Privacy Policy

Updated: 2026-06-22

Welcome to Rabah (the “Service”). This Privacy Policy explains how Rabah collects, uses, stores, shares, and protects your personal information, and how you can manage that information.

By registering for an account, logging in, purchasing services, topping up balance, subscribing, using chat features, calling APIs, linking third-party accounts, contacting support, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with this Privacy Policy, do not use the Service.

1. Who We Are

The Service is operated under the Rabah brand.

If you have questions about this Privacy Policy or our handling of personal information, you can contact us at:

2. Scope of This Policy

This Policy applies to our processing of personal information when you:

  • visit the Rabah website;
  • create, log into, link, or use an account;
  • use chat mode, the dashboard, user API keys, or related features;
  • make payments, subscribe, request refunds, cancel, or manage orders;
  • use third-party login methods such as GitHub, Google, LinuxDo, OIDC, or WeChat;
  • contact support, submit appeals, request refunds, or report security issues;
  • otherwise interact with the Service.

This Policy does not apply to third-party websites, third-party model platforms, third-party payment processors, third-party identity providers, or applications you independently control. When you use third-party services through the Service, their own privacy policies and terms may also apply.

3. Information We Collect

We may collect the following categories of information:

3.1 Account and Identity Information

  • email address;
  • password (processed and stored securely; not stored in plaintext);
  • username, avatar, and related account profile information;
  • account identifiers, email, nickname, avatar, or similar information returned by third-party login providers, depending on the login method used and the information provided.

3.2 Usage and Device Information

  • IP address;
  • User-Agent;
  • browser, device, operating system, language, timezone, and similar technical information;
  • login timestamps, authentication events, access logs, and security logs;
  • session identifiers, authentication state, local preference settings, and Service configuration state.

3.3 Chat Mode Content

When you use chat mode, we store chat-related content in order to provide conversation history, context continuity, message retrieval, operational troubleshooting, and related features. This may include:

  • prompts and message content;
  • uploaded content, images, attachments, and related context;
  • model, session, response, and related metadata.

3.4 API Call Information

When you use the Service through user API keys:

  • we do not store, review, or use your API request bodies or response bodies for unrelated business purposes;
  • however, we may record necessary technical and billing metadata, such as:
    • request timestamps;
    • paths, models, platforms, group or routing information;
    • token counts, image counts, cache information;
    • error codes, latency, time-to-first-byte/time-to-first-token;
    • usage, billing, risk-control, and troubleshooting logs.

3.5 Payment and Order Information

If you purchase, top up, subscribe, or request a refund, we may receive and store:

  • order numbers, product information, amounts, currencies, and payment status;
  • subscription status, renewal status, cancellation status, and refund status;
  • invoice, receipt, and transaction reference data;
  • information reasonably necessary for fraud review, dispute handling, and chargeback handling.

We do not store full payment card numbers in our own systems.

Payment information is typically processed by third-party payment providers, which may include:

  • Creem;
  • NOWPayments;
  • other payment processors or wallet providers we may add in the future.

Those providers process billing and payment information under their own policies.

3.6 Support and Appeal Information

When you contact support, request a refund, file an appeal, or report a security issue, we may collect:

  • your contact information;
  • your support request or description of the issue;
  • account, order, log, dispute, or risk-review context reasonably necessary to investigate the matter;
  • communications between you and us.

4. How We Collect Information

We may collect information:

  • directly from you, such as when you register, log in, pay, chat, upload content, or contact support;
  • automatically when you use the Service, such as logs, device information, IP address, authentication records, and usage records;
  • from third-party identity providers when you use OAuth or similar sign-in methods;
  • from payment processors or order systems when purchases, subscriptions, or refunds occur;
  • through internal processing necessary to provide features, billing, security, risk controls, and troubleshooting.

5. How We Use Information

We may use your information to:

  • create, manage, and protect your account;
  • provide chat features, history, dashboard functions, and API services;
  • process payments, top-ups, subscriptions, cancellations, refunds, and reconciliation;
  • measure usage, generate billing, and enforce service rules;
  • detect, prevent, and handle fraud, chargebacks, abuse, security incidents, and suspicious activity;
  • provide customer support, review appeals, investigate disputes, and improve the user experience;
  • maintain, monitor, debug, and improve the performance and reliability of the Service;
  • comply with legal obligations, tax obligations, regulatory requests, or lawful investigations;
  • send service notices, security notices, billing notices, and updates to our terms or policies, where permitted by law.

Where applicable law requires us to identify a legal basis for processing, those bases may include:

  • performing a contract with you;
  • complying with legal obligations;
  • pursuing our legitimate interests, such as security, fraud prevention, billing, operations, and support;
  • your consent, where required.

6. Privacy Difference Between Chat Mode and API Mode

To avoid confusion:

Chat Mode

In chat mode, we store chat-related content and metadata in order to provide conversation history, context continuity, and related product features.

API Mode

For user API key calls, we do not store your API request bodies or response bodies locally, and we do not review or use that content for unrelated business purposes.
We may still record technical metadata and logs necessary for billing, stability, security, fraud prevention, and troubleshooting.

