Privacy Policy

Who this is about

Rezee is operated by Akshar Software LLP, registered at Purushottam, Dhebar Road, Rajkot 360002, Gujarat, India. This policy covers rezee.app, the web app at work.rezee.app, the API at api.rezee.app, git access at git.rezee.app, the command-line tool, the desktop app and the iOS app.

Two roles matter and they are not the same. For your account - your name, your email address, your billing details - we decide what happens to it, so we are the controller. For the contents of a workspace - issues, documents, messages, code, everything your team writes - your organisation decides, and we only hold and process it on your instructions. The terms for that second role are in the Data Processing Addendum.

What we collect

• Account. Name, email address, an avatar if you set one, and a password stored only as an Argon2id hash. If you sign in through your company's identity provider, whatever that provider asserts about you instead.
• Workspace content. Issues, projects, documents, design canvases, chat messages, repositories and their full git history, pull requests and reviews, pipeline definitions, build logs and artifacts. We hold this because holding it is the product.
• Technical records. Request logs carrying IP address, user agent, path and response, kept for operational debugging; metrics that count requests rather than describe them; and an audit log of who changed what in a workspace.
• Billing. Plan, seat count, invoices and a billing contact. Card details are entered directly into Stripe and never reach our servers.
• Agent prompts. When an agent does work for you, the text it needs is sent to a language model provider. That can include issue text, document contents and source files the agent read to do the job.
• Devices. A push token per device that has enabled notifications, so a notification can be addressed to it.

What we do not do

There is no analytics vendor, no advertising network, no session recorder and no third-party script of any kind on this website or in the app. Fonts are served from our own domain rather than a font CDN. There is no cookie banner because there are no cookies to consent to: the only ones we set are the session cookie that keeps you signed in and a short-lived one during single sign-on. We do not sell personal data, and we do not train any model on your workspace content.

Why we are allowed to hold it

Where the GDPR or UK GDPR applies, our bases are: performance of a contract for your account, subscription and everything the product does for you; legitimate interests for security, abuse prevention, keeping logs long enough to debug an incident, and telling you about changes that affect your account; and consent where you have given it, which today is only push notifications and marketing email. Where India's Digital Personal Data Protection Act, 2023 applies, this policy is the notice it requires, and the purposes above are the purposes for which you provide the data.

Who else sees it

A short list of companies that run parts of the service, each with a row saying what it can actually reach: the subprocessor list. We do not add to it quietly - the DPA commits us to notice before a new one starts.

Otherwise: nobody. We disclose data outside that list only if you tell us to, or if we are legally compelled, in which case we will tell you unless we are prohibited from doing so.

Where it is processed

On Google Cloud in the United States (us-east1), with CI and pipeline artifacts on AWS in us-east-1. If you are in the EEA, the UK or Switzerland, that is an international transfer, and it rests on the Standard Contractual Clauses in our DPA together with the terms each provider above publishes.

How long we keep it

• Workspace content for as long as the workspace exists. Delete it in the product and it goes.
• Audit log for 90 days, or for the life of the workspace on Business and Enterprise.
• Backups roll on a 14-day window on the server and 30 days in the off-host copy, so deleted content can persist in a backup for up to a month after it is gone from the live system.
• Request logs for as long as they are useful for debugging and abuse investigation, which is weeks rather than years.
• Billing records for as long as tax and accounting law requires us to keep them.

Deleting your account scrubs the personal data from your user row rather than deleting the row itself, because comments and commits you wrote belong to the conversation they are part of and cascading them away would take other people's history with them. What is left is not you: no name, no email address, no credential.

What you can ask for

Access, correction, deletion, a copy in a portable form, restriction, objection, and withdrawal of any consent you gave. Two of those you do not have to ask for: a workspace owner can export a whole workspace from its settings, and repositories are ordinary git, so a clone is the export. For the rest, write to support@rezee.app and we will answer within 30 days. If you are a member of somebody else's workspace, ask them first - for their content they are the controller and we act on their instruction.

If you are unhappy with how we handled a request you can complain to your data protection authority, or in India to the Data Protection Board. We would rather you told us first: support@rezee.app reaches the person responsible for this policy.

Security

How the data is actually protected - encryption, isolation, least privilege, and what is not certified - is on the security page, in specifics rather than adjectives. To report a vulnerability, write to security@rezee.app.

If personal data we hold is breached, we will notify affected customers without undue delay and in any case within 72 hours of becoming aware, with what happened, what was affected, and what we are doing about it.

Children

Rezee is a tool for people at work and is not intended for anyone under 16. We do not knowingly collect their data; if we learn we have, we delete it.

Changes

When this policy changes materially we will email account owners and update the date at the top. Continuing to use Rezee after that is acceptance of the new version.

Contact

support@rezee.app for anything in this policy, including data requests and grievances under the DPDP Act.