What we collect
- Account details: your name, email address, workspace name and a hashed password.
- Sign-in sessions: the browser, approximate IP address and time of each session, so you can see and end them in Settings.
- What you create: projects, deployments and their logs, environment variables, databases, domains, email templates and sending logs, WhatsApp numbers, contacts and messages, and support tickets.
- Usage: build minutes, emails, social notifications and bandwidth, so we can show your usage and apply your plan.
- Domain contacts: the owner details you enter when you buy a domain, which registries require.
How we use it
- To run the service: build and host your apps, send your email and messages, and keep your workspace secure.
- To apply your plan and show your usage and bills.
- To answer support tickets and send emails you asked for, like deploy failures and replies. You can turn these off in Settings → Notifications.
- To send occasional product updates, which you can also turn off.
What we don’t do
- We don’t sell your data.
- We don’t use advertising or tracking cookies.
- We don’t read your data except to run the service, to answer a request from you, or where the law requires it.
AI tools you connect (MCP)
- You can connect AI tools such as Claude, ChatGPT or Cursor to your workspace through the Rimbra MCP server at app.rimbra.app/mcp, by signing in or with a key you make under MCP in the dashboard.
- A connected tool works only in the workspace you choose, with the access you choose (Developer or Viewer), and never more than your own role. It can't pay for anything, buy domains, or change billing or your team.
- It sees what you could see with that access, such as projects, logs, variable names (never secret values), databases, domains, your team and sent emails, and it can act on them, for example deploying or sending an email you asked for.
- What the tool does with that data is covered by the AI provider’s own terms. Rimbra keeps what the tool creates or changes in your workspace like anything else you create, and records each action it takes in our security logs.
- Disconnect any tool or key at any time under MCP in the dashboard. Access stops immediately.
Cookies
We use essential cookies only: one to keep you signed in and keep your account secure. Your cookie choice is remembered in your browser.
Who else handles it
We use a small number of providers to run Rimbra, such as our server hosts, an email delivery service and domain registrars. They process data only to provide their service to us. Domain owner details are passed to the registry for the domain you buy, as registration requires.
Keeping it safe
Passwords are hashed, secrets such as API keys are shown only once, and access to production systems is limited. No system is perfectly secure, so please use a strong password and keep your keys on your server.
Your choices
- Download a copy of your workspace data from Settings.
- Change your email, password and notification settings any time.
- Ask us to delete your account and data by writing to support@rimbra.app.
How long we keep it
We keep your data while your account is open. When a workspace is deleted, its data is removed from our systems, apart from what we must keep for legal or billing reasons.
Changes
If we change this policy in a meaningful way, we will tell you by email or in the dashboard before it takes effect.
Contact
Questions about privacy? Write to legal@rimbra.app.