Privacy Policy
Version 1.1 · Effective 1 November 2026
1. Who we are
PeraLabs Ltd, trading as Rysh AI (company number 12905271, registered office 124 City Road, London, United Kingdom, EC1V 2NX), is the controller of the personal data described in this policy ("rysh", "we"). ICO registration number: ZC285424. Privacy contact: info@rysh.ai.
2. What this policy covers
It covers the rysh.ai website and our hosted Service. It does not cover:
- The rysh command-line tool running on your machine. The tool sends no telemetry. With the default setup, your agents' model calls go from your machine to the provider you chose, and rysh's own proxy runs locally on your machine.
- Data you process as a business through the Service, such as your own customers' chats and orders. For that data you are the controller and we are your processor, under our Data Processing Addendum (rysh.ai/dpa).
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | name, email, password hash, sign-in provider (Google or GitHub through Firebase, or your SSO provider) | you |
| Billing | billing name and address, VAT number, plan, invoices. Card details are handled by Stripe; we do not store them. | you, Stripe |
| Workspace and usage | workspaces, members and roles, API-key metadata (only a hash of the key), audit-log entries, usage and spend counters | the Service |
| Content | what you put into the Service: configurations, chatbot knowledge, website content, messages | you |
| Signup source | UTM tags, referrer and source, stored by us at signup | your browser |
| Analytics | pages viewed and device information, through Google Analytics 4 on rysh.ai, only if you accept analytics cookies | your browser |
| Communications | emails and support messages with us | you |
| Design-partner applications | the details you submit on the form | you |
We do not knowingly collect data from anyone under 18; the Service is for businesses.
4. Why we use it
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Provide the Service and your account | contract |
| Billing, tax and accounting | contract; legal obligation |
| Security, fraud prevention, audit logs | legitimate interests (keeping the Service and customers safe) |
| Improving the Service | legitimate interests |
| Site analytics through cookies | consent |
| Sales and service emails to business contacts | legitimate interests, with an opt-out in every message |
| Design-partner programme | consent, which you may withdraw at any time |
Where we rely on legitimate interests, we have weighed them against your rights; ask us at info@rysh.ai for details. You can withdraw consent at any time without affecting earlier processing.
We do not sell personal data and we make no decisions about you that have legal or similarly significant effects through solely automated processing. We do not use your content to train AI models ourselves. The AI model providers listed in section 6 handle content under their own terms.
5. AI processing
When you use AI features (chatbots, agents, meeting agents), the content needed for each request is sent to the AI model provider configured for that feature, to generate a response. Which provider is used depends on your configuration and is listed in section 6.
6. Who we share it with
We share data only with providers that help us run the Service, under written contracts, and with authorities where the law requires.
| Provider | Purpose |
|---|---|
| Stripe | payments and invoices |
| Mailgun | sending email (rysh and company sending domains) |
| Twilio | UK phone numbers, calls and SMS for the phone add-on |
| Google (Firebase Authentication) | Google and GitHub sign-in |
| Google Analytics 4 | site analytics (consent only) |
| Anthropic, OpenAI, Google (Gemini) | AI model responses, per your configuration |
| Deepgram | speech-to-text for voice and meeting features |
| LiveKit | rysh meeting rooms |
| Vercel and Cloudflare | site hosting and DNS for company websites |
| Amazon Web Services (AWS) | hosting for rysh.ai servers and database |
| Google Cloud | hosting for customers' company websites and services |
We may also share data in a sale or reorganisation of our business, with our professional advisers, and where we must by law.
Transfers outside the UK. Some of these providers process data outside the UK. We transfer data only where the UK has adequacy regulations for the destination (including through the UK Extension to the EU–US Data Privacy Framework for certified US providers), or under the UK International Data Transfer Addendum or Agreement, with other safeguards where needed. Ask info@rysh.ai for a copy of the safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | while your account is active. When you ask us to close it, we delete it within 30 days, or, if a paid period or a phone-number transfer is still running, within 30 days of that ending. Copies in our archive storage and database backups are erased within 30 days after that. |
| Company workspace content and transcripts | 30 days after the company is closed. Copies in our archive storage and database backups are erased within 30 days after that. |
| Billing, order and usage records | 6 years, because the law requires it |
| Enquiries received through company websites | 90 days |
| Company web address (no personal data) | held in quarantine for 180 days after closure |
We also keep one recovery image of our main server's disk, taken on 19 May 2026. It holds only data that existed on that date and is used only to restore the service after a failure. We will delete it by 31 March 2027. If we ever restore from it, we delete again any data that people asked us to delete after that date, before the service goes back online.
We may keep data longer where the law requires it or to deal with a legal claim.
8. Your rights
You can ask us to: give you a copy of your personal data; correct it; delete it; restrict or stop our processing; and give it to you in a portable format. Where we rely on consent you can withdraw it. Write to info@rysh.ai; we reply within one month. If you are not happy, tell us first so that we can put it right. You may also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
9. Security
We use appropriate technical and organisational measures to protect personal data. API keys are stored only as hashes. Access to production systems is restricted to authorised staff.
10. Cookies
On rysh.ai we use cookies that are strictly necessary (for example to keep you signed in), which need no consent, and analytics cookies (Google Analytics 4), which we set only if you accept them in the cookie banner. You can change your choice at any time from the cookie settings link in the page footer.
11. Changes
We will post updates here and email account owners about material changes.