Privacy Policy

Information you give us

• Account details: your mobile phone number, and in setup your name, a contact email address, the language you want Rumi to use, and your timezone.
• Business details: if you tell us about your work, the kind of business, its name and website, what you want help with, and the size of your team.
• Channel details: the number you want to use for iMessage or, for Telegram, your bot’s username and the bot token you give us to connect it.
• Payment and subscription details: if you buy a plan, the name and email address on the subscription, the plan, the number of lines, any trial code, and the subscription record (when it started, its status, and payment history). Your card details go to the payment processor that takes the payment; this site does not receive or store them.
• Contact and support: what you send us through the “Talk to us” form (your name, email, which messaging app you use, and what you want Rumi to handle first), by email, or as feedback.

Information you share while using Rumi

• The messages you send Rumi and Rumi’s replies, including voice notes, their transcripts, and spoken replies.
• Photos and files you send, such as a business card you ask Rumi to read, and documents Rumi prepares for you, such as slide decks.
• Notes Rumi keeps about what you have told it, such as your preferences, the people you work with, and work in progress, so it can carry context between conversations; and reminders you set.
• Contacts and follow-ups you add in the dashboard. These can include other people’s names, email addresses, phone numbers, company names, and notes.

Information from accounts you connect

If you connect your Google account, we receive the information the permission you approve makes available. The section “Information from Google” below explains exactly what that is and the limits on how we use it.

Information from other sources

• The messaging apps you use to reach Rumi give us your handle or phone number and the messages you send in your thread with Rumi.
• Our text-message and messaging providers tell us whether a code was delivered, what kind of number you entered, and whether it can receive iMessage.
• The payment processor tells us whether a payment succeeded and the status of your subscription.

Information collected automatically

• Website analytics: which pages are visited, the referring page, and general device, browser, and country information, collected by a privacy-focused analytics tool.
• Logs: our servers and our hosting providers record technical information such as IP addresses, browser type, and the time of a request. Logs from the website keep only part of an email address. Logs on the servers that run Rumi can contain parts of messages.
• Cookies and browser storage: see “Cookies, analytics, and browser signals” below.

Sensitive information

We do not ask for sensitive information, such as health, financial account, or government ID details. But Rumi works with whatever you send it or connect, so it may handle sensitive information you choose to share, for example an email from your doctor in a mailbox you connect. Please do not send Rumi information you do not want it to process. We do not use your voice notes to identify you by your voice.

We use the information we collect to:

• provide the Assistant: understand your messages and voice notes, generate replies and spoken answers, read what you connect in order to answer your questions, remember context you have given, send the reminders you set, and prepare documents you ask for;
• create and run your account, set up your assistant (our team reviews your account and business details to configure it), connect your channels, and send you sign-in codes;
• take payment for a plan, run the trial and subscription, and send receipts, trial and renewal reminders, and notices about price or plan changes;
• communicate with you, including replies to support requests, a welcome message and setup tips, and, if you asked us to keep in touch through the “Talk to us” form, news about Rumi (you can opt out at any time);
• keep the Services secure and working: prevent fraud and abuse, enforce our Terms, and find and fix problems;
• understand how the website and the Services are used, in aggregate, and improve them; and
• comply with the law and protect our rights and the rights of others.

We do not use your information for targeted advertising, and we do not sell it.

Rumi’s understanding comes from AI models provided by third parties that we use under contract. The content Rumi needs in order to answer you, such as your message, a voice note, a photo, or the part of an email Rumi is reading for you, is sent to them for processing, and their response comes back to Rumi. Under our agreements with them, they may not use that content to train their models, and they may keep it only for a limited period, for example to detect abuse. We do not name providers on this page because they can change; ask us and we will tell you who is in the path today.

We do not use your content to train or fine-tune AI models, ours or anyone else’s. We do not use the Services to make decisions about you that have legal or similarly significant effects.

If you connect your Google account, the permission we ask for covers three things: Gmail, read-only (read your messages and their metadata); Google Calendar (see your calendars and events); and adding and removing events on calendars you own. The Gmail permission does not allow sending, deleting, or changing anything. On your calendar, Rumi adds an event only when you ask for one, never adds guests, never sends invitations, and removes only events it added itself; it does not change or remove an event anyone else created. Some older connections may also include read-only access to Google Drive, Docs, Sheets, and Contacts, which Rumi does not use; withdrawing access and connecting again removes it.

