Privacy Policy
RawKit — Version 1.2 · Effective 2026-09-06 · Last updated 6 September 2026
<!-- Art. 12–14, 28, 30, 44 ff. DSGVO -->This Privacy Policy is the transparency notice under Articles 12, 13 and 14 GDPR for RawKit, a web application for evidence-based research and go-to-market work operated by Elijah Ross. It describes what personal data RawKit stores, why, on what legal basis, where, for how long, and who else receives it. It describes actual behaviour of the deployed system, not intentions.
This Policy is a standalone document. It forms an integral part of the Terms of Use, which govern the contract between you and the provider; where the Terms describe a commercial or contractual matter and this Policy describes the same processing, this Policy prevails on questions of data protection.
Section 8 covers connected social platforms specifically. Section 9 covers retention and how to delete your data, and points to the separate data deletion instructions.
1. Controller and contact
The controller for the processing described here is:
| Controller | Elijah Ross, sole trader (Einzelunternehmer) |
| Address | Kulmgasse 38/20, 1180 Vienna, Austria |
| service@ml-canvas.com | |
| Data protection officer | None appointed — see below |
| Supervisory authority | Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at |
No data protection officer has been appointed. The controller is a sole trader whose processing does not meet the thresholds of Article 37 GDPR; the appointment obligation is reassessed whenever the scope of processing changes.
Full statutory disclosure under section 5 ECG, section 5 DDG and section 14 UGB is published in the Impressum.
For processing you carry out on your own behalf inside a workspace, the role split in section 10 applies.
2. Infrastructure and processing locations
All primary systems are located in the European Union:
| Layer | Provider | Location |
|---|---|---|
| Web application, serverless functions, static hosting | Amazon Web Services (Amplify, Lambda, CloudFront-equivalent delivery) | eu-central-1, Frankfurt am Main, Germany |
| Relational database (PostgreSQL) | Neon | EU region, hosted on AWS eu-central-1, Frankfurt am Main, Germany |
| Object storage for uploaded and generated files | Amazon S3 | eu-central-1, Frankfurt am Main, Germany |
| Agent runtime, research clients, cost ledger | Self-operated servers at Hetzner Online GmbH | Frankfurt am Main / Falkenstein, Germany |
| Real-time collaboration (WebSocket) service | Self-operated, co-located with the agent runtime | Germany |
| Embedding generation for search | Self-operated model server | Germany, no third party involved |
No user data is stored at rest outside the EU. Personal data leaves the EU only as transient content of a request to a third-country service provider, and only where you invoke a feature that requires it — see sections 6 and 7.
3. What is stored, and why
a) Account and identity data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, name (optional), profile image (optional) | Account creation, authentication, transactional email | Art. 6(1)(b) GDPR — performance of the contract | Until account deletion |
| Password, stored only as a salted cryptographic hash | Authentication | Art. 6(1)(b) GDPR | Until account deletion |
| Email verification status and verification tokens | Preventing registration with foreign addresses | Art. 6(1)(b), 6(1)(f) GDPR | Tokens expire; deleted after use |
| Workspace plan (free / creative / pro), Stripe customer and subscription identifiers, renewal date | Feature entitlement, billing | Art. 6(1)(b) GDPR | Until workspace deletion |
| Usage ledger: cost of every run per model and source, top-ups, plan credits, auto-recharge threshold | Metering, billing, showing you what was spent | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for records subject to statutory retention | Until workspace deletion; accounting records for the statutory retention period (7 years, section 132 BAO) |
| Account creation and update timestamps | Auditability | Art. 6(1)(f) GDPR — legitimate interest in a traceable account history | Until account deletion |
b) Session and security data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Session token, expiry, IP address, user agent string | Keeping you signed in; detecting session abuse | Art. 6(1)(b) and 6(1)(f) GDPR — legitimate interest in securing accounts | Session lifetime is 7 days, refreshed at most daily; rows are removed on expiry or sign-out |
| Bot-protection token and the IP address transmitted with it | Preventing automated registration, credential stuffing and email-bombing of the mail relay | Art. 6(1)(f) GDPR | Not stored by the controller; transmitted to Cloudflare for verification (section 5) |
| Short-lived signed tickets scoped to one board | Authorising a browser to open a collaboration socket for one board only | Art. 6(1)(b) GDPR | Minutes; never persisted |
c) Workspace, board and collaboration data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Workspace name, slug, membership and role of each member | Multi-tenancy, access control | Art. 6(1)(b) GDPR | Until the workspace is deleted |
| Board content as a CRDT (Yjs) binary document, plus a queryable JSON projection of nodes, edges and frames | Storing your canvas; enabling search, thumbnails and agent reads without loading the CRDT | Art. 6(1)(b) GDPR | Until the board or workspace is deleted |
| An append-only log of every incremental board update | Crash-safe persistence, version history and restore | Art. 6(1)(b) and 6(1)(f) GDPR — legitimate interest in recoverable state | Until the board is deleted; the log is deleted with it |
| Board thumbnail images | Board overview | Art. 6(1)(b) GDPR | Until the board is deleted |
| The identity of the member who created an object | Attribution inside the workspace | Art. 6(1)(f) GDPR | With the object |
Note on the update log: because board history is stored as an append-only sequence of changes, content you delete from a board remains recoverable in the history until the board itself is deleted. If you need a specific item irretrievably removed sooner, delete the board or contact the controller.
