Legal

Privacy Policy

Last updated: August 26, 2026

1. Introduction

This Privacy Policy explains how Rixora ("we," "our," or "us") collects, uses, shares, and protects personal data when you visit RixoraAgency.com or use our services (the "Service"). For data you provide and content you create in the Service, we act as a controller for account and billing data and as a processor for the content you submit. The data controller is Rixora Agency LLC, 4089 Palmetto Drive, Lexington, Kentucky 40513, USA.

2. Data We Collect

  • Account data: name, email, password (hashed), company name, and profile details.
  • Billing data: subscription plan, transaction history, and payment metadata. Card details are handled by Stripe; we do not store full card numbers.
  • Content & prompts: business information, brand inputs, prompts you submit, and AI-generated output you create and store.
  • Usage data: pages viewed, features used, device and browser information, and IP address.
  • Cookies & similar technologies: used for authentication, preferences, and analytics (see Section 7).

3. How We Use Data

  • To provide, secure, and operate the Service and your account;
  • To process AI generations you request and store your content;
  • To process payments, subscriptions, and credits;
  • To provide support and send service and transactional communications;
  • To analyze and improve the Service and prevent abuse and fraud; and
  • To comply with legal obligations.

4. Legal Bases (EEA/UK)

Where applicable, we rely on: performance of a contract (to provide the Service and billing), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional analytics/marketing cookies where required), and legal obligation (for tax and compliance).

5. AI Processing

When you use AI features, your prompts and relevant context are sent to third-party AI providers to generate output. We do not sell your prompts or output. We instruct our AI providers to process this data to deliver results and, where applicable, subject to their terms; we do not authorize them to train foundation models on your content where an opt-out is available to us.

6. Subprocessors

We share data with trusted service providers ("subprocessors") who process it on our behalf under appropriate agreements. The providers active for the Service may include:

  • Supabase — database, authentication, storage, and serverless functions (hosting of account and content data).
  • Stripe — payment processing and subscription billing.
  • Resend — transactional and account email delivery.
  • OpenRouter and underlying AI model providers — AI text and image generation.
  • Cloudinary — media storage and delivery (where enabled).
  • PostHog — product analytics.
  • Sentry — error monitoring and diagnostics.
  • Google — fonts, analytics, and sign-in (where enabled).

This list reflects the providers currently enabled and may be updated as the Service evolves. We do not sell your personal data.

7. Cookies

We use strictly necessary cookies for authentication and core functionality, and, subject to consent where required, analytics cookies to understand usage. You can control non-essential cookies through your browser settings or any in-product consent controls we provide.

8. International Transfers

Your data may be processed in countries other than your own, including where our subprocessors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

9. Data Retention

We retain account and content data for as long as your account is active and as needed to provide the Service. After account closure we delete or anonymize personal data within a reasonable period, except where we must retain it to comply with legal, tax, accounting, dispute-resolution, or security obligations. You may contact us for details about the retention period applicable to your data.

10. Security

We use industry-standard measures including encryption in transit, access controls, and tenant isolation to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent. To exercise these rights, contact us at contact@rixoraagency.com. You may also lodge a complaint with your local data protection authority.

12. Data Processing Agreement

Business customers who require a Data Processing Agreement (DPA) for the content they process through the Service may request one at contact@rixoraagency.com.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date and, where appropriate, communicated to you.

15. Contact

For privacy questions or requests, contact us at contact@rixoraagency.com.