AI Usage & AI Agent Policy

This Privacy Policy governs the collection, processing, storage, and protection of personal data and proprietary document assets processed by Production RAG Agent (referred to herein as "RAG Agent", "we", "us", or "our"). This policy applies to all users of our multi-tenant document ingestion workspaces, real-time retrieval-augmented generation (RAG) chat interfaces, autonomous multi-agent workflows, Model Context Protocol (MCP) tool executions, and subscription portals.

For the purposes of the European Union General Data Protection Regulation (GDPR) and the UK Data Protection Act:

• Data Controller: For account identity, authentication credentials, billing records, and system telemetry, RAG Agent Technologies Inc. acts as the Data Controller.
• Data Processor: For proprietary documents, text chunks, vector embeddings, and workspace interactions uploaded or generated by organization members, RAG Agent acts as a Data Processor on behalf of the customer organization (the Data Controller).

Enterprises rely on RAG Agent to process sensitive internal documentation, confidential source code, legal contracts, and proprietary intellectual property. We provide an unconditional, binding contractual commitment:

• Zero Pre-Training & Fine-Tuning: Customer data—including raw documents, chunked text, semantic vectors, user queries, and agent deliberation traces—is strictly excluded from any model training or fine-tuning datasets.
• Zero Data Retention with Third-Party Providers: When commercial foundation models (e.g., OpenAI, Google Gemini, Anthropic Claude) are configured as generation or embedding providers, requests are routed via enterprise endpoints governed by strict Zero Data Retention (ZDR) agreements. Third-party providers are prohibited from logging prompt contents beyond transient stateless inference.
• Air-Gapped Local Option: For organizations with maximum privacy mandates, RAG Agent provides native support for 100% local, on-premise execution utilizing local Ollama models (such as Qwen2.5 and Nomic-Embed-Text), ensuring zero outbound network transmission.

We process data strictly to the extent required to deliver grounded document intelligence and agentic task execution:

When documents are submitted to a Room workspace, they undergo an automated ingestion lifecycle:

1. Text Extraction & Sanitization: Raw text is extracted, stripped of harmful scripts or embedded macros, and split into chunks based on configurable size and overlap parameters (default 800 characters with 150-character overlap).
2. Vector Generation: Each chunk is converted into a vector representation by your designated embedding model.
3. Database Storage: Embeddings and chunk references are saved directly into the isolated ChromaDB vector store mapped to the specific Room ID and Organization ID.

No external service or unauthorized user can search or cross-reference your vector indices.

Our architecture incorporates a two-tier memory system designed to provide context-aware responses without compromising privacy:

• Short-Term Memory (STM): Transient conversational facts stored in ephemeral RAM cache, scoped strictly to the active session. STM items decay automatically when a session ends.
• Long-Term Memory (LTM): Explicitly confirmed user preferences and enterprise domain facts stored in the database. LTM access is governed by strict RBAC (accessible only to authorized Staff and Admin accounts).
• Transparent Control: Authorized users can view, prune, revaluate, or delete every individual memory fact in real time through the dedicated Memory Management Panel.

We implement comprehensive technical and organizational safeguards:

• Encryption Standards: Data in transit is secured using modern TLS 1.3 protocol with strict cipher suites. Data at rest (SQLite databases, ChromaDB vector stores, uploaded files) is encrypted using industry-standard AES-256.
• Strict Workspace Partitioning: Every room workspace maintains cryptographic isolation. Document queries enforce strict row-level security and room membership checks at the API middleware layer prior to vector search execution.
• Sanitized Execution: Multi-agent autonomous code execution takes place in restricted sandboxes preventing unauthorized system calls, directory traversal, or network escalation.

To deliver multi-modal capabilities and secure payments, we engage selected sub-processors under rigorous data protection agreements:

• Razorpay: Payment processing gateway for subscriptions and recurring billing. Razorpay is certified PCI-DSS Level 1 compliant. RAG Agent never receives, stores, or logs raw payment card credentials.
• Cloud Foundation Providers (Optional): When configured by your administrator, queries may be dispatched to Google Cloud Platform (Gemini API), OpenAI Inc., or Anthropic PBC under enterprise zero-data retention agreements.
• ChromaDB & SQLite: Localized vector and relational persistence engines operating within your designated environment boundaries.

