitive personal information when you have a lawful reason and the authority to do so. If you think personal information was submitted by mistake, email [email protected].

12. Changes to This Policy

We may update this policy as Recallstack changes. We will publish the latest version here and show its effective date.

Our Terms of Service explain the rules for using Recallstack.