1. Who we are and what this Policy covers
This Privacy Policy explains how Rilke (“Rilke”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you use our website, the Rilke dashboard, your Rilke agent and related services (together, the “Service”).
The personal information controller for the information described in this Policy is Rilke, operated from the Philippines. You can reach our data protection contact at franco@tgifranco.com.
Information about other people. Your agent may handle personal information about people other than you — your clients, colleagues or contacts. For that information you are the controller and we are your processor; we handle it only on your instructions, as set out in Section 10 of our Terms of Service. This Policy still describes how such information is protected, stored and kept.
This Policy does not cover third-party services you connect to your agent or use alongside it (such as your messaging app); their own privacy policies apply.
2. Information we collect
Information you give us
- Account information: your name, email address and password (stored only in protected, hashed form), the name you give your agent, your plan and subscription status, and payment confirmations.
- Conversations: the messages you send your agent and the replies it gives, whichever channel you use. Your dashboard keeps a mirror of this history.
- Files and content: files, images and other content you send your agent or ask it to create, which are kept in your agent’s workspace.
- Memory: the notes your agent keeps about you and your work so that it does not have to be told twice. You can see and remove them on the Memory page.
- Scheduled tasks you set up, and the instructions they contain.
- Connected accounts: when you connect a third-party app, we receive the access token the provider issues and the data your agent retrieves or sends through that connection when carrying out your requests. If you give your agent an API key, we hold the key in a vault outside your agent.
- Communications with us: emails and messages you send us, and our replies.
Information we collect automatically
- Log data: your IP address, browser type and settings, device information, the pages you visit and the time of each request, collected when you use the website or dashboard.
- Usage and audit records: which features you use and when, and a record of actions taken on your account and by your agent — for example that a file was uploaded, an app was connected or a scheduled task ran. Audit records note that an action happened; they do not copy its content.
- Cookies: we use only the cookies needed to keep you signed in (Section 11).
Information from third parties
- From your messaging platform: when you link your agent to Telegram we receive the identifier of your chat and the profile details Telegram shares with bots (such as your first name and username), and the messages you send your agent there. We do not receive your other Telegram conversations or contacts.
- From connected apps: the data described under “Connected accounts” above, only through the connections you authorize.
- From payment providers: confirmation that a payment was made, and the details needed to match it to your account. We do not store full payment card numbers.
We do not ask for sensitive personal information (such as health, religion, government ID numbers or biometric data). If you choose to give your agent such information about yourself, we process it only to carry out your request and as described in this Policy.
3. How we use your information
We use personal information to:
- Provide the Service: run your agent, answer you, remember what you have told it, carry out scheduled tasks, work with the apps you connect, and show you your dashboard;
- Manage your account and subscription: verify your email, sign you in, record payments, enforce plan limits, and send you service messages such as payment and subscription notices;
- Keep the Service safe and reliable: detect and prevent abuse, fraud and security incidents, enforce our Terms, and troubleshoot problems;
- Improve the Service: understand how features are used, in aggregate, so we can fix what is broken and build what is missing;
- Communicate with you: respond to your questions, and tell you about changes to the Service or these documents;
- Comply with the law: meet our legal obligations, respond to lawful requests, and establish or defend legal claims.
Our lawful bases. Under the Philippine Data Privacy Act and similar laws elsewhere, we rely on: the contract with you (most of the processing above is simply how the Service works); our legitimate interests in running a secure, reliable service and improving it, where those interests are not overridden by your rights; your consent, where the law requires it — for example when you connect a third-party account or, if we ever send marketing, before we do; and legal obligations, such as keeping billing records.
No automated decisions with legal effect. Your agent generates its responses automatically, but we do not make decisions about you that have legal or similarly significant effects solely by automated means.
No marketing without your say-so. We do not currently send marketing emails. If that changes, we will ask first where the law requires it, and every such message will include a way to opt out.
4. How your agent processes your information
AI model providers. To answer you, your agent sends the relevant parts of your conversation — including recent messages, the memory notes and files it needs, and any images you share or ask it to create — to third-party AI model providers, which generate the response. Each request carries only what is needed to answer it. Those providers process the data to provide the model service to us, under their own terms; we choose providers and settings intended to prevent your content from being retained longer than necessary or used to train their models, and we do not use providers that we know to do so.
We do not train AI models on your content. We do not use your conversations, files or memory to train or fine-tune any AI model, and we do not sell them or share them for advertising.
Web search and browsing. When your agent searches the web, the search query is sent through our own search service to public search engines. When it opens a web page for you, that page’s operator sees the request as it would any visitor. Do not ask your agent to search for or visit anything you would not want a search engine or website to see.
Connected apps and email. When you ask your agent to read from or write to a connected app, or to send an email from the address we give it, the data involved goes to that app or recipient at your direction. Once it is there, it is governed by that service’s terms.
Your agent works alone. Every customer’s agent runs in its own isolated environment on its own private network, with its own storage and its own spending allowance. No customer’s agent can see another’s conversations, files, memory or connected accounts.
5. Your controls
Your dashboard gives you direct control over most of what your agent holds:
- Memory — the Memory page lists what your agent has remembered about you and your work. You can remove any of it.