We adhere strictly to the principle of data minimization:

• Instant Self-Service Purge: You may at any time click the "Clear All Data" button in Settings to permanently delete all conversation transcripts, session histories, and contextual memory records.
• Document Deletion: Deleting a file from the Document Library immediately unlinks the file, purges its vector embeddings from ChromaDB, and removes the physical file from the storage directory.
• Account Termination: Upon account closure, all associated rooms, documents, embeddings, and credentials undergo complete cryptographic erasure within 30 days.

Regardless of your geographical location, RAG Agent provides comprehensive data rights:

• Right to Access & Portability: You may request an export of your account data, document catalog, and chat logs in structured JSON format.
• Right to Rectification: You may update erroneous profile information or re-index updated document versions.
• Right to Erasure ("Right to be Forgotten"): You have the absolute right to demand complete deletion of your personal records and indexed assets.
• Right to Restrict or Object: You may opt out of telemetry logging and disable automated memory extraction.

For privacy inquiries, Data Subject Access Requests (DSAR), or Data Processing Agreements (DPA), please reach our Data Protection Officer:

These Terms of Service ("Terms") constitute a legally binding agreement between you (individually or on behalf of the entity you represent) and RAG Agent Technologies Inc. ("RAG Agent", "we", "us"). By creating an account, uploading documents, running autonomous agents, or paying for a subscription, you represent that:

• You are at least 18 years of age or the legal age of majority in your jurisdiction.
• You have full corporate power and legal authority to bind your organization to these Terms.
• Your use of the services complies with all applicable export controls, cybersecurity regulations, and data privacy laws.

RAG Agent provides an enterprise-grade document ingestion and conversational retrieval platform featuring:

• Multi-tenant room workspaces for group-scoped document sharing and contextual inquiry.
• Document parsing for PDF, DOCX, TXT, CSV, MD, and HTML files with automated chunking and vector embedding generation.
• Real-time Server-Sent Events (SSE) streaming answers with verifiable source chunk citations.
• A agent autonomous collaborative system (Decision Maker, Researcher, Task Generator, Task Executor, Validator, Deployer).
• Model Context Protocol (MCP) tool calling and sandboxed computational executions.

Users are responsible for safeguarding account credentials, API keys, and session tokens. You agree to notify us immediately of any unauthorized access to your account.

The platform enforces Role-Based Access Control (RBAC):

• Admin: Possesses full control over organization settings, member invitations, team billing, audit logs, and memory management.
• Staff: Authorized to revaluate document memory, review audit traces, and manage workspace documents.
• Member: Permitted to upload documents, participate in assigned room chats, and run multi-agent workflows.
• Viewer: Read-only access to room chats and verified citation references.

We respect intellectual property rights and maintain clear delineations:

• Customer Materials: You retain 100% sole ownership, copyright, and trade secret rights in all files, documents, text excerpts, and prompts you upload or provide to the platform.
• AI Output Ownership: As between you and RAG Agent, you own all rights, title, and interest in and to the synthesis, reports, answers, and artifacts generated by the agent based on your inputs, to the fullest extent permitted by applicable law.
• Platform Intellectual Property: RAG Agent retains all rights, title, and interest in our proprietary algorithms, agent coordination graphs, UI designs, codebases, APIs, and documentation.

You agree not to engage in any prohibited activities, including but not limited to:

• Reverse engineering, decompiling, or attempting to discover the source code of non-open components or model weights.
• Uploading files containing malware, rootkits, viruses, or obfuscated malicious payloads.
• Attempting to break out of the Python execution sandbox or executing unauthorized command-line system operations.
• Bypassing multi-tenant room isolation or accessing workspaces without explicit invite tokens.
• Generating deceptive deepfakes, automated phishing campaigns, hate speech, or malicious exploits.
• Automating high-volume query flooding that degrades platform availability for other tenants.