d) Files and generated media
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Uploaded files (any type you upload), stored in object storage under a key prefix unique to your workspace | Providing your files to you and as agent context | Art. 6(1)(b) GDPR | Until you delete the file, the board or the workspace |
| File metadata: filename, MIME type, size, status, uploader, timestamps | File management | Art. 6(1)(b) GDPR | As above |
| Text extracted from documents, stored as markdown in the database | Letting the agent read document content without re-parsing the binary | Art. 6(1)(b) GDPR | As above |
| AI-generated images and video, ingested into the same object storage | Persisting generated media beyond the provider's temporary URL | Art. 6(1)(b) GDPR | As above |
Files are never made public. Access is granted exclusively through short-lived pre-signed URLs issued by the server after it has verified that the requesting account belongs to the owning workspace.
e) Conversations and the search index
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Chat messages (your prompts, agent replies, system and tool messages), the board objects attached as context, and the identifier of the run that produced a reply | Conversation history, reproducibility, cost attribution | Art. 6(1)(b) GDPR | Until you delete the conversation, board or workspace |
| Token counts and cost per message | Usage transparency and budget enforcement | Art. 6(1)(b) and 6(1)(f) GDPR | As above |
| Message chunks and their vector embeddings | Hybrid full-text and semantic search over your own transcripts, so the agent can retrieve only relevant passages instead of the whole history | Art. 6(1)(b) GDPR | Deleted together with the message |
Embeddings are computed on the controller's own infrastructure in Germany. No third party receives message text for the purpose of building the search index.
f) Connector credentials and publications
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| OAuth access and refresh tokens for connected platforms, encrypted at rest with AES-256-GCM | Acting on your behalf on the connected platform | Art. 6(1)(b) GDPR | Until you disconnect, the token is revoked, or the workspace is deleted |
| Granted scopes, platform account identifier, display name, handle, avatar URL, connection status | Showing you which account is connected and what it may do | Art. 6(1)(b) GDPR | As above |
| Publication drafts, scheduled and published content, target (subreddit, page, and similar), attached media identifiers | Publishing and scheduling | Art. 6(1)(b) GDPR | Until you delete the publication or the workspace |
| Post identifier and permalink returned by the platform, plus retrieved engagement metrics (impressions, likes, comments, shares) and the time they were retrieved | Performance reporting | Art. 6(1)(b) GDPR | As above |
| Record of a platform-initiated deletion request: confirmation code, platform, the platform account identifier it concerned, how many connectors and publications were removed, and the timestamps | Proving that a deletion demanded by Meta was carried out, and answering the status URL Meta requires us to publish for it | Art. 6(1)(c) GDPR — compliance with a legal obligation, and Art. 6(1)(f) GDPR — legitimate interest in evidencing deletion | Kept after the deleted data is gone, because the status URL must keep resolving; 12 months |
Note the last row: it is the one thing that outlives a deletion. It holds no content — only the platform account identifier the request concerned and a count of what was removed — but it is retained deliberately, because Meta's data deletion callback requires a URL that keeps reporting the outcome.