We use information from Google only to provide and improve the features you use: answering your questions about your mail and calendar, summarizing messages, adding and removing the calendar events you ask for, and preparing drafts for you to send yourself. Rumi AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy. In particular:

• we do not use or retain it, including in aggregated, anonymized, or derived form, to develop, improve, or train generalized or non-personalized AI or machine-learning models, and the AI providers that process it for us are bound by contract not to do so either;
• we do not use it for advertising, including retargeting, or to determine creditworthiness or for lending, and we do not sell it;
• we transfer it only to the service providers that help us provide the features you use (such as the AI models that process it to answer you), as needed for security or to comply with the law, or as part of a merger or acquisition with notice to you; and
• no person on our team reads it unless you ask us to look at specific messages or data, it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymized for our internal operations.

You can withdraw access at any time in your Google Account’s security settings, or ask us to disconnect it. Withdrawing access stops new information from reaching us. Parts of your mail that Rumi has already read for you remain in your conversation history until you ask us to delete them.

We share personal information only as described here. We do not sell it, and we do not share it for cross-context behavioral advertising.

Service providers

Companies that process information for us under contract and only to provide their services to us:

• AI model providers, which process content to generate Rumi’s responses;
• cloud hosting, storage, and database providers;
• account sign-in and authentication providers;
• the messaging providers that carry your conversations with Rumi, including the service that operates Rumi’s iMessage line;
• text-message and email delivery providers;
• website hosting and analytics providers; and
• the payment processor and the systems that keep subscription records.

Where the payment processor uses card data for its own purposes, such as fraud prevention, it acts as an independent controller and its own privacy notice applies.

Affiliates

Some of our systems, including the account sign-in system and the payment account, are shared with affiliated companies that operate other Rumi-branded products. Their systems therefore receive account and subscription records, such as your phone number or email address and your subscription status. One of them, Rumi Inc, bills and collects payments for the Services on our behalf, and receives the subscription and payment records it needs to do that, such as the name and email address on the subscription, the plan, and the payment history. We share information with affiliates only to operate these shared systems and as this policy otherwise allows.

Messaging platforms and the people you choose

Your conversations with Rumi pass through the messaging app you use, such as iMessage or Telegram, under that company’s own terms and privacy policy. If you reach Rumi through a Telegram bot, this policy is that bot’s privacy policy. When you send a draft Rumi prepared, you share it with its recipient yourself.

Legal, safety, and business transfers

We may disclose information if we believe in good faith it is required by law or legal process; to protect the rights, property, or safety of you, us, or others; to investigate fraud, security problems, or violations of our Terms; to our professional advisers, such as lawyers and accountants, under confidentiality; and in connection with a merger, acquisition, financing, or sale of assets, in which case the information remains subject to this policy’s promises.

Text messaging

We do not sell, rent, or share your mobile phone number or your consent to receive text messages with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third party, except the providers that deliver our messages.

Rumi runs on servers we operate, and the small team that operates the service has technical access to them. We say that plainly because the alternative, that nobody but you could ever see it, would not be true of software running on machines we administer.

Our commitment is that we do not read your messages or the content Rumi retrieves from your connected accounts, except when you ask us for help (and then we tell you what we looked at), when you send us feedback, when it is reasonably necessary to investigate a security incident, abuse, or a violation of our Terms or to keep the Services working, or when the law requires it. Information from Google is subject to the stricter limits in “Information from Google.”

• Sign-in cookie: when you sign in, a cookie keeps you signed in to the dashboard and lets this site confirm your account at checkout. It is needed for the Services to work.
• Browser storage: your browser saves your progress through the get-started and checkout steps on your device, including the email address and any code you type, so that you do not lose them if you leave and come back. You can clear it in your browser settings.
• Analytics: our website analytics measure visits in aggregate. We do not use advertising cookies or tracking pixels, and we do not track you across other websites.

Our website does not respond to Do Not Track signals. Because we do not sell or share personal information for advertising, there is nothing for a Global Privacy Control signal to opt you out of; where the law requires, we treat it as a request to opt out of selling or sharing.

We keep personal information for as long as we need it for the purposes in this policy, and then delete it or keep it only in a form that does not identify you. In practice:

• Conversation history, notes, contacts, and connected-account content are kept while your account is open, so Rumi can carry context. When your plan ends, your assistant stops, but this data is kept, so you can come back, until you ask us to delete it.
• Temporary items are deleted after a short time: for example, a business-card scan after about an hour and a slide deck after about fourteen days.
• Logs are kept for a limited period and overwritten as they rotate.
• Billing records are kept for as long as tax and accounting law requires, even after the rest of your data is deleted.
• Contact-form messages are kept until you ask us to delete them or we no longer need them to reply to you.