Paid plans (including Pro and Enterprise tiers) are offered on monthly and annual billing cycles:

• Recurring Billing Mandates: Paid subscriptions utilize automated recurring billing handled securely via Razorpay. By upgrading to a paid tier, you authorize recurring debits until cancelled.
• Taxes: All fees are exclusive of applicable Goods & Services Tax (GST), Value Added Tax (VAT), or sales taxes, which will be charged where required by local statutory law.
• Price Modifications: We reserve the right to revise subscription prices upon at least 30 days advance written notice prior to your next renewal cycle.

To ensure optimal responsiveness, accounts are subject to tier-based fair usage policies:

• File upload caps (default 25MB per document; customizable for Enterprise tiers).
• Concurrent vector ingestion limits to prevent queue starvation.
• Rate limits on streaming LLM token generation per minute. Excessive programmatic loops may trigger temporary throttles.

We target a 99.9% uptime Service Level Agreement (SLA) for paid enterprise tiers, excluding scheduled maintenance. Scheduled maintenance is conducted during low-traffic windows with at least 48 hours advance notice posted in the system dashboard.

Important Regulatory Notice on Generative AI:

To the maximum extent permitted by applicable law:

• Neither party shall be liable for indirect, punitive, special, exemplary, incidental, or consequential damages (including loss of profits, goodwill, data, or business disruption).
• RAG Agent's aggregate total liability arising out of or related to these Terms shall not exceed the total fees paid by customer to RAG Agent in the twelve (12) months preceding the event giving rise to liability.

You may terminate your account at any time via the billing portal. Upon termination, customer maintains a 30-day grace period during which all workspace documents, transcripts, and memory data may be exported. Following the grace period, all data is permanently purged.

These Terms shall be governed by and construed in accordance with the laws of Delaware, USA (or the applicable regional entity jurisdiction for international enterprise contracts), without regard to conflict of laws principles. Any unresolved disputes shall be settled through binding individual arbitration under the rules of the American Arbitration Association (AAA).

If you upgrade to our Pro subscription tier and determine within 14 calendar days that the platform does not meet your business requirements, you may request a complete refund of your initial subscription payment. No interrogation, no convoluted hurdles.

Refund requests will be promptly honored under any of the following circumstances:

• First-Time Subscription Window: Request filed within 14 calendar days of the initial subscription charge.
• Verified Service Disruptions: Platform downtime or core ingestion failures exceeding our 99.9% SLA threshold during a billing cycle.
• Technical Incompatibility: Inability of the platform to index supported file formats (.pdf, .docx, .txt, .csv) due to verified backend bugs.
• Billing Anomalies: Duplicate charges, incorrect plan assignment, or billing errors resulting from gateway synchronization anomalies.
• Annual Plans: Annual plans cancelled within 30 days of renewal are eligible for a prorated refund for all unused months.

Refunds will not be granted under the following conditions:

• Excessive Quota Depletion: Accounts that have consumed more than 80% of allocated monthly LLM token quotas prior to filing a refund claim.
• Terms of Service Violations: Accounts suspended or terminated as a result of malicious hacking attempts, automated abuse, or illegal material uploads.
• Requests Past the Guarantee Window: Standard monthly renewals requested after the expiration of the 14-day window.
• Repeated Cycles: Customers who previously claimed a refund and subsequently subscribed again under the same organization or billing credentials.

You can cancel your recurring subscription at any moment without penalty:

1. Navigate to the Plans & Pricing Page.
2. Locate your active subscription banner and select "Cancel Subscription / Stop Recurring Mandate".
3. Upon cancellation, your card will never be charged again. You retain full access to Pro features until the conclusion of your current paid billing period.

To submit a refund request, follow these straightforward steps:

Once our billing desk approves your refund:

• The refund command is dispatched immediately to the Razorpay Payment Gateway.
• Funds are routed back exclusively to the original payment instrument (Credit Card, Debit Card, UPI, NetBanking).
• Settlement Timing: Most domestic banks credit the funds within 5 to 7 business days. UPI refunds often settle within 24 to 48 hours.

We strongly encourage reaching out to our billing desk prior to filing formal bank chargebacks. Direct refund processing via Razorpay is significantly faster (5–7 days) compared to bank dispute workflows, which can take 60–90 days. We are committed to fair and prompt resolution of all genuine billing inquiries.