Privacy Notice
Last updated
- Registered name
- Subworkflow AI Limited
Registered in England & Wales, UK (16781125)
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom - Legal contact
- legal@subworkflow.ai
- Support
- support@subworkflow.ai
Data Protection Registration: ZC013758
We are the controller of your personal data. This privacy notice tells you what to expect us to do with your personal information when you use ragextract.com and the Ragextract service at app.ragextract.com.
What information we collect, use, and why
We collect or use the following information to provide and improve products and services for clients:
- Names and contact details
- Addresses
- Organisation name, size and description, where you give them to us
- Usage data (including information about how you interact with and use our website, products and services)
- Account access information
- Website user information
We collect or use the following personal information for information updates or marketing purposes:
- Names and contact details
- Addresses
- Profile information
- Marketing preferences
- Purchase or account history
- Website and app user journey information
We collect or use the following personal information for dealing with queries, complaints or claims:
- Names and contact details
- Addresses
- Payment details
- Account information
- Purchase or service history
- Customer or client accounts and records
Documents you upload
Ragextract works on documents you provide. Those documents, and anything extracted from them, are your content. We process them as a processor on your behalf, for the sole purpose of providing the service to you.
- What we do with them. An uploaded document is read, split into pages, rendered to page images and indexed so that questions can be answered from it. When a table is run, the relevant pages are sent to a language model provider to produce an answer and a citation back to the page.
- We do not train on your content. Your documents and the answers extracted from them are not used to train our models or our providers’ models.
- Who can see them. Documents live inside a workspace and are private to it. Access is granted per workspace by you or your organisation’s administrators. Our staff do not access your documents except where you ask us to in order to resolve a support issue, or where we are legally required to.
- If you upload personal or special category data belonging to other people, you are the controller of it and you are responsible for having a lawful basis to share it with us. Please see our Acceptable Usage Policy for what may not be uploaded.
- Deleting. You can delete a document or a table at any time from within the application, and archiving a workspace can delete its documents with it. Deletion is not instantaneous: the document is withdrawn from the service immediately, and a clean-up process running twice daily then removes the stored file, the page images and the search index entries. Related records in our database may persist in encrypted backups for up to 30 days before being overwritten.
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which mean you may not receive all the information you ask for.
- Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Your right to erasure — You have the right to ask us to delete your personal information.
- Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
- Your right to object to processing — You have the right to object to the processing of your personal data.
- Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for information updates or marketing purposes are:
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Where we get personal information from
- Directly from you
- From your organisation’s administrator, where you are invited to a Ragextract workspace
- From Google or GitHub, where you choose to sign in with one of those providers
Who we share information with
We use the following sub-processors to run the service. Each is bound by contract to process data only on our instructions.
Where you choose to sign in with Google or GitHub, those providers confirm your identity to us. They are not our sub-processors for that purpose — they decide independently how they handle your use of their own accounts, and their own privacy notices govern it.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, application database, document storage, transactional email | Global network, including the United States |
| Hetzner Online GmbH | Hosting for the document processing pipeline and the search index | Germany (EU) |
| Stripe, Inc. | Payment processing and tax calculation for credit purchases | US / EU |
| OpenRouter, Inc. | Routing extraction requests to large language model providers | US |
| Voyage AI | Generating embeddings from document pages so they can be searched | US |
| PostHog, Inc. | Product analytics and error reporting for the application (not the website) | US |
Where a sub-processor is outside the UK or EEA, transfers are made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
Cookies and similar technologies
We use one cookie. It keeps you signed in to the application, is strictly necessary to provide a service you have asked for, and so does not require your consent. We set no analytics, advertising or personalisation cookies on this website or in the application, which is why you are not asked to make a cookie choice. If that ever changes, non-essential cookies will be set only after you agree to them, and this notice will say so first.
We do use a product analytics service (see the sub-processor table above) to understand how the application is used and to be told when it fails. It runs on our servers rather than in your browser: it sets no cookie and stores nothing on your device.
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| __Secure-better-auth.session_token | Ragextract | Keeps you signed in to app.ragextract.com. Set only after you sign in. | Until you sign out, or the session expires | Strictly necessary |
How long we keep information
Account and billing records are kept for as long as your account is open, and afterwards for as long as we are required to keep them for tax and accounting purposes.
Documents you upload are kept until you delete them, or until we close your account at your request. We do not delete them on a schedule of our own, so a document you leave in place stays available to you.
For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details provided above.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: ico.org.uk/make-a-complaint