When you ask us to delete your data, we delete it and tell you when it is done. If a copy exists in a backup, it is removed on that backup’s own schedule; ask and we will tell you what that is.

Whatever state or country you live in, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• send you the notes and summaries Rumi keeps about your work, in a form you can open without us;
• correct information that is wrong;
• delete your information;
• disconnect an account you connected; and
• stop sending you news about Rumi.

Email support@rumiai.ai from the email address or phone number on your account, or tell us how to reach you. We may need to confirm it is you before we act, and an authorized agent may make a request for you if we can verify their authority. We will respond within the time the law requires (in California, we confirm receipt within ten business days and respond within forty-five days, which can be extended once). We will not treat you differently for exercising these rights. If we decline a request, we will tell you why, and you can appeal by replying to our decision; if your appeal is denied, you can contact your state attorney general.

Some information we must keep even after a deletion request, such as billing records the law requires and information needed to resolve a dispute or prevent fraud.

The California Consumer Privacy Act, as amended (“CCPA”), gives California residents the rights described above to know, access, correct, and delete personal information, to opt out of its sale or sharing, and to limit the use of sensitive personal information, and the right not to be discriminated against for using them. This section is our notice under the CCPA. In the past twelve months we have collected the following categories of personal information, from the sources and for the purposes described in this policy:

• Identifiers, such as name, phone number, email address, messaging handle, account IDs, and IP address.
• Customer records and commercial information, such as billing name, plan, and subscription and payment history.
• Internet and electronic activity, such as website usage and logs.
• Audio, electronic, and visual information, such as voice notes and photos you send.
• Professional information, such as your business details.
• Inferences, such as the preferences Rumi notes from what you tell it.
• Sensitive personal information, such as the contents of email you let Rumi read, and the bot token for a Telegram bot you connect.

We disclose each of these categories for business purposes to the categories of recipients in “How we share information.” We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only to provide the Services you ask for and for the other purposes the CCPA allows, so we do not offer a right to limit its use. We keep each category for the periods in “How long we keep information.”

Under California’s “Shine the Light” law, you may ask whether we disclose personal information to third parties for their direct marketing. We do not.

The Services are designed for people in the United States, and signing up requires a United States mobile number. We are based in the United States and process information there and in other places our service providers operate.

If the law where you live, such as the GDPR in the European Economic Area or the UK, applies to our processing of your information, we rely on these legal bases: performing our contract with you (to provide the Services and take payment), our legitimate interests (to keep the Services secure, prevent abuse, and understand how they are used, where those interests are not outweighed by yours), your consent (for example, to connect an account or to receive news about Rumi, which you can withdraw at any time), and legal obligations. You can ask to access, correct, delete, restrict, or receive a portable copy of your information, or object to our processing, by emailing us, and you may complain to your local data protection authority.

We use administrative, technical, and physical safeguards designed to protect personal information. Some of the important ones are enforced rather than promised: the Google connection’s mail permission is read-only, so a draft Rumi writes is sent by you, from your own account. Each customer’s assistant runs in its own environment on servers we operate, information is encrypted in transit to our providers, and access is limited to the small team that runs the service. Our security page explains this and the limits of what we can promise.

An AI assistant brings its own risks. Rumi can make mistakes, and content it reads, such as an email, can contain instructions written to mislead an AI. We design the Services to limit what such content can do, but no system is completely secure, and we cannot guarantee the security of information sent to us. If a breach affects your personal information, we will notify you as the law requires.

The Services are for adults 18 and older and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

If we answer your business phone or handle your customers’ messages under a separate agreement, we process your customers’ information, such as their phone numbers, what they say, and the requests they leave, on your behalf as your service provider, as that agreement describes. Your own privacy notice governs that information, and requests about it should go to you; we will help you respond.

If you ask us to make a voice from your own voice, we use the recordings you provide only to create and run that voice for your business, only with your explicit written consent, and we delete the recordings and the voice when the service ends or when you ask.

We may update this Privacy Policy. When we do, we will change the effective date above, and if a change is material, especially one that changes how we use or share information we already hold, we will tell you before it takes effect, by email or through the Services, and ask for your consent where the law requires.

Questions about this policy or your data, or a request to access, export, or delete it? Email support@rumiai.ai. Rumi AI LLC, Los Angeles, California.