1. Who we are
Rempa AI ("Rempa", "we") publishes rempa.ai and the Rempa application at app.rempa.ai, a service that measures how AI assistants and AI search engines talk about brands. Rempa AI is the data controller for the personal data described in this policy. You can reach us at contact@rempa.ai.
Our servers are hosted by OVH in Roubaix, France, in the European Union.
2. The data we collect
When you visit rempa.ai
Technical data sent by your browser (IP address, browser and device type, pages viewed, referring site) and analytics data described in the cookies section. If you use the contact form, we collect the name, email address, company and message you enter, so we can answer you.
When you create an account
Your email address, and your name when you sign in with Google. We send you a one-time sign-in code by email; we never store a password. We also keep your sign-in dates, the IP address and browser of each session, for security.
When you use the application
The data you enter to configure your projects: brand names and websites, competitors, markets, topics and prompts. The AI answers we collect for you, with the brands, sources and sentiment detected in them. Your plan and the features you use.
This data describes brands and companies, not individuals. We ask you not to enter personal data about other people in prompts or brand names.
When you subscribe
Payments are handled by Stripe. We never see or store your card number. We keep your Stripe customer and subscription identifiers, your plan, your billing period and the status of your subscription. Stripe collects the billing details it needs (name, address, VAT number if you give one) under its own privacy policy.
When you use the API or the MCP connector
The API keys you create (stored hashed), the AI assistants you connect through OAuth, and when each is used.
3. How we use it
- To provide the service (performance of our contract with you): run your prompts on the AI engines you selected, store and show the results, bill your subscription, answer your requests.
- To keep the service secure and reliable (our legitimate interest): sign-in codes, session logs, rate limits, backups, monitoring of failures.
- To improve the product (our legitimate interest, or your consent where the law requires it): understand which pages and features are used, through the analytics tools listed below.
- To tell you about Rempa: emails about your account and your tracking, and, with your consent, news about the product. You can unsubscribe from the latter at any time.
- To comply with our legal obligations: accounting and tax records for invoices.
We do not sell personal data, and we do not use your brand data to train AI models.
4. Who we share it with
We work with service providers who process data on our behalf, under contracts that bind them to this purpose:
- OVH (France): hosting of our servers, databases and backups.
- Stripe (Ireland / United States): payments and invoices.
- Bright Data, DataForSEO and SerpApi: collection of the public answers of AI assistants and search engines for the prompts you configure, and of Google search volumes. They receive the text of your prompts and the market, never your account details.
- AI model providers (such as OpenAI, Google, Perplexity, DeepSeek, Alibaba Cloud): when a project asks a model through its API, the prompt is sent to that provider. The AI answers are also analyzed by an AI model to score the sentiment about each brand; that model receives the answer text and the brand names, not your account details.
- PostHog (hosted in the European Union): product analytics and session replay in the application, see the cookies section.
- Google (Tag Manager, Analytics, Ads) and Contentsquare: audience measurement and advertising measurement on rempa.ai.
- Our email provider: sign-in codes and transactional emails.
Some of these providers are located outside the European Union. When that is the case, transfers rely on the European Commission's adequacy decisions or its standard contractual clauses.
We may also disclose data when the law requires it, or to protect our rights and the security of the service.
5. Cookies and analytics
Cookies needed for the service
On app.rempa.ai, a session cookie keeps you signed in and a security cookie protects forms against forgery. They are strictly necessary and require no consent.
Analytics
- PostHog (EU servers) measures page views and clicks on rempa.ai and in the application. In the application, PostHog is linked to your account (email and plan) and may record your session so we can understand how the interface is used; everything you type is masked in these recordings.
- Google Analytics, loaded through Google Tag Manager, measures the audience of rempa.ai. Google Ads measures signups coming from our advertisements. Contentsquare analyzes how pages of rempa.ai are used.
You can block these tools with your browser's settings or a content blocker; the site and the application keep working. We honor the Global Privacy Control signal where our tools support it. Write to us if you want your analytics data deleted.
6. How long we keep it
- Account and project data: for as long as your account exists, then deleted within 30 days of its closure. You can delete a project at any time from its settings.
- AI answers and results: for as long as the project exists, so you can follow your visibility over time.
- Session logs and security data: 12 months.
- Invoices and billing records: 10 years, as required by French accounting law.
- Contact form messages: 2 years after our last exchange.
- Analytics data: according to each tool's settings, at most 14 months for Google Analytics.
- Backups: encrypted daily backups are kept for 30 days.
7. Security
Connections to rempa.ai and app.rempa.ai are encrypted (HTTPS). Sign-in uses one-time codes or Google sign-in, never a stored password. API keys and the keys of our providers are stored hashed or encrypted. Access to production systems is restricted to the people who operate the service. Daily backups are kept on our infrastructure.
8. Your rights
Under the GDPR and French law, you have the right to access your personal data, to correct it, to ask for its deletion, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent at any time. You can also set out instructions on what happens to your data after your death.
Most of your data can be seen and changed directly in the application. For anything else, write to contact@rempa.ai; we answer within one month. If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.
9. Changes and contact
We may update this policy when the service or the law changes. The date at the top tells you when it was last revised; for significant changes we notify account holders by email.
Questions about this policy or your data: contact@rempa.ai, or through the contact page.