Privacy Policy

1. Scope and responsibility

This policy describes how Riften Inc., a Delaware corporation, doing business as Riften, handles personal information in connection with its website, business relationships, accounts, and services.

Where Riften processes personal information in customer content on an organization’s behalf, that organization’s instructions and the applicable customer agreement govern that processing. Requests relating to an organization’s content should be directed to that organization. This policy does not replace a customer data processing agreement.

2. Information we handle

The information we handle depends on the services you use and what you or your organization provide. It includes:

• Account and business information: names, work email addresses, organization details, sign-in information, and workspace membership.
• Service content: prompts, model responses, files, code, datasets, evaluation results, and configuration information submitted through a workspace or API.
• Technical records: IP addresses, device or browser information, request identifiers, usage records, errors, and security logs.
• Communications: messages, support requests, and information supplied when contacting Riften or applying to work with us.
• Transaction information: billing contacts and payment records, if a paid service is used.

We receive information directly from you, from your organization and its authorized users, through use of the services, and from providers involved in authentication, payment, and fulfilling your requests.

3. Purposes

Riften processes information to provide access to the services, execute requests, route model calls, run evaluations, operate configured models and environments, respond to support requests, manage billing, protect accounts, monitor service performance, understand product usage, diagnose errors, and meet legal obligations.

4. Model requests and customer content

Riften uses customer content for model training or customization only for that customer’s private models, within the scope of the customer’s agreement. We do not use that content to train shared models or models for other customers.

Riften uses model and inference providers including OpenAI, Anthropic, Fireworks AI, Baseten, and other providers serving open-source models. Depending on the service and configuration, model routing can send request content to the provider used to fulfill the request. Private-model and environment deployments may have different data flows depending on their configuration and agreement.

5. Providers and sharing

The technology used to provide the services includes AWS and Supabase for infrastructure and data storage; OpenAI, Anthropic, Fireworks AI, Baseten, and other inference providers for model services; Stripe for payments; and Better Auth for authentication. Depending on the deployment, we also use Resend to deliver account emails and PostHog for product usage analytics, performance monitoring, and error reporting.

We disclose relevant information to:

• Infrastructure, authentication, model, email, analytics, support, and payment providers used to deliver the services.
• An organization’s authorized administrators and members, according to workspace permissions.
• Recipients you instruct Riften to connect or disclose information to.
• Authorities or other recipients when legally required or necessary to establish or protect rights.
• A successor in a proposed or completed business transaction, subject to applicable protections.

6. Website storage and tracking

The marketing website stores your selected dark or light theme in your browser using the local-storage key riften-home-theme. This remembers the display preference across pages. You can change the preference on the homepage or remove it through your browser’s site-data controls.

The application uses authentication cookies to maintain sign-in sessions. Where analytics is enabled, PostHog collects usage, page-view, performance, and error events. Session recording may also be enabled, with text and input masking configured in the application. Browser controls let you remove stored site data or restrict cookies, although doing so can affect sign-in and other functionality.

7. Retention and deletion

Riften stores customer data to provide the services. Deletion requests may be carried out through a manual process. Following an authorized request to delete a customer workspace, we delete its customer data from active systems within 30 days and remove residual backup copies within 90 days of the request. During that period, residual backup data is restricted to recovery purposes. If a backup is restored, we reapply the deletion.

Deleting an individual user account removes that user’s access and personal account data under the same deletion schedule. It does not delete the company’s shared workspace or business content controlled by the organization. Requests to delete that content must come from an authorized representative of the organization.

We retain specific records beyond these periods where required by law, such as records necessary to meet applicable tax or accounting obligations. Such records are retained only for that obligation and the required period.

8. Security

No method of transmission or storage is completely secure. You should protect your credentials, restrict workspace access to authorized users, and contact legal@riften.ai if you suspect unauthorized access. Additional security commitments may be specified in your customer agreement.

9. Your choices and requests

Depending on where you live and which laws apply, you may have rights to request access to, correction of, deletion of, or a copy of personal information, or to object to or restrict certain processing. Additional rights may apply to consent, marketing, sale, or targeted-advertising sharing.

Contact legal@riften.ai. We may need to verify your identity and authority before responding. For information controlled by your organization, contact its administrator. We will respond within the period required by applicable law. Where available under the law that applies to you, you may appeal our decision by contacting us or lodge a complaint with your privacy regulator. We will not discriminate against you for exercising applicable privacy rights.

10. Processing locations

The locations where customer content is processed depend on the providers, services, and deployment configuration used for your account. For information about your deployment’s processing locations and applicable data processing terms, contact legal@riften.ai. A private-model arrangement does not by itself specify a hosting country.

11. Children

Riften’s services are for businesses and their authorized users. They are not offered for personal or consumer use and are not directed at children.

12. Updates and contact

We will update the date of this policy when it changes. We will notify you of material changes as required by applicable law and the relevant agreement. If a change requires consent, we will obtain it before making that change.

Privacy contact: legal@riften.ai
Company: Riften Inc.
Mailing address: 251 Little Falls Drive, Wilmington, Delaware 19808, United States (registered office)