Tokens are encrypted, not hashed, because they must be usable. The encryption key is held in the server environment, separately from the database. The per-application OAuth client credentials belong to the controller and are never exposed to you or to other users. Section 8 describes the connector processing in full.
g) Agent runs and the cost ledger
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Run records: the model used, number of turns and steps, tool calls made, token counts, estimated and actual cost in USD, status and errors | Enforcing budgets, billing accuracy, debugging failed runs, and showing you what a run cost | Art. 6(1)(b) and 6(1)(f) GDPR | 12 months |
| Search-provider spend recorded per call, per provider | Cost transparency for paid data sources | Art. 6(1)(b) GDPR | As above |
Run records are stored on the agent runtime's own database in Germany; the cost ledger (balances and per-call spend) is stored in the primary EU database listed in section 2.
h) Transactional email
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Recipient address and message content for verification, password reset and account notices | Operating the account | Art. 6(1)(b) GDPR | Delivery logs at the mail relay per its own retention; the controller stores no separate mail archive |
The controller sends no marketing email and operates no newsletter. If that changes, it will be on the basis of a double opt-in and separate consent under Article 6(1)(a) GDPR and section 174 TKG 2021, with an unsubscribe link in every message.
i) Server logs
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Technical logs of requests to the application and the agent gateway, which may contain IP address, timestamp, requested path, status code and user agent | Operation, error diagnosis, abuse and attack detection | Art. 6(1)(f) GDPR — legitimate interest in a secure, functioning service | A maximum of 14 days for raw logs, longer only for security incidents |
j) Reach measurement on the marketing pages (web analytics)
The public marketing pages (landing page, documentation and these legal pages) use PostHog for reach measurement: page views, referrer, approximate device characteristics and interaction events. All requests are routed through the controller's own domain to PostHog's EU cloud (Frankfurt, Germany); no third-party script is loaded and no data leaves the EU for this purpose.
Two modes exist, controlled by the consent banner described in section 4:
- With your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021 / section 25(1) TDDDG): PostHog stores a first-party cookie so that repeat visits can be recognised. You can withdraw consent at any time via "Cookie settings" in the page footer, with effect for the future.
- Without consent (declined, or no choice made): measurement continues in cookieless mode — nothing is stored on or read from your device, and visits are counted using a pseudonymous hash computed on PostHog's EU servers that rotates daily, so no persistent identifier exists. Legal basis is the legitimate interest (Art. 6(1)(f) GDPR) in aggregate, privacy-preserving reach statistics; no device access within the meaning of section 165(3) TKG 2021 takes place.
The application itself (everything behind sign-in) contains no web analytics of any kind.
k) What is not processed
The Service uses no tracking pixels, no advertising network, no A/B testing service, no session recording and no cross-site tracking of any kind. No profile of your browsing behaviour is created; analytics on the marketing pages is limited to what section 3(j) describes. The content security policy of the application permits third-party script loading only for the bot-protection widget; the marketing pages load no third-party scripts at all.
4. Cookies and local storage
<!-- TKG 2021 §165(3) / TDDDG §25 -->| Name | Type | Purpose | Duration | Consent required |
|---|---|---|---|---|
| Session cookie set by the authentication layer | Strictly necessary | Keeps you signed in | Up to 7 days | No — Art. 6(1)(b) GDPR, exempt under section 165(3) TKG 2021 / section 25(2) TDDDG |
| "NEXT_LOCALE" | Strictly necessary (user-set preference) | Stores the interface language you chose | 1 year | No — set only as a direct result of your explicit choice |
| Cloudflare bot-protection cookies set by the challenge widget | Strictly necessary | Distinguishing humans from automated clients on the sign-up, sign-in and password-reset endpoints | Per Cloudflare's specification | No — security measure necessary to provide the service you requested |
| Browser local storage / IndexedDB used by the collaborative canvas | Strictly necessary | Offline-capable local copy of the board you have open, so edits are not lost on a reconnect | Until you clear it or leave the board | No |
| PostHog analytics cookie ("ph_…_posthog") and associated local storage | Analytics — optional | Recognising repeat visits to the marketing pages | Up to 1 year | Yes — set only after you accept in the consent banner |
| PostHog consent record ("_ph_opt_in_out…") | Strictly necessary | Remembers the accept/decline choice you made in the banner, so you are not asked again | Until you clear it | No — storing the decision itself is necessary to honour it |
The marketing pages therefore show a consent banner before any analytics cookie is set. Declining is as prominent as accepting and results in the cookieless measurement described in section 3(j) — nothing is stored on your device. A previously made choice can be changed at any time via "Cookie settings" in the page footer. The application behind sign-in continues to set no non-essential cookies and shows no banner.