Remote Control (Mobile App and the Agent on Your Computer)

When you use the mobile app to control an Agent on your computer remotely, session content between the app and your computer is end-to-end encrypted: it is encrypted on your devices, and the keys needed to decrypt it are held by your devices, not by us. RABAH’s remote relay only stores and forwards the encrypted data and cannot read that session content.
The following is not covered by end-to-end encryption and we may process it: account information, device and session identifiers, connection status, and timing, which we use to establish connections and to keep the service stable and secure.
Please note that end-to-end encryption covers only the link between the mobile app and your computer. When your Agent calls a model from your computer, the request is sent through the RABAH API and is governed by “API Mode” above. Chat mode content is not end-to-end encrypted.

7. How We Share Information

We do not sell your personal information as part of a data-broker business.

We may share necessary information in the following circumstances:

7.1 Service Providers and Infrastructure Partners

We may share information with service providers that help us operate the Service, such as:

  • hosting, server, cloud, and database providers;
  • identity and authentication providers;
  • security, logging, monitoring, or support vendors;
  • providers involved in payment, order, tax, and reconciliation workflows.

7.2 Payment Partners

When you make a purchase, top up, subscribe, request a refund, or enter a payment dispute flow, related information may be shared with:

  • Merchant of Record or payment providers such as Creem;
  • cryptocurrency payment providers such as NOWPayments;
  • other payment channels or wallet providers we may add in the future.

7.3 Upstream Model and AI Providers

When you use chat features or API features to access third-party models, your request content may be transmitted to the actual upstream model or AI provider necessary to fulfill that request.

Those third parties may process data under their own rules and policies, so you should independently assess the risk of using such services.

We may disclose necessary information:

  • to comply with law, court orders, regulatory requirements, or lawful government requests;
  • to investigate fraud, chargebacks, money laundering, sanctions issues, abuse, security incidents, or violations of our terms;
  • to protect the rights, property, and safety of Rabah, our users, payment partners, upstream providers, or the public.

7.5 Business Transfers

If we are involved in a merger, acquisition, asset sale, financing diligence, or similar transaction, personal information may be disclosed or transferred as part of that process, subject to appropriate confidentiality and legal handling requirements.

8. International Transfers and Storage Locations

Your information may be stored and processed in:

  • Hong Kong;
  • the United States;
  • and other locations necessary for third-party processing or service delivery.

Because our servers, databases, payment partners, authentication providers, and upstream model providers may operate in different jurisdictions, your information may be transferred across borders.

By using the Service, you understand and agree that information may be transferred to and processed in those locations as necessary to provide the Service, process payments, fulfill requests, route API traffic, and maintain security and reliability.

9. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including:

  • account information during the life of your account;
  • chat history while you continue to use chat features, until you delete relevant content, delete your account, or we remove it for operational reasons;
  • usage logs, error logs, security logs, and risk-control records for a reasonable period for billing, abuse prevention, disputes, and troubleshooting;
  • order and transaction records for as long as required by law, tax, accounting, audit, payment, or dispute obligations.

When information is no longer needed, we will delete, anonymize, or de-identify it where reasonably practicable, unless we are required to retain it by law.

10. Your Rights and Choices

Depending on your location and applicable law, you may have rights to:

  • access your personal information;
  • correct inaccurate information;
  • delete your account and related personal information;
  • object to or request restriction of certain processing;
  • request a copy of certain information we hold about you;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a regulator where applicable.

You may currently exercise some of these rights by:

  • reviewing and editing certain account information in your account settings;
  • using account deletion features when available in your version of the Service;
  • contacting support for data export requests, manual deletion requests, appeals, or related assistance at: support@rabah.ai

To protect account security and prevent fraud, we may need to verify your identity before fulfilling a request.

11. Cookies, Local Storage, and Similar Technologies

We may use cookies, local storage, session storage, or similar technologies to:

  • keep you signed in;
  • remember language, interface, and security preferences;
  • support payments, authentication, fraud prevention, and session continuity;
  • keep the website and dashboard functioning properly.

If you disable these technologies, some features may not work correctly.

12. Security Measures

We use reasonable technical, organizational, and administrative measures to protect personal information, including access controls, credential handling, audit logging, security hardening, and anomaly monitoring.

However, no internet transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee that information will never be accessed, disclosed, altered, or destroyed by unauthorized parties.

If a significant security incident affects personal information, we will respond and notify affected parties as required by applicable law.

13. Children

The Service is not designed for children. Where applicable law requires a minimum age to consent, you should not use the Service unless you meet that age requirement.

If we learn that we collected personal information from a child without appropriate authorization, we will take reasonable steps to delete that information.

The Service may contain links to third-party websites, documentation, payment pages, identity pages, or model service pages. We are not responsible for the privacy practices of those third parties.

When you access or use those services, you should review their own privacy policies and terms.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions may be posted on the website, in the dashboard, on legal pages, in announcements, or through other reasonable notice mechanisms, and will become effective on the updated date shown above.

If the changes are material, we will make reasonable efforts to provide more prominent notice.

Your continued use of the Service after an updated Privacy Policy takes effect constitutes acceptance of the updated Policy.

16. Contact Us

If you have questions about this Privacy Policy, your personal information, deletion requests, export requests, security issues, or complaints, contact us at: