Privacy Policy

Welcome to Ragently's privacy policy. We attach great importance to the protection of personal data and handle all information processed through our platform with care.

This privacy policy explains what data we process, why we do so, how we secure that data and what rights users have under the General Data Protection Regulation (GDPR) and other applicable Dutch legislation.

Ragently is built on the principles of privacy by design and privacy by default. We only process data that is necessary to deliver, secure and improve our services.

Ragently VOF is the owner and operator of Ragently.

For questions about privacy or data processing, or for requests regarding your personal data, you can contact us at the email address above.

Depending on how Ragently is used, different roles under the GDPR may apply.

Ragently VOF as controller

Ragently VOF acts as controller for data relating to:

• account management
• billing
• support requests
• security
• system administration
• legal obligations

Ragently as processor on behalf of customers

When customers process personal data through Ragently — for example via AI customer service or Shopify integrations — Ragently acts as processor on behalf of that customer.

In that case, the customer remains responsible for:

• the lawful processing of personal data
• informing end users
• determining retention periods
• meeting other GDPR obligations

We only process data that is necessary for our services to function.

Account and company data

• name
• email address
• company name
• billing details
• user settings
• subscription and payment information

Service and usage data

• chat interactions
• questions and answers
• AI configurations
• error messages
• system information
• security logs
• usage statistics

Technical data

• IP address (anonymised where possible)
• browser type
• device information
• timestamps
• API requests
• session information

We process personal data solely for the following purposes:

• delivering AI services
• customer service and support
• securing systems and accounts
• error analysis and technical optimisation
• billing and administration
• compliance with legal obligations
• fraud prevention
• improving performance through anonymised statistics

We only process personal data where a valid legal basis exists, including:

• performance of a contract
• legitimate interest
• legal obligation
• consent of the user (where required)

For AI functionality, Ragently uses two AI providers:

• Venice AI (venice.ai) is the primary AI provider. Venice is built around privacy: Venice does not store the content of processed conversations and does not use it to train AI models. See also our AI privacy page.
• OpenAI (openai.com) is used as an automatic fallback when Venice is temporarily unavailable, and to analyse images uploaded during a conversation.

With both providers, personal data and customer content may be processed temporarily in order to generate AI responses.

Data processed through our AI providers is not used by those providers to train AI models.

• Venice AI does not store the content of processed conversations.
• OpenAI is used exclusively through the business API. OpenAI does not use API data for training and may retain it for a maximum of 30 days for abuse detection, after which it is deleted.

Data may, however, be stored by Ragently itself in order to deliver the service.

This may relate to, among other things

• chat history
• user management
• error analysis
• security purposes
• system optimisation

Ragently stores application data (including conversations and customer profiles) on its own secured servers in the Netherlands, managed by Ragently VOF and accessible only to authorised personnel.

For storing uploaded files (such as knowledge base documents and chat attachments) and for backups, Ragently also uses Microsoft Azure Blob Storage. Web traffic to the platform is routed through Cloudflare.

Security measures

We take appropriate technical and organisational security measures, including:

• TLS 1.3 transport security
• encryption of sensitive data
• access control
• network segmentation
• auditing and logging
• system monitoring
• secure backup procedures

In some cases, personal data may be processed outside the European Economic Area (EEA), for example through our AI providers Venice AI and OpenAI (both established in the United States) or through Google Analytics.

Where this occurs, Ragently ensures appropriate safeguards under the GDPR, including:

• Standard Contractual Clauses (SCCs)
• appropriate security measures
• contractual arrangements with processors

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a statutory retention obligation requires otherwise.

End-user deletion requests received through connected platforms (such as Shopify or Meta) are processed automatically. When an account is deleted, the data of that environment is removed.

11.1 Customer memory

Customer memory is an optional feature on the Pro plan, disabled by default. The business owner (our customer) decides whether to enable it for their account.

When customer memory is active, we store a customer profile (name, email address, phone number and identifiers of the channel used for contact, such as a WhatsApp or Messenger ID) and a compact, AI-generated memo of previous conversations. This serves solely to recognise returning customers and help them faster and more personally.

The memo never contains special categories of personal data such as health information, religious or philosophical beliefs, political opinions, sexual orientation, ethnicity or biometric data; such information is always fully omitted when the memo is generated.

The AI processing underlying customer memory (generating the conversation memo) falls under the same arrangements with our AI subprocessors as Ragently's other AI functionality (see sections 7 and 8).