5. Recipients and processors
The following recipients process personal data on the controller's behalf or receive data as independent controllers. The controller concludes a data processing agreement under Article 28 GDPR with every processor.
Infrastructure processors — data at rest
| Recipient | Function | Data | Location | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Hosting, serverless execution, object storage | All application data and files | eu-central-1, Germany | EU; US parent access governed by the AWS GDPR addendum, SCCs and EU-US DPF |
| Neon Inc. | Managed PostgreSQL | All relational data | EU region on AWS eu-central-1, Germany | Storage in the EU; SCCs and, where applicable, EU-US DPF for US-based support access |
| Hetzner Online GmbH, Germany | Server hosting for the agent runtime and collaboration service | Run records, transient request content | Germany | EU — no third-country transfer |
| Cloudflare Germany GmbH / Cloudflare, Inc. | Bot protection (challenge verification) | Challenge token, IP address, coarse browser characteristics | Global anycast; verification endpoint operated by Cloudflare, Inc. | SCCs and EU-US DPF |
| SMTP.com, Inc., USA | Transactional email delivery | Recipient address, message content | EU-hosted relay | SCCs and EU-US DPF |
| Stripe Payments Europe, Ltd., Dublin, Ireland | Payment processing, subscriptions, tax calculation, billing portal | Name, email address, billing address, tax ID, payment card data (entered on Stripe's own pages and never held by the controller), transaction history | Ireland; Stripe, Inc., USA processes data as a sub-processor | SCCs and EU-US DPF |
| PostHog, Inc., San Francisco, USA | Web analytics on the marketing pages only (section 3(j)) | Page views, interaction events, IP address (processed transiently), coarse browser characteristics | EU cloud, AWS eu-central-1, Frankfurt, Germany | Storage and processing in the EU; SCCs and EU-US DPF cover any US-based support access |
AI providers — data in transit only, no storage by the controller
| Recipient | Function | Data sent | Seat | Transfer basis |
|---|---|---|---|---|
| OpenAI | Language models, including web-search-capable variants | Prompt content: your instructions, relevant board content, conversation excerpts, extracted document text | United States (contracting entity in Ireland for EEA customers) | EU-US DPF and SCCs |
| Google (Gemini API) | Language models, image generation | As above | United States (contracting entity in Ireland for EEA customers) | EU-US DPF and SCCs |
| DeepSeek | Language models | As above | People's Republic of China | No adequacy decision. SCCs plus a transfer impact assessment required — see section 7 |
| Moonshot AI (Kimi) | Language models | As above | People's Republic of China | No adequacy decision — see section 7 |
| MiniMax, including the Hailuo media models | Language models, image and video generation | As above, plus any source image you supply | People's Republic of China / Singapore | No adequacy decision — see section 7 |
| Replicate, Inc. | Image and video generation | Generation prompt, any source image you supply | United States | SCCs, EU-US DPF where certified |
Social platforms — independent controllers
When you connect a platform account, the platform receives the content you publish and the API calls RawKit makes on your behalf, and processes that data as an independent controller under its own privacy policy. The platforms that can be connected are LinkedIn (LinkedIn Ireland Unlimited Company), X (Twitter International Unlimited Company), Reddit (Reddit, Inc.), Instagram and Threads (Meta Platforms Ireland Limited, as two separate apps) and TikTok (TikTok Technology Limited). Section 8 sets out what is exchanged with each and on what basis. Nothing is sent to any of them unless you connect that account and ask RawKit to publish.
6. What actually leaves the EU, and when
Nothing is transferred to a third country by default. A transfer occurs only when you invoke a feature whose execution requires it, and it is limited to the content of that request:
- You run the agent or send a chat message. The prompt, the board objects you attached as context, relevant excerpts of the conversation and any extracted document text are sent to the language model provider configured for the model you selected.
- You generate an image or video. The generation prompt and any source image you supplied are sent to the media provider.
- The agent performs research. The constructed search query is sent to the relevant search or data provider.
- You publish through a connector. The post content, attached media and target are sent to the platform you selected.
Responses are stored in the EU. Nothing is transferred for any purpose other than executing the request you triggered.
Third-country risk you should be aware of. The Service can route to language models operated in the People's Republic of China (DeepSeek, Moonshot/Kimi, MiniMax and the Hailuo media models). China is not covered by an adequacy decision under Article 45 GDPR, and its legal framework provides state access powers that a European transfer impact assessment must weigh. If you do not wish your content to reach these providers, select only OpenAI or Google models in the workspace model settings, or disable the affected models for your workspace.
The EU-US Data Privacy Framework, on which transfers to certified US recipients rely, remains in force but is subject to a pending challenge before the Court of Justice of the European Union. Standard Contractual Clauses are maintained as a fallback for every US recipient.
7. Whether AI providers train on your content
The controller does not train models on your content (section 11.3 of the Terms of Use). For the third parties it calls, the position depends on their API terms:
- For the major US providers, inputs and outputs submitted through the paid API are, under their published API terms, not used to train their general models by default.
- For the Chinese providers, an equivalent contractual guarantee has not been established.
Because this depends on contracts the controller does not control, no guarantee is given here beyond the controller's own conduct. If a no-training guarantee is material to you, restrict your workspace to the providers for which it is documented, and do not place confidential or personal data in prompts.
8. Connected social platforms
<!-- Platform developer-policy disclosure: Meta (Instagram, Threads), LinkedIn, X, Reddit, TikTok -->8.1 What a connector is
A connector is a social or publishing account that you connect by OAuth so that RawKit may act on your behalf on that platform. Connecting is always initiated by you, is optional, and is never required to use the rest of the Service. Legal basis for the processing described in this section is Article 6(1)(b) GDPR — performance of the contract you concluded by asking RawKit to publish for you.
You authorise the requested access on the platform's own consent screen, which states the permissions being granted.
Six platforms are implemented and can be connected: LinkedIn, X, Reddit, Instagram, Threads and TikTok. No other platform can be connected, whatever a platform list elsewhere in the product may suggest.
8.2 What RawKit receives from a connected platform
The permission strings below are the exact OAuth scopes each connector requests. Instagram and Threads are separate Meta apps with separate credentials; Instagram uses Instagram Login for Business and requires a Business or Creator account.
| Platform | OAuth scopes actually requested | Stored about the connected account | Read back |
|---|---|---|---|
openid, profile, email, w_member_social | Account identifier, display name, avatar URL, granted scopes, connection status, encrypted access and refresh tokens | Identifier and permalink of posts RawKit created | |
| X | tweet.read, tweet.write, users.read, offline.access | Account identifier, display name, handle, avatar URL, granted scopes, connection status, encrypted tokens | Identifier and permalink of posts RawKit created, and their public metrics (likes, reposts, replies, quotes, impressions, bookmarks) |
identity, submit, read | Account identifier, username, granted scopes, connection status, encrypted tokens | Identifier and permalink of posts RawKit created, and their score and comment count | |
instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights | Account identifier, name, username, avatar URL, granted scopes, connection status, encrypted token | Identifier and permalink of posts RawKit created, and their like and comment counts | |
| Threads | threads_basic, threads_content_publish, threads_manage_insights | Account identifier, name, username, avatar URL, granted scopes, connection status, encrypted token | Identifier and permalink of posts RawKit created, and their views, likes, replies, reposts and quotes |
| TikTok | user.info.basic, video.publish, video.upload, video.list | Open ID, display name, avatar URL, granted scopes, connection status, encrypted access and refresh tokens | Identifier of videos RawKit created, their publication status, and their view, like, comment and share counts |
Every scope above is exercised. RawKit requests no permission it does not use: the Instagram and Threads apps hold no messaging, comment or reply permission, so RawKit cannot read or write direct messages, comments or replies on your account even if it tried.
RawKit reads back only content it created for you. It does not read your inbox, your direct messages, your contact or friend lists, your follower lists, or content posted by other people, and it does not use platform data to build a profile of anyone.
8.3 What RawKit sends to a connected platform
Only what you asked it to publish: the post content you approved, any attached media, and the target you selected (page, subreddit, account). Nothing else about your workspace, your boards, your files or your conversations is transmitted to a platform.
How the media reaches the platform differs, and both routes are limited to the one file attached to that publication:
- Instagram and Threads fetch the file themselves from a short-lived pre-signed URL that RawKit generates for that publication and that expires afterwards.
- TikTok does not fetch: RawKit reads the file from its own object storage and uploads the bytes to TikTok directly.
8.4 How platform data is used inside RawKit
Data received from a platform stays inside the workspace that owns the connector. It is used to show you the state of your connection, to publish what you asked for, and to report how a publication performed.
Platform data is sent to a language model only if you yourself run an agent or send a chat message over it — for example asking the agent to summarise how a campaign performed. That is a transfer under section 6 and happens on your instruction, never automatically in the background.
Platform data is never sold, rented, shared with data brokers, used for advertising or ad targeting, used to train any model, or combined with data from other users' workspaces.
8.5 Retention and revocation
You may disconnect a connector at any time in the application. On disconnection the stored tokens are marked revoked and the credentials are deleted. Posts already published on the platform are not withdrawn, and engagement metrics already retrieved are retained with the publication record until you delete it — to remove published posts, delete them on the platform itself.
You can additionally revoke RawKit's access from the platform side, in the connected-apps or business-integrations settings of your platform account. Revoking there stops all further access even if the RawKit-side record still exists; for Instagram, Threads and TikTok the platform also notifies RawKit, which then revokes the connector and deletes its credentials automatically (section 8.7).
Deletion of platform-derived data, including deletion requests the platform sends us on your behalf, is described in section 9 and in the separate data deletion instructions.
8.6 The platform is its own controller
Each platform processes the data it receives as an independent controller under its own privacy policy and terms, over which the controller of RawKit has no influence. Your relationship with the platform is governed by that policy; this Policy covers only what happens on RawKit's side.
8.7 Event notifications received from a platform (webhooks)
Instagram, Threads and TikTok can send RawKit server-to-server notifications about your connected account. Every such request is cryptographically verified against the app secret before it is acted on; unsigned or wrongly signed requests are rejected.
| Platform | Notifications received | What RawKit does with them |
|---|---|---|
| TikTok | Authorisation removed; video publication completed; video upload failed; data-portability export ready | Revokes the connector and deletes its credentials; marks the corresponding publication published or failed; the export notice is written to the server log only |
| Instagram, Threads | Only the event types the granted permissions allow. Because the apps hold no messaging, comment or reply permission, no message, comment or reply notification can be delivered | Not stored and not read. Only the event type and the platform account identifier are written to the server log (section 3(i), maximum 14 days); no notification content is stored, parsed or shown anywhere in the product |
No notification content is used to build a profile, is passed to a language model, or leaves the controller's infrastructure.
9. Retention, deletion and how to delete your data
9.1 Retention
- While your account exists, your data is retained so the Service can work.
- You may delete individual objects — files, boards, conversations, publications, connectors — at any time. Deletion cascades to the dependent records (a board takes its update log, its conversations and their message chunks with it).
- On account deletion, the controller deletes the object-storage prefix of every workspace of which you are the sole member, then deletes those workspaces, which cascades their boards, files, conversations, connectors and publications. Workspaces with other remaining members are preserved and only your membership is removed — content you contributed to a shared workspace stays with that workspace.
- Backups. Database backups are retained for a limited period for disaster recovery, with a retention window of 14 days. Deleted data may persist in a backup until it is rotated out.
- Statutory retention. Once invoicing exists, accounting records must be kept for seven years under section 212 UGB and section 132 BAO. Such records are blocked from ordinary use and retained solely to meet that obligation.
- Log and run data are retained for the periods stated in section 3(g) and (i).
9.2 How to delete your data
Three routes, all of which you control:
- Delete a single object — open the file, board, conversation or publication in the application and delete it there. The dependent records go with it.
- Disconnect a platform — in the connector settings of the application. Tokens are marked revoked and the stored credentials are deleted, as described in section 8.5.
