Privacy Policy

Introduction

This Privacy Policy explains how ReaperAgent, LLC, a Delaware limited liability company, doing business as Reagent ("we," "us," or "our"), collects, uses, and protects your personal information when you use our audio automation tool for REAPER. We are committed to protecting your privacy and handling your data transparently.

Information We Collect

Account Information

When you create an account, we collect:

• Display name
• Email address
• Password (stored securely via Supabase)

Payment Information

When you subscribe to a paid plan, billing information is processed by our payment provider, Polar (which uses Stripe). We do not store your full credit card details on our servers.

Contact Form Data

When you contact us through our website, we collect your name, email address, subject, and message content.

Analytics Data

We use PostHog to understand how our website and desktop application are used. This includes page views and navigation, and automatically captured interaction events such as clicks and form interactions. Analytics may be collected for anonymous visitors as well as signed-in users; for anonymous visitors, an analytics identifier cookie may be set.

When you are signed in, we associate analytics events with your account and profile attributes, which may include your email address, display name, professional status, experience level, primary use cases, and subscription tier. We also collect error-diagnostic information, including error messages and stack traces, to help us fix problems.

We do not record session replays of your screen, and we do not send the content of your AI conversations to our analytics provider. Enterprise-organization users are excluded from behavioral analytics (see "Enterprise Data Handling" below).

Technical Data

We use cookies for session management and authentication purposes.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your subscription and payments
• Send you important updates about your account
• Respond to your inquiries and support requests
• Analyze usage patterns to improve user experience
• Protect against fraud and unauthorized access

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: To provide our services and fulfill our agreement with you
• Consent: Where you have given explicit consent for specific processing
• Legitimate Interest: To improve our services and protect against fraud
• Legal Obligation: To comply with applicable laws and regulations

Third-Party Services

We share data with trusted third-party services to operate our platform:

• Supabase: Authentication, database, and temporary file storage
• Vercel: Application and website hosting, and the AI Gateway that routes model requests (your text prompts and transcripts transit the AI Gateway on their way to Anthropic and Google)
• Anthropic: AI language model provider (Claude) for processing text-based commands
• Google: AI analysis provider (Gemini) for dialogue analysis and translation using text transcripts only
• ElevenLabs: Cloud-based speech-to-text transcription for dialogue editing features
• Voyage AI: Text embeddings for documentation search (receives your search-query text)
• WorkOS: Enterprise SAML single sign-on (SSO)
• Polar: Subscription management and billing
• Stripe: Payment card processing (used by Polar)
• PostHog: Product analytics
• Resend: Transactional and contact-form email delivery

We also rely on infrastructure vendors that receive only operational data, such as Mintlify (documentation hosting) and GitHub (application updates and avatar images). These services have their own privacy policies and are contractually bound to protect your data. For the authoritative, versioned list of subprocessors — including the data each receives and where it is processed — see our Subprocessors page.

AI Processing & Model Training

Reagent uses Anthropic's Claude models to process your text-based commands and generate responses. Model requests are routed through the Vercel AI Gateway to the model provider. For most features, only text commands and metadata are sent to the cloud—your audio files stay on your machine.

Dialogue editing is the exception. When you use the dialogue editing feature, your audio is temporarily uploaded to our secure cloud storage, sent to ElevenLabs for speech-to-text transcription, and immediately deleted after processing. The resulting text transcript (not audio) is then sent to Google Gemini for content analysis. Audio files are never permanently stored in the cloud and are automatically purged within one hour as an additional safeguard.

Your data is not used to train AI models. Anthropic, ElevenLabs, and Google do not use API inputs or outputs to train their models. Your conversations, audio, and transcripts remain private.

For more details on Anthropic's data practices, see their official data usage policy.

Enterprise Data Handling

Members of an enterprise organization are subject to additional, more restrictive data handling:

• Single sign-on: Enterprise members authenticate through their organization's SSO, provided via WorkOS. We store only the member's email address and organization membership; we do not store names, identity-provider IDs, or other SAML attributes. WorkOS processes the SAML assertion (which may include the member's name) in transit.
• Your own model endpoint: Enterprise members connect their own model endpoint, and model requests are routed to that endpoint rather than through our servers. Prompt and conversation content for enterprise members does not reach Reagent's servers or our model providers.
• No audio or file egress: The transcription, feedback, and documentation-search features that would send content to our servers are disabled for enterprise members, so dialogue audio is not uploaded. Uploads of transcription audio by enterprise members are additionally denied at the database layer.
• No behavioral analytics: Behavioral analytics are disabled for enterprise members in the desktop application.
• Minimal authentication logging: We keep an authentication audit log that records only an account identifier, the event type, the organization, and a timestamp. It does not record IP addresses or user-agent information.

Cookies and Tracking

We use essential cookies for:

• Session management and authentication
• Remembering your preferences
• Security and fraud prevention

We also set an analytics cookie to measure usage. This analytics identifier may be set for all visitors, including anonymous (logged-out) visitors, not only signed-in users.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal data within 30 days, except where we need to retain certain information for legal or legitimate business purposes.

Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Request transfer of your data in a machine-readable format
• Restriction: Request limitation of processing
• Objection: Object to processing based on legitimate interests

Your Rights (CCPA)

If you are a California resident, you have the right to:

• Know: Request information about data collection and use
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale of personal information (we do not sell your data)
• Non-Discrimination: Not be discriminated against for exercising your rights

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (HTTPS), secure password hashing, and regular security reviews. However, no method of transmission over the internet is 100% secure.

International Data Transfers

Our services and subprocessors process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. We do not currently offer a regional (for example, EU) data-residency option. We rely on our service providers' compliance with applicable data protection frameworks for these transfers. See our Subprocessors page for where each provider processes data.

Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us through our contact page.

ReaperAgent, LLC
1908 Thomes Avenue, STE 50007
Cheyenne, WY 82001