Privacy Policy

Ratelane is operated by AiNest. For data about you and your account, we are the data controller. For telemetry about your own end users that your applications send us, you are the controller and we act as your processor, handling it only on your instructions to provide the service.

Account data.

• Email address, account name, and a hashed password (we never store your password in plain text).
• If you sign in with Google or GitHub: the email address and provider identifier they share with us.
• Team membership, roles and instance access you or your owner set up.
• Consent records: when you accepted the Terms and whether you opted in to product update emails.

Service data.

• Your policies, saved policies, route and instance settings, aliases and alert preferences.
• API key metadata (we store only a hash and a short prefix of your keys) and when they were last used.
• Instance information such as device identifier, framework, and last-seen time.

Telemetry from your applications. For each request your SDK reports: HTTP method, path, status code, latency, response size, timestamp, the client IP address, and whether the request was blocked and why. We do not receive request bodies, headers or cookies.

Billing data. Subscriptions and payments are handled by our payment processor. We keep your plan, billing cycle, subscription status and processor identifiers. We do not receive or store your full card number.

Support and usage. Messages you send through support chat or email, and basic usage analytics from visiting our site and dashboard (pages viewed, sign-up events).

• To provide, secure and support the service, including enforcing your plan limits.
• To show you traffic, analytics, logs and alerts in your dashboard.
• To process payments and prevent fraud and abuse (including bot protection at sign-in).
• To send service emails you need (password resets, billing, security and incident alerts, the alerts you configure).
• To send product updates and changelogs, only if you opted in.
• To improve the product and meet legal obligations.

Where the law requires a legal basis: contract (running your account), legitimate interests (security, support, improving the service), consent (marketing emails, optional analytics where required) and legal obligation.

We only send product updates if you tick the box at sign-up, join our newsletter (confirmed by email), or turn it on in Settings. Every such email has an unsubscribe link, and you can switch it off any time in Settings → Email preferences. Unsubscribing does not stop essential service emails.

We do not sell your personal data. We share it only with service providers that help us run Ratelane, under agreements that limit how they use it:

• Hosting and databases (application hosting, MongoDB and Redis infrastructure).
• Email delivery (Resend).
• Payments (Dodo Payments, or Razorpay where applicable).
• Bot protection (Cloudflare Turnstile).
• Sign-in providers you choose (Google, GitHub).
• Support chat (Libredesk).
• Analytics (Google Analytics).

We may also disclose data if required by law, to protect our rights and users, or in a merger or sale of the business.

Our staff can access account data when needed to provide support or investigate abuse. Access is limited to authorised staff, and administrative actions are logged. When support uses a read-only "view as user" session, it is recorded.

• Essential: secure, HTTP-only cookies that keep you signed in, and bot-protection cookies at sign-in.
• Preferences: your theme and which announcements you dismissed, stored in your browser.
• Analytics: Google Analytics sets cookies to measure usage of our site and dashboard. It loads only if you accept it in the cookie banner, and never in our internal admin tools. We also treat a browser "Global Privacy Control" signal as a refusal.

• Telemetry: deleted automatically after your plan's retention period (24 hours Free, 7 days Pro, 30 days Enterprise).
• Account and service data: kept while your account is active. If you delete your account we remove or anonymise it within a reasonable period.
• Billing and tax records: kept as long as the law requires.
• Security and audit logs: kept for as long as needed to protect the service.

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent at any time. Email [email protected] and we will respond within a reasonable time. You can also complain to your local data protection authority. If you are an end user of one of our customers, please contact that customer first, since they control that data.

We use encryption in transit, hashed credentials and keys, access controls and rate limiting to protect your data. No system is perfectly secure, so please use a strong, unique password and keep your API keys private. If a breach affects you we will notify you as the law requires.

We and our providers may process data in countries other than your own. Where required, we rely on appropriate safeguards for those transfers.

Ratelane is not for anyone under 16, and we do not knowingly collect their data. If you think we have, contact us and we will delete it.

We may update this policy. We will post the new version here with a new date, and tell you about material changes by email or in the dashboard.

Ratelane, a product of AiNest. [email protected]