- Delete your entire account — in the account settings of the application. This runs the cascade described in section 9.1 and cannot be undone.
If you cannot reach the application, send a deletion request to service@ml-canvas.com from the address registered to your account. The controller responds within one month, extendable by two months for complex requests.
The step-by-step version of these instructions, including what a deletion does and does not remove, is published separately at rawkit.io/data-deletion.
9.3 Deletion requests received from a platform
Where a platform's developer policy requires it, RawKit accepts deletion and deauthorisation signals sent by the platform itself — for example when you remove the RawKit integration from your Facebook or Instagram account settings. On receiving such a signal the connector is disconnected, its stored credentials are deleted, and the platform-derived data listed in section 3(f) for that connector is deleted.
| Platform | Signal | Endpoint |
|---|---|---|
| Deauthorisation callback | https://app.rawkit.io/api/instagram/remove | |
| Data deletion request callback | https://app.rawkit.io/api/instagram/delete | |
| Threads | Deauthorisation callback | https://app.rawkit.io/api/threads/remove |
| Threads | Data deletion request callback | https://app.rawkit.io/api/threads/delete |
| TikTok | Authorisation removed (delivered as an event notification) | https://app.rawkit.io/api/tiktok/webhook |
| All | Deletion instructions for users | https://rawkit.io/data-deletion |
A data deletion request from Meta deletes the connectors for that platform account and, with them, the publication records made through them. RawKit answers with a confirmation code and a status URL, as Meta requires; opening that URL shows whether the deletion completed and what it removed. The record behind that URL is the one described in the last row of section 3(f).
10. Roles: when you are the controller
RawKit is a general-purpose tool. You decide what to put into it.
- For account, billing, security and service-operation data, the provider is the controller.
- For the content you place in a workspace — a board with named prospects, a file containing employee data, a research run about identifiable people — you determine the purposes and means. In that respect the provider acts as your processor under Article 28 GDPR, and you are the controller.
If you process personal data of third parties in the Service, you must have your own legal basis, you must satisfy the information duties owed to those people, and you must not upload special categories of data without appropriate safeguards. Business users processing personal data in the Service should conclude a data processing agreement with the provider; a template is available on request at the address in section 1.
Note specifically that the LinkedIn enrichment source returns data about identifiable natural persons who are not users of the Service. When you use it, you become the controller for that data, and Article 14 GDPR information duties may fall on you.
11. Security measures
The controller maintains technical and organisational measures appropriate to the risk, including: transport encryption for all connections; encryption of OAuth credentials at rest with AES-256-GCM under a key held outside the database; password storage as salted hashes only; strict tenant isolation with every query scoped to a workspace the caller belongs to; short-lived, board-scoped tickets for collaboration sockets; pre-signed, expiring URLs as the only path to stored files; a restrictive content security policy with framing denied and HSTS enabled; mandatory bearer authentication on the agent gateway, which denies rather than permits when unconfigured; hard per-run budget ceilings; and bot protection on all public authentication endpoints.
12. Personal data breaches
If a breach of the security of personal data occurs, the controller will notify the Austrian Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR), and will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
13. Your rights
You have the right to:
- access your personal data (Article 15 GDPR);
- rectification of inaccurate data (Article 16 GDPR);
- erasure (Article 17 GDPR) — you can trigger this yourself by deleting your account, see section 9.2;
- restriction of processing (Article 18 GDPR);
- data portability in a structured, commonly used, machine-readable format (Article 20 GDPR);
- object to processing based on legitimate interests, on grounds relating to your particular situation (Article 21 GDPR);
- withdraw consent at any time, with effect for the future, where processing is based on consent (Article 7(3) GDPR).
Send requests to the address in section 1. The controller responds within one month, extendable by two months for complex requests, and will tell you if an extension is needed.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). The competent authority for the controller is:
Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria dsb@dsb.gv.at · www.dsb.gv.at
14. Changes to this Privacy Policy
This Policy is updated whenever the processing it describes changes — a new processor, a new platform connector, a new model provider or a changed retention period. The version and effective date at the top of this page always identify the operative text.
Where a change materially affects your rights, you will be notified by email to the address registered to your account, or by a notice in the application, before it takes effect. Purely clarifying or editorial changes are published without separate notice.