- Files — the Files page lists everything in your agent’s workspace. You can download or delete any file.
- Apps — the Apps page shows the accounts you have connected. You can disconnect any of them, and you can also revoke access from the provider’s own account settings.
- Connections — if you gave your agent an API key, deleting the connection revokes it immediately.
- Scheduled tasks — you can pause or delete any task you set up.
- Subscription — you can cancel from the Settings page; see Section 8 for what happens to your data afterwards.
For anything you cannot do from the dashboard — a copy of your data, deleting your whole account, correcting account details — email franco@tgifranco.com (Section 10).
7. Where your information is stored and international transfers
Our primary servers are in Southeast Asia (currently Singapore and Malaysia). Some of our service providers — including AI model providers, hosting and app-connection services — process information in the United States and other countries. Your information may therefore be stored and processed outside the country where you live, including outside the Philippines.
Wherever it is processed, we remain responsible for your information under the Philippine Data Privacy Act and apply the protections in this Policy. We transfer information only to providers bound by contractual commitments to protect it, and where the law of your country requires a specific transfer mechanism (such as standard contractual clauses under the GDPR), we rely on one.
8. How long we keep information
We keep personal information only for as long as we need it for the purposes above, and then delete or anonymize it:
- While your account is active, your conversations, files, memory, scheduled tasks and connected accounts are kept so your agent can do its work, subject to the controls in Section 5.
- For 90 days after your subscription ends, everything your agent holds is preserved so you can come back and pick up where you left off. After that it is scheduled for deletion.
- Sooner if you ask. Email us and we will delete your account and its data, subject to the exceptions below.
- Account, billing and payment records are kept for as long as tax, accounting and consumer-protection law require after the last transaction.
- Operational logs and audit records are kept for as long as needed for security, troubleshooting and to demonstrate compliance, then deleted or anonymized.
- Longer where the law requires it, or where information is needed to resolve a dispute, investigate abuse or enforce our Terms. When you ask us to delete your data, we keep a record of the request itself so we can show that we honored it.
9. Security and breach notification
We protect personal information with organizational, physical and technical safeguards appropriate to the risk, including: isolating every customer’s agent in its own environment and private network; keeping connected-account credentials and API keys in a vault your agent cannot read; encrypting information in transit; restricting access to systems and data to those who need it; and keeping audit records of sensitive actions. We test the Service against misuse, including attempts to trick an agent into revealing information or acting against its owner’s interests.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please choose a strong password, keep your messaging account secure, and tell us at once if you suspect a problem.
If a personal data breach occurs that is likely to put your rights or freedoms at real risk, we will notify the National Privacy Commission and the people affected within 72 hours of becoming aware of it, or as otherwise required by the law that applies to you, and tell you what happened, what information was involved and what we are doing about it.
10. Your rights
Under the Philippine Data Privacy Act of 2012, and under similar laws in many other countries, you have the right to:
- Be informed about how your personal information is collected and processed — which this Policy is meant to do;
- Access the personal information we hold about you, and learn how it has been processed, its sources, the recipients, and how long it is kept;
- Correct inaccurate or incomplete information;
- Object to processing, including for direct marketing or profiling, and to processing based on legitimate interests where your situation warrants it;
- Erase or block your information where it is incomplete, outdated, unlawfully obtained, no longer necessary, or where you withdraw consent;
- Data portability: receive a copy of the information you provided in a commonly used electronic format;
- Withdraw consent at any time where we rely on it, without affecting processing that already took place;
- Be indemnified for damages you suffer from inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal information, as provided by law;
- Complain to a supervisory authority — in the Philippines, the National Privacy Commission (privacy.gov.ph) — or to the data protection authority where you live.
How to exercise them. Email franco@tgifranco.com from the address on your account, or tell us how to verify that you are who you say you are; we have to check before acting on a request. We respond within 30 days, or sooner where the law requires, and we will tell you if we need more time. Where we cannot act on a request — for example because the law requires us to keep the information — we will explain why. We will not charge a fee unless a request is clearly excessive, and we will never treat you differently for exercising your rights.
If the information concerns you but was given to us by one of our customers (for example, you are a customer’s client), you may still contact us; we will refer your request to that customer where appropriate and help them respond.
12. Children
The Service is for adults and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email franco@tgifranco.com and we will delete it.
13. Third-party platforms and links
Telegram. Your conversation with your agent travels through Telegram, whose own privacy policy governs your Telegram account and its handling of your messages.
Google. If you connect a Google account, Rilke’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you ask your agent to perform, never for advertising, and we do not sell it or allow humans to read it except with your consent, for security purposes, or as required by law.
Other connected apps are governed by their providers’ privacy policies, which you should review before connecting them.
Links. The Service and your agent’s output may contain links to other websites. We are not responsible for their privacy practices.
14. Changes to this Policy
We may update this Policy from time to time. When we do, we will post the new version here with a new “Last updated” date. If a change materially affects how we use your personal information, we will tell you by email or in the dashboard before it takes effect, and ask for your consent where the law requires it.
15. Contact us
Privacy questions, requests and complaints: franco@tgifranco.com. General support: franco@tgifranco.com.
If you are in the Philippines and are not satisfied with our response, you may contact the National Privacy Commission at privacy.gov.ph.