Privacy policy

Last updated: 30 September 2026

This policy explains how Rabona Tech LTD. (Rabona, we, us or our) handles personal data in connection with Rabona Intel and its websites, dashboards, APIs, embedded tools and related services (the Service).

This policy covers personal data for which Rabona decides the purposes and means of processing. Where Rabona processes personal data in Customer Data solely on a business customer’s instructions, the customer is the controller and our Data Processing Addendum applies. Rabona’s independent collection and analysis of material from public news sources is not Customer Data and is governed by Rabona’s own legal obligations.

1. Controller and contact details

Rabona Tech LTD. is the controller for the activities described in this policy. Before publication, qualified counsel must insert the company number, registered office, country of incorporation, privacy contact address and, if applicable, data-protection representative and supervisory authority details. The contact route must be operational and monitored before this draft is made public.

2. Personal data we collect

• Account data: name, work email, authentication records, verification status, organisation, role, team membership and invitation records.
• Commercial data: plan, subscription status, billing contact, transaction references, tax and invoice information, and Stripe webhook records used to reconcile subscription events. Payment-card data is handled by Stripe and is not intended to be stored by Rabona.
• Configuration and content: Saved Feed definitions, search filters, integration origins, support requests, feedback and other information submitted through the Service.
• Usage data: API-key identifier, endpoint, response status, request units, timestamps, feature use and account activity. Secret API-key values are intended to be shown only when created and stored as non-reversible verification material.
• Device and security data: IP address, user agent, session and cookie identifiers, request metadata, audit events, failed authentication, abuse indicators and diagnostic logs.
• Communications: messages with us and records of operational, security, billing and service notices.
• Public-source data: names and other information appearing in public news material, source metadata and derived classifications needed to provide the news-intelligence Service.

We do not intentionally collect payment-card security codes, government identifiers, biometric templates or children’s data through customer account features.

3. How we obtain data

We receive data directly from users and their organisations, automatically from browsers and integrations, from payment and email providers, from Cloudflare Turnstile when it protects a form against abuse, from public news sources and publisher pages, and from other users who invite a person to an organisation. Customers must ensure they are entitled to provide another person’s details.

4. Purposes and legal bases

• Contract: create accounts, authenticate users, provide plans and features, process subscriptions, support integrations and respond to service requests.
• Legitimate interests: secure and operate the Service, prevent fraud and abuse, diagnose faults, measure capacity and usage, improve relevance and quality, communicate with business users and protect Rabona, customers, publishers and third parties.
• Legal obligation: maintain financial records, respond to lawful requests, enforce rights and meet tax, accounting and regulatory duties.
• Consent: where required for optional marketing communications or non-essential cookies. Consent may be withdrawn without affecting earlier processing.

Rabona processes public-source data to provide business news intelligence, source discovery, structured Facts and provenance. This processing may rely on legitimate interests, subject to applicable rights, source terms, proportionality and safeguards. Automated labels assist retrieval and analysis; Rabona does not use them to make legal or similarly significant decisions about individuals.

5. Cookies and similar technologies

We use cookies or equivalent storage required for authentication, security, preferences and load protection. We do not claim to use advertising cookies or cross-site behavioural profiling. If optional analytics or marketing technologies are added, this policy and any consent controls must be updated before activation.

6. Sharing and subprocessors

We share personal data only as needed for the purposes above, including with:

• Cloudflare for website