Privacy, in plain view.

1. Scope and updates to this Privacy Notice

This Privacy Notice applies to information processed by us, including on our websites, browser extensions, applications, and other online or offline services and offerings (collectively, the "Services").

Changes to our Privacy Notice

We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Notice if you continue to use our Services after the new Privacy Notice takes effect.

2. Information We Collect

The categories of information we collect depend on how you interact with us and our Services. We collect information that you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below. We limit collection to information needed to provide, secure, support, and improve the Services.

A. Information You Provide to Us Directly

You may provide personal information when creating an account, configuring Rover, purchasing a plan, contacting support, or otherwise using the Services.

• Account Information: You may provide information in connection with the creation or administration of your account, such as a name, email address, authentication identifier, organization, and account preferences.
• Purchases: We do not directly collect or store payment card information. Payments are processed by third-party payment processors, and we may receive confirmation of the transaction.
• Communications: If you contact us for support, we collect the contact details and message content needed to investigate and respond.

B. Information Collected Automatically

We may collect information automatically when you use our Services.

• Automatic Collection of Usage Data: We may automatically collect information regarding your use of our Services, such as pages that you visit before, during, and after using our Services, items that you search for via the Services, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services.
• Cookie Policy: We, as well as third parties that provide content or other functionality on our Services, may use cookies, pixel tags, and other technologies to automatically collect information through your use of our Services.

C. Information Collected from Other Sources

Third-Party Services and Sources: We may obtain information about you from other sources, including through third-party services and organizations.

Retention and usage of 3rd Party data: Any information obtained via any 3rd Party API integration, including, but not limited to Google Drive, Google Mail, and others, will only be used for providing and improving automation features of the product as instructed by the user. This data will not be used for training of any generalized AI models, internal or external.

D. Rover AI for Webflow

When you install Rover AI from Webflow, we receive your authorized profile, basic details of the selected site, and the OAuth permissions you approve, and we store the encrypted credentials, configuration, and operational records needed to deploy, operate, update, and uninstall Rover.

The Webflow App requests only the permissions needed to install and operate Rover, and Rover is designed not to inspect, collect, transmit, or act on login, password, authentication, or payment-entry fields on a published site.

3. How we use your information

We use the collected information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

A. Provide Our Services

• Creating, authenticating, and managing your account
• Providing access to certain areas, functionalities, and features of our Services
• Answering requests for customer or technical support
• Communicating with you about your account, activities on our Services, and policy changes
• Processing payments through third-party payment processors

B. Administrative Purposes

• Pursuing our legitimate interests such as direct marketing, research and development
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity
• Measuring interest and engagement in our Services
• Improving, upgrading, or enhancing our Services
• Developing new products and services
• Ensuring internal quality control and safety

C. Marketing and Advertising

We may use account and usage information to provide product communications and relevant content as permitted by applicable law. We do not sell personal information for money, and outside of Free Mode we do not share personal information with third parties for advertising. When Free Mode is on (it is how the free plan runs, and optional on paid plans), sponsored content and, on the cloud platform, licensing of de-identified workflow data apply to Free Mode tasks as described in Section 5 — and, on the cloud platform only, personal information may be shared with our advertising partner as described in Section 5F that you can opt out of at any time.

4. How we disclose your information

We may disclose information to infrastructure, authentication, payment, analytics, communications, and AI service providers acting on our behalf; to a customer organization that administers your account; or as otherwise described below. We require service providers to process information only for the contracted purpose and subject to appropriate safeguards.

A. Disclosures to Protect Us or Others

We may access, preserve, and disclose any information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to comply with law enforcement or legal process, protect rights, property, or safety, or enforce our policies.

B. How we protect your information

We use technical and organizational safeguards appropriate to the nature of the information, including transport encryption, access controls, audit logging, and encryption of stored integration credentials. No security measure is perfect, and we continually review and improve these safeguards.

5. Free Mode data and sponsored content

Free Mode is how the free plan runs our AI agent without spending credits, and an option on paid plans: AI inference and cloud browser hosting for Free Mode tasks costs zero credits and is supported by sponsored content and, on the cloud platform only, licensing of de-identified workflow data. Free Mode applies only to tasks you run while Free Mode is on. Tasks billed with credits are excluded from sponsored content and from data licensing.

