Privacy Policy

Last updated: 2026-07-12

Who we are

RafiHive (“we”, “us”) is an independent product operated by Davor Klincharski, based in Germany. The controller for personal data processed via rafihive.com, within the meaning of the GDPR, is the operator. You can reach us about privacy at info@rafihive.com. Company registration details are published in our Imprint.

Data we process

  • Account data (name, email, sign-in identifiers) via AWS Cognito, including LinkedIn sign-in where you choose it.
  • Usage & conversation data (your questions, generated answers, threads) stored in the EU to provide the service.
  • Uploaded documents and their names, size, owner and chosen scope when you use document analysis or private knowledge features.
  • Billing data handled by Stripe; we store subscription/entitlement status, not full card details.
  • Technical data (IP, device/browser, logs) for security, reliability and aggregate traffic statistics. Our CDN writes an access-log line per request, held in our own AWS account in the EU for 30 days and never shared with a third party. We use it only in aggregate — which pages are requested, and from where — and the legal basis is our legitimate interest in operating and understanding the site (Article 6(1)(f) GDPR). No cookie or browser storage is involved, so this does not depend on your analytics choice below.

How your questions are processed

Questions and documents you choose are processed by large language models on Amazon Bedrock within the EU to generate answers grounded in the sources available to your workspace. Your inputs, documents and outputs are not used to train foundation models. Uploaded documents are not sent to optional web search. Do not submit personal data or confidential information you are not permitted to share.

Legal bases (GDPR)

Contract performance (providing the service), legitimate interests (security, service improvement), and consent where required.

Sub-processors

Amazon Web Services (hosting, AI and storage, in the EU eu-west-1 region), Stripe (payments) and LinkedIn (optional sign-in). We keep this list current and will inform users of material changes before they take effect.

Retention

We keep account, conversation and uploaded-document data while your account is active or until you remove the relevant document. A removed document stops being available to answers immediately while removal from private storage and searchable knowledge completes. After you close your account we delete or anonymise remaining service data within 90 days, except where longer retention is legally required — for example, billing and tax records, which German law requires us to keep for up to 10 years (§ 147 AO, § 257 HGB).

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. Contact info@rafihive.com. You may also lodge a complaint with your data-protection supervisory authority.

Cookies & local storage

We do not use advertising cookies or tracking pixels, and we do not sell or share personal data with advertisers. When you choose to sign in, RafiHive uses strictly necessary browser storage to keep your account session available. That storage is required for the sign-in service you requested, so it is not subject to consent.

Analytics

We use Google Analytics 4 to understand which pages are useful. It runs in Google Consent Mode with all storage denied by default: the Google tag is present on every page, but until you select Accept it sets no cookies, creates no identifiers and cannot recognise you or link your visits together. On your first visit we ask. If you decline, we store only the fact that you declined, and we do not ask again.

Before you decide, the tag may contact Google to load itself and send a cookieless signal containing your IP address and page address, which Google uses only in aggregate and which cannot identify you. If you accept, Google Analytics then sets cookies (_ga and related) and processes your usage of this website — pages viewed, approximate location derived from your IP address, device and browser type — on our behalf. Google Ireland Limited acts as our processor, and data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. We do not use analytics data to make decisions about you, and we do not link it to your RafiHive account.

You can withdraw your consent at any time, with effect for the future, by clearing this site’s cookies and browser storage in your browser settings, or by writing to info@rafihive.com. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing carried out beforehand.