Privacy policy

• Your account: your name, email address, a hashed copy of your password, your company if you give it, and your role in each workspace.
• Billing: your plan, its status, your billing country and the record of your payments, which our payment partner sends us. Your card details go to the payment partner, never to us.
• What you put into Rext AI: keywords, your brand profile (read from your website when you create a workspace), author personas, instructions, uploaded files, outlines and articles.
• Connections: your WordPress site's address and the key from the Rext AI plugin, which we store encrypted.
• Security and usage records: sign-ins and sessions, the actions recorded in your account's audit log, IP addresses, browser details and error reports.
• On rext.ai: the pages you visit, what you click, how far you scroll and the errors your browser meets, as measured by PostHog and Microsoft Clarity (see the cookie policy); your cookie choice; and the text you enter in a free tool, which is sent to our servers and our AI provider to produce the result. If you later create an account from the same browser, PostHog links those visits to it, so that we can see what led to a sign-up.
• How you use the app: the screens you open, the steps you take (creating a workspace, the steps of writing an article, publishing, checkout) and where on a page you click, as positions only, as measured by PostHog and tied to your account's ID, your role and your plan, never to your name or email address. In the EEA, the UK and Switzerland this happens only if you say yes when the app asks, and after a no the app only counts page views, with no identity; elsewhere it is on unless you switch it off in the app's settings. Our servers also send PostHog events about plans and payments (the plan and the amount, never who).
• Recordings of some visits to rext.ai: PostHog's session replay records a share of visits (the pages, your clicks, your scrolling and the pointer's movement), so that we can see where the site is hard to use. What you type is never in a recording: every field is hidden before the recording leaves your browser, and the free tools, our forms and the support chat are left out whole. A visit is recorded only where PostHog's cookie is in use, and never after you decline. Microsoft Clarity records visits and their heatmaps as well, under the same choice.
• Recordings of sessions in the app: where you allow analytics in the app, PostHog may also record your sessions on the app's working pages, never on the sign-in, sign-up, password, invitation or checkout pages. In such a recording everything you type is hidden, and so is every text on the page except the app's own fixed words (its buttons, menus and labels); pictures and the support chat are left out whole.
• When you write to us or sign up: the newsletter address you give, what you send through a form, by email or in the support chat, and the details you enter when booking a demo through Calendly.

We send messages about your account, security and billing because they are part of the service. We do not sell personal data, and we do not use it for targeted advertising.

A few companies process data on our behalf: Hetzner (our servers and databases), OpenAI (writing and images), Tavily (web research), DataForSEO (search results and keyword data), LangSmith (records of each writing run, for fixing problems), Sentry (error reports), Resend (account email), Lemon Squeezy (payments, as the merchant of record), Vercel (hosting rext.ai), PostHog (analytics for rext.ai and the app), Brevo (the newsletter), Crisp (the support chat) and Calendly (demo bookings).

Microsoft, which runs Clarity, is not one of them: Clarity collects and uses the recordings as a controller in its own right, under its own privacy statement, which also says how to reach Microsoft about them.

The data processing addendum lists what each one does and what data it handles.

Apart from the companies above, we share personal data only when you ask us to (for example, when Rext AI publishes an article to your WordPress site), when the law requires it, to protect people or the service from harm or fraud, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

Some of these companies are in the United States, and our servers may be in the EU. Where personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses or the company's certification under the EU-US Data Privacy Framework.

• Your account and the content in it: for as long as the account exists. When you delete your account, it is anonymized within 14 days.
• The working records of each writing run: 3 days.
• Your account's audit log: 365 days. Error reports: 90 days. Email delivery records: 30 days.
• Billing records: as long as tax and accounting law requires.
• Support chat conversations, and the IP address Crisp stores with each: until we delete the conversation. We delete it when you ask us to (see “Your rights over your data”).
• Analytics on rext.ai and in the app: recordings, 30 days. What PostHog measures (pages viewed, clicks, steps taken, errors), up to 7 years unless we delete it sooner.
• Clarity's recordings: 30 days; recordings labeled, favorited or kept in Clarity's own sample, and its click and heatmap data, up to 9 months.
• Deleted data can remain in backups for a limited time before they are overwritten.

Depending on where you live, you can ask us to show you the personal data we hold about you, correct it, delete it, limit or object to how we use it, or give you a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time. You can delete your account yourself in the app.

To use a right, write to contact@rext.ai from the email address on your account. We may need to confirm it is you, and we answer within one month. If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority.

California residents have the rights above, and we do not sell or share personal information for cross-context advertising. Our site does not respond to browsers' Do Not Track signals; you can turn analytics off with “Cookie settings” at the bottom of every page.

The cookie policy lists every cookie the site sets, what it is for and how long it lasts.

The security page describes what we do to protect your data, and what we do not have yet.

Rext AI is for businesses and professionals and not for anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

When this policy changes, the date at the top changes too. If a change matters to you, we tell you by email or in the app before it takes effect.

Revnix LLC, for Rext AI
Email: contact@rext.ai