A. Your choice

• Your acknowledgement: Before your first Free Mode task we show a one-time dialog with these terms. On the free plan you continue, or view paid plans; on a paid plan you choose "Enable Free Mode" or "Use credits." Your decision is recorded, and if we materially change what Free Mode involves, we show the dialog again before Free Mode is used.
• Turning it off: On a paid plan you can turn Free Mode off at any time in the model picker; on the free plan, ad-free runs require a paid plan, while running tasks on your own API key keeps the model call on your provider account. Turning Free Mode off stops sponsored content and, on the cloud platform, ends data licensing for future tasks. Turning off Free Mode on a paid plan never limits the Services — tasks simply use credits.

B. Sponsored content (browser extension and cloud platform)

When Free Mode is on, we may show clearly labeled sponsored cards or prompts alongside a task and beneath its results. Sponsored content is contextual, not personalized: it is matched to your agentic interaction, and we do not build advertising profiles or use your browsing history for ad targeting.

To request, deliver, and measure sponsored cards as well as to prevent fraud and abuse, we and our advertising partners may process an excerpt of your agentic interaction, device-generated advertising identifiers, and privacy-compliance signals. On the cloud platform only, an advertising partner may also receive limited personal information as described in Section 5F. Sponsored images and measurement requests may load from partner servers.

C. Data licensing (cloud platform only)

On the cloud platform, Free Mode is additionally supported by our use of de-identified records of Free Mode tasks to build derived simulation environments, which we may license to third parties. What we license are these derived, de-identified environments: we are interested in how tasks get done, not in who ran them, and we do not sell your account data or your identifiable workflows. We may receive revenue from these licenses.

• Scope: Only cloud tasks run in Free Mode are eligible. Tasks billed with credits, tasks run in Private Mode, and all browser-extension tasks are excluded — Free Mode in the browser extension involves sponsored content only, with no data licensing.
• De-identification: Before task records are used this way, we take measures designed to prevent them from being linked to you or your account, we use and license them only in de-identified form, and we contractually prohibit recipients from attempting to re-identify them or from using them to identify or contact any individual.
• Ending it: Turning Free Mode off ends this use for future tasks. Derived products already created or licensed in de-identified form cannot be recalled.

D. Regional privacy signals

• California: Declining or turning off Free Mode stops sponsored-content requests entirely and is recorded as a "Do Not Sell or Share" preference. Sponsored-content requests carry your opt-out status, and we honor the Global Privacy Control signal as described in Section 6.
• EEA/UK: For traffic we identify as likely from the EEA or UK, sponsored content stays contextual only.

E. Zero Data Retention (Private Mode)

Private Mode, available on Enterprise and Scale plans, is our Zero Data Retention option: it is our strict in-memory processing option designed to keep task content out of server-side logs and content storage. Private Mode tasks are excluded from Free Mode's zero-credit billing and from data licensing.

F. Personal information shared with our advertising partner (cloud platform only)

On the cloud platform (rtrvr.ai/cloud) only, when Free Mode is on and you have accepted the current Free Mode disclosure, we may share limited personal information associated with your account with an advertising partner so it can select and measure the sponsored content that funds Free Mode. We do not use it to build advertising profiles, we contractually limit the partner to selecting, delivering and measuring sponsored content on our Services, and the browser extension never shares account information.

• Turning it off: At any time, without affecting Free Mode or the Services — turn off "Share data with ad partner" under Settings → Sponsored cards in the cloud dashboard, or enable the Global Privacy Control signal in your browser. Each is honored for your signed-in account, not just one browser, and once you opt out we will not ask you to turn sharing back on.
• California: This sharing may be a "share" or "sale" of personal information under the CCPA/CPRA; any of the routes above is your "Do Not Sell or Share" request for it. We do not knowingly share personal information of anyone under 16.
• EEA/UK: Never shared for users we identify as located in the European Economic Area or the United Kingdom, where sponsored content remains contextual only.