Ragently uses cookies and similar storage technologies (such as localStorage and sessionStorage). On this page we explain exactly which technologies we use, for what purpose, how long data is stored and how you can withdraw your consent.

Ragently does not sell personal data to third parties.

Personal data is only shared where necessary for:

• delivering services
• technical infrastructure
• payment processing
• legal obligations
• security purposes

Ragently uses external subprocessors for parts of its service, including AI processing, payment processing, infrastructure and email delivery.

An up-to-date overview of all subprocessors, including their country of establishment and purpose, is available on our subprocessors page.

13.1 Requests from governments and law enforcement

Ragently does not provide personal data to government authorities unless legally obliged to do so on the basis of a binding and valid order. Informal or voluntary requests are refused.

For every request from a government authority we follow this procedure:

• Legality assessment: we assess the authority's competence, the legal basis, the form of the order and its scope.
• Informing our customer: where the request concerns data we process as processor on behalf of a customer, we notify that customer without delay and, where possible, refer the authority to that customer as controller. We refrain from notifying only where the law prohibits it; in that case we make efforts to have the restriction lifted or narrowed.
• Objecting: we challenge requests we consider unlawful, overly broad or disproportionate — with legal assistance where necessary.
• Data minimisation: if disclosure is ultimately mandatory, it remains limited to the strict minimum the order requires.
• Record keeping: we record every request internally, including the date, the authority, the stated legal basis, the data requested, our legal assessment, the individuals concerned and our response.

This procedure is also laid down in article 11 of our data processing agreement and applies to all customers, regardless of which version of that agreement applies to them.

Ragently offers two optional Google integrations. You enable them yourself; without your consent, Ragently gets no access whatsoever to your Google account.

14.1 Google Calendar

When you connect Google Calendar, Ragently requests access to your calendar to do two things: retrieve when you are busy, so the AI assistant only offers free slots, and create an appointment when a visitor books one. During setup we show the list of calendars in your account so you choose which calendar is booked into.

What we store: the integration's access keys (encrypted), the calendar you selected and your settings — time zone, working days, start and end time, appointment length and the buffer between appointments. What we do not store: the content of your calendar. Busy time slots are retrieved at the moment a visitor asks about availability and are not kept afterwards; we do not store titles, attendees or descriptions of your existing appointments.

For a booked appointment, Google itself creates the invitation and sends it to the visitor. The details the visitor left in the conversation — name, email address and chosen time — are kept by us as part of the conversation and the lead, in line with the retention periods in section 11.

14.2 Google Sheets

When you connect Google Sheets, Ragently creates a single spreadsheet in your Google Drive and writes rows to it: captured leads, handovers to a human agent and booked appointments. Ragently uses the narrowest possible access for this: only files the app created itself. Ragently cannot see, open or search the rest of your Drive.

What we store: the access keys (encrypted), the identifier of the spreadsheet we created and which events you want written through.

14.3 Limited use

Data Ragently receives through Google APIs is used solely to deliver the functions described above. We do not sell this data, do not use it for advertising, and do not use it to train AI models. Human access does not take place, except with your explicit consent, where necessary for security or debugging, or where required by law.

Ragently's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.4 Revoking and deleting

You can disconnect an integration at any time in Ragently, under Integrations. We then revoke the consent with Google and delete the stored access keys from our systems. You can also revoke access yourself at myaccount.google.com/permissions. When you delete your Ragently account, this data is deleted along with it, as described in section 16. The spreadsheet and the appointments in your calendar remain yours: they live in your own Google account and we do not delete them.

For customers who process personal data through Ragently, our Data Processing Agreement (DPA) applies. You can download it here: Ragently Data Processing Agreement (PDF).

It sets out arrangements regarding:

• data processing
• security
• confidentiality
• subprocessors
• responsibilities under the GDPR

This agreement also covers the processing of data within customer memory and its associated retention period (see section 11.1).

Under the GDPR, data subjects have the right to:

• access
• rectification
• erasure
• restriction of processing
• object to processing
• data portability
• withdraw consent
• human intervention in automated processing

Requests can be submitted via [email protected].

We respond within 1 month at the latest, unless statutory exceptions apply.

Ragently's AI functionality supports customers with communication and analysis.

Our services are not directed at persons under the age of 18.

If we discover that personal data of minors has been processed without valid consent, that data will be deleted as soon as possible.

If you believe we are processing personal data incorrectly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Ragently VOF may amend this privacy policy when legislation, services or internal processes change.

The most current version is always available on Ragently's privacy page.

We recommend reviewing this policy regularly.

Last change: 14 August 2026