Privacy policy

NextGen Software Ltd trading as Ratelytics (“Ratelytics”, “we”) operates ratelytics.io. This policy says what we collect, why, where it lives, and how to take it away. It is written to be read.

The one-line version

Ratelytics has read-only access to usage metadata. No prompt or content data is ever collected: the keys you connect are not capable of exposing it.

What we collect

• Account data: email address, optional name, sign-in method (magic link). No passwords exist.
• Affiliate details, if you become one (optional, and only for people who ask to join the referral programme): name, email address, company and country if you give them, and the payout method and payout reference you want us to pay you with — for most people a bank sort code and account reference. We hold these because we cannot pay you without them. They are entered by us, on your instruction, and are visible only to the addresses on our admin allowlist; they are never shown to customers, never used for marketing, and never shared with a customer you refer. If you are a customer who arrived through a referral link, what we record is the code and the affiliate it belongs to — not anything about them, and nothing extra about you.
• Usage metadata from providers: dates, model names, token counts, costs, API key identifiers and project identifiers. These are the numbers on your bill, never the content behind them.
• A file you upload before you have an account (the free autopsy teaser, optional): if you try the teaser on ratelytics.io/autopsy, your CSV is read in memory to compute the result and is never written to storage in any form. What we keep is only the computed findings: totals, model and key names, and the dates your file covered. They are held against a random session token for two hours so that a purchase can attach them to your new workspace. The token is not linked to an email address, an IP address or a device fingerprint. Nothing is kept if you do not buy.
• A one-way fingerprint of your network address, to stop abuse: public pages that accept a file, namely the free autopsy teaser, cap how many uploads one network can make in an hour. Doing that needs to recognise repeat requests, so we take your IP address, mix it with a secret that changes every day, and keep only the resulting hash. The address itself is never written down, and yesterday’s hashes cannot be matched to today’s. We store a count per hash per hour, not a record of individual requests, so there is no log of when you did anything. It is held in its own table with no key in common with your uploaded findings and no way to join the two, which is why the sentence above stays true: the token that holds your result is not linked to your address. The counts are needed for the hour they cover and are deleted by the next hourly clean-up, so they exist for at most two hours.
• Revenue metadata from Stripe (Company mode, optional): customer names, emails, subscription amounts and statuses, read with a restricted key you create.
• Product analytics: feature events tied to your workspace (for example “autopsy generated”), and the campaign parameters (utm_source, utm_medium, utm_campaign) from the link you arrived by. No advertising trackers, no cookies requiring a banner.

What we never collect

• Prompts, completions, files, embeddings or any model input/output.
• Provider billing credentials or card details (provider keys are usage-scope only).
• Your customers' payment details (Stripe restricted keys cannot read them).

How keys are protected

Provider keys and webhook URLs are encrypted at rest with AES-256-GCM under a key held only in the server environment, decrypted server-side at sync time, displayed masked, and stripped from logs by a redaction layer. Deleting a connection destroys its key immediately.

Legal bases

Contract (running the service you signed up for), steps taken at your request before entering a contract (the free autopsy teaser: you ask for it by choosing a file, and it exists only to show you what the paid report would contain), legitimate interest (security, abuse prevention including the hourly upload caps described above, product analytics), and consent where required (marketing emails: each has a one-click unsubscribe). Affiliate details are held on the basis of contract — the referral agreement between us — and, for the payout records specifically, legal obligation, because we are required to keep records of money we have paid out.

Subprocessors

• Vercel: hosting
• Neon: PostgreSQL database
• Stripe: payments and billing
• Resend: transactional email

Retention and deletion

Data lives as long as your workspace does. Deleting a workspace (Settings → Data, typed confirmation) hard-deletes every row and key after a 24-hour cancellation window, confirmed by email. The full CSV export is available on every plan, any time.

Affiliate records do not follow a workspace, because an affiliate does not have one. If you leave the referral programme we delete your payout method and payout reference on request and stop using your details for anything else. We keep the record of commissions and payouts already made for six years, which is the period UK company records must be retained for; that record is the amounts and dates, and it is kept because it is an account of money that moved.

The abuse-prevention counts described above are deleted by the same hourly job, and are never retained beyond the two hours the hourly cap needs. They are not exported, not shared, and not used for anything except refusing the next upload.

The free autopsy teaser is the one thing that exists before a workspace does, so it has its own rule. The uploaded file itself is never stored. The computed findings are deleted within two hours of being produced, whether or not you buy, by the same hourly job that runs every other deletion. Two hours is not an arbitrary figure: it is the one-hour lifetime we set on the payment page, plus the hourly clean-up’s worst-case wait before it collects the row. To remove a teaser sooner, close the tab and email privacy@ratelytics.io with the reference shown on the result page; there is no account to sign in to, so that reference is the only way we can find it.

Your rights

The UK GDPR set: access, rectification, erasure, portability, restriction, objection. Most are self-serve (export, delete); for the rest, email privacy@ratelytics.io. If you used the free autopsy teaser there is no account to sign in to, so quote the reference from the result page and we will delete it on receipt. Otherwise it goes on its own within two hours. You may also complain to the ICO.

Governing law

This policy and any dispute under it are governed by the laws of England and Wales, and NextGen Software Ltd trading as Ratelytics is the data controller.

Changes

Material changes are announced by email and in the changelog before they take effect. The date at the top is the date that counts.