6. Your privacy choices and rights

Your Privacy Choices

• Email Communications: You can use the unsubscribe link found at the bottom of emails to opt-out of receiving future emails.
• Text Messages: You may opt-out of receiving future text messages by following the instructions in the text message.
• Website cookies: Necessary cookies support sign-in, security, and preferences. Google Analytics and our own analytics measure visits, acquisition channels, and product use. Analytics and advertising cookie preferences start enabled unless you have opted out or your browser sends Global Privacy Control. Use Cookie settings here or in the site footer to reject optional cookies or change your choice. We remember your choice for up to six months. Dismissing the prompt does not change your settings or record consent. Advertising cookies, where offered, are used to personalize ads and measure their performance; you can control them separately from analytics. Saving a preference does not install a tag or establish consent for future providers; we will disclose providers and purposes when applicable. Withdrawal stops new optional website collection and clears its browser identifiers; it does not delete data previously collected. Essential service, security, billing, and operational records remain separate, as do Free Mode sponsored cards and their account privacy settings. We process the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of personal information — automatically, with no further action needed from you — for that browser and, when you are signed in, for your account. Sharing with our advertising partner (Section 5F) can also be turned off at any time under Settings → Sponsored cards in the cloud dashboard.

Your Privacy Rights

In accordance with applicable law, you may have the right to:

• Confirm Whether We Are Processing Your Information
• Access to and Portability of Your Information
• Request Correction of your information where it is inaccurate or incomplete
• Request Deletion of your information
• Request to Opt-Out of Certain Processing Activities
• Withdraw your Consent to our processing of your information

7. International transfers of information

All information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

8. Retention of information

We store the information we collect as described in this Privacy Notice for as long as you use our Services, or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws. Retention periods vary by category and purpose. Integration credentials, such as OAuth tokens, are kept only while the integration is in use and are deleted after uninstall. You may request deletion subject to legal, fraud-prevention, security, and accounting obligations.

9. Supplemental notice for California residents

This Supplemental Notice for California Residents supplements our Privacy Notice and only applies to our processing of information that is subject to the California Consumer Privacy Act of 2018 (as amended from time to time) ("CCPA").

Additional Privacy Rights for California Residents

• Opting Out: California residents have the right to opt-out of the "sale" of information and the "sharing" of information for "cross-context behavioral advertising."
• Free Mode: Sponsored content and, on the cloud platform, data licensing apply only to tasks run in Free Mode with your consent, as described in Section 5. Declining or turning off Free Mode stops sponsored-content requests and is recorded as a "Do Not Sell or Share" opt-out for those features; where you have made no Free Mode choice, we treat the Global Privacy Control browser signal as an opt-out.
• Advertising partner sharing (cloud platform): As described in Section 5F, sharing limited personal information with our advertising partner may be a "share" or "sale" of personal information. You can opt out at any time via Settings → Sponsored cards or the Global Privacy Control signal; each is honored for your signed-in account.
• Minors Under 16: rtrvr.ai does not have actual knowledge of any "sale" of information of minors under 16 years of age.
• Sensitive Personal Information: rtrvr.ai only uses and discloses sensitive personal information for specific permitted purposes.
• Non-Discrimination: California residents have the right not to receive discriminatory treatment for exercising their CCPA rights.

10. Supplemental notice for Nevada residents

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal information to third parties. Please note that we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A.

11. Children's information

The Services are not directed to children under 16 (or other age as required by local law), and we do not knowingly collect or store personal information from children. If we become aware that a child has provided us with personal information in violation of applicable law, we will delete any personal information we have collected and terminate the child's account, if applicable.

12. Other provisions

Third-Party Websites/Applications

The Services may contain links to other websites/applications and other websites/applications may reference or link to our Services. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact.

Supervisory Authority

If your personal information is subject to the applicable data protection laws of the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority if you believe our processing of your personal information violates applicable law.

13. Contact us

rtrvr.ai is the controller of the information we process under this Privacy Notice.

If you have any questions about our privacy practices or this Privacy Notice, or to exercise your rights as detailed in this Privacy Notice, please contact us at: