RateLoop privacy notice

Last updated: 8 October 2026

Controller

Hawig Ventures UG (haftungsbeschränkt), Herzogin-Juliana-Straße 7, 55469 Simmern, Germany. Contact: hello@rateloop.ai.

RateLoop acts as controller for accounts, security, billing, and service operations. For personal data in private material that a business customer submits and controls, RateLoop generally acts as that customer's processor under the Data Processing Addendum. The role depends on the actual purpose and means of each processing activity.

Service data

The service stores workspaces, projects, frozen evaluation manifests, reviewer policies, assignments, responses, access events, and operational identifiers. Customer artifacts are encrypted before private object storage; database rows keep opaque object references and tenant-scoped metadata. Assigned reviewers receive short-lived leases only for their blinded cases. The site does not use advertising or cross-site profiling.

Each customer artifact has its own random data-encryption key. In the current deployment, designated private fields and artifact keys are protected by purpose-separated, server-only application keyrings and an authenticated envelope-encryption boundary. Authorized RateLoop workloads can decrypt covered data when needed to provide the service. Hosted artifact wrapping derives workspace/project keys from a versioned root in Vercel's server-only secret store. This is application-managed encryption, not a customer-held-key or non-exportable hardware-security-module boundary. Key inventory, rotation and rewrapping, recovery, least-privilege access tests, and the DPIA must be complete before real customer material is accepted.

Rating AI

When a workspace owner enables Rating AI and grants inference permission, RateLoop stores the case in its workspace service and sends the source, proposed reply, and evaluation question to a RateLoop-operated evaluator, hosted on Railway in Amsterdam or run on a connected device. The evaluator returns an advisory rating. The Rating AI workflow does not send case content to an external AI model provider. In this Alpha, submit only public, synthetic, or safely redacted material.

Permission to rate does not permit training. Tenant-private learning and shared model improvement require separate, purpose-specific authorization and eligible data. Company permission does not replace individual rights or a lawful basis for personal data. Withdrawing permission prevents future authorized use; removing the influence of an already trained example requires retiring or retraining affected versions. Operational security telemetry is separate from model training.

Chat and API generation

When authorized workspace users choose hosted Chat, or an agent uses the owner-authorized generation API, RateLoop sends the submitted prompts, messages and system instructions to Vercel AI Gateway and its routed model provider to generate text with the configured OpenAI model. Chat includes selected conversation history. This external generation path is separate from Rating AI. Provider roles, locations, retention, training restrictions and transfer safeguards depend on the actual routing configuration and agreements; the web hosting region does not establish them. Alpha use remains limited to public, synthetic or safely redacted material.

Optional online source checks send the selected answer and its review context through Vercel AI Gateway to the configured OpenAI model and its web search, only after explicit permission. This feature is unavailable with local drafting or local ratings. Reports are stored with Chat and included in its access and deletion controls. The Alpha restriction to public, synthetic or safely redacted material still applies.

Purposes and legal bases

RateLoop processes account, workspace, assignment, response, and delivery data to perform the service and the applicable contract; security and abuse signals to protect accounts, reviewers, customers, and the service on the basis of legitimate interests; and billing, tax, dispute, and statutory records where a legal obligation applies. Optional notification email is enabled at the user's request and can be disabled or unsubscribed. RateLoop does not use personal data for advertising or cross-site profiling.

Browser users sign in through RateLoop's self-hosted Better Auth service using an email one-time code or a registered passkey. Google and Apple are offered only when their credentials are configured. Better Auth and the selected email or social provider process the authentication data needed for that sign-in. RateLoop maps the provider subject to an opaque RateLoop principal, then exchanges the short Better Auth session for its own hashed, time-limited, HttpOnly application session. An email address or domain alone never grants workspace membership or project access.

Each sign-in session record stores the IP address and the user agent of the device that created it, next to the session identifiers, the sign-in method, and the session lifetime. RateLoop keeps them to recognize session theft and abuse, on the basis of its legitimate interest in account security; they are not used to profile, locate, or advertise to anyone. They are deleted with the session record under the 35-day schedule described below.

Subscription billing

When a business purchases or manages a workspace subscription, Stripe processes payment-card details, billing address, tax or VAT identifiers, invoice identity, payment status, and related fraud-prevention data under its own privacy terms. RateLoop stores the workspace's Stripe customer and subscription identifiers, plan, subscription status, billing period, cancellation state, webhook processing records, and decision-usage allocations. RateLoop does not store full card details.

Demo scheduling

The public pages link to an external scheduling service for booking a demo. RateLoop places the link only; the page itself loads nothing from the scheduling provider and sets no browser storage for it. Selecting it opens the provider's own booking page in a new tab, identified by the destination address, and everything entered there is collected by that provider under its own privacy terms rather than by RateLoop. That typically includes a name, an email address, any answers to the booking questions, and the chosen time; the provider may process it outside the European Economic Area. No RateLoop account is created or required, and the booking page is reachable by anyone holding the link. RateLoop receives the resulting appointment and its contact details as a calendar entry and email, and processes them under its legitimate interest in responding to a commercial enquiry. Writing instead to the enterprise contact address avoids the scheduling provider entirely.

Reviewer forecast integrity

When a terminal review includes a crowd forecast, RateLoop uses aggregate forecast counters to measure calibration and detect repeated low-effort or lockstep reporting. The service keeps running sums for calibration, variance, outcome and vote discrimination, plus workspace-level forecast histograms and pair-distance sums. It does not retain a per-person, round-by-round forecast history. After a private result is aggregated, the individual forecast is removed from the private response row.

Invited-review counters use a server-keyed reference scoped to the principal and workspace. Identifiable reviewer analytics run only when the workspace has recorded the applicable controller and processor roles, lawful basis, necessity assessment, worker notice, retention and access rules, impact assessment, data-subject process, and works-council position. A finding never changes the verdict, future assignment, or access; the reviewer can inspect and contest it.

Recipients, processors, and international transfers

RateLoop uses service providers for hosting, database/runtime operations, email, billing, and configured sign-in providers. The current categories, named providers, feature conditions, and change-notice process are listed on the subprocessor page. Where covered data is transferred outside the EEA, RateLoop uses an applicable adequacy decision or contractual transfer safeguards and supplementary measures as required.

Retention and rights

Workspace and project retention settings control private artifact deletion and access logging. Subscription cancellation does not override an agreed evidence-retention setting or erase records required for audit, dispute handling, accounting, legal holds, or statutory retention. A workspace owner can delete a workspace in the product once its subscription, open work, and billing obligations are resolved. A signed-in user can delete their account once accepted work is resolved. Their own workspace is deleted with it unless it has other members, open work or an active subscription. Deletion revokes access and erases or anonymizes eligible account and workspace data; retained categories remain subject to their applicable purpose and schedule.

RateLoop temporarily retains a revoked sign-in binding for 35 days to prevent an in-flight sign-in from recreating a deleted account. Expired or revoked session and sign-in security telemetry, including the IP address and user agent held with a session record, is purged on a rolling 35-day operational schedule enforced by a maintenance job that runs every five minutes; terminal notification-delivery records are purged after 90 days. Generated subject-access exports expire after seven days. Statutory accounting, tax, fraud, dispute, and legal-hold records follow their documented legal schedule and can remain restricted rather than erased while that duty applies. When a workspace authorizes identifiable reviewer analytics, its governance record freezes a machine-readable retention period. A scheduled job then removes dormant linkable forecast accumulators, pair records, findings, and appeals at that deadline and records only person-free purge counts; eligible rows are also erased with account or workspace deletion. A later sign-up starts a new account. Backup copies expire under the applicable backup schedule.

Private Rating AI learning inputs and shared-learning selections are kept for at most 30 days, private routing learning features for 90 days, and generation API requests and answers for 24 hours so an identical retry receives the same answer.

You may request access, correction, deletion where available, restriction, portability, or object to processing, and may withdraw consent for future processing where consent is the basis. Signed-in access and export requests enter an authenticated queue; completed exports are available only to the requesting principal for seven days. Other requests and questions may be sent to the controller address above. RateLoop normally responds within one month, subject to lawful extensions, identity verification, legal holds, and retention duties. You may complain to the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz or another competent supervisory authority.

Cookies and local storage

RateLoop does not load audience analytics and does not set advertising cookies. It uses first-party authentication cookies and limited browser storage for requested functions such as review drafts and a remembered integration choice. Details and lifetimes are in the cookies and browser storage policy. The privacy-enhanced YouTube player is contacted only after a user chooses to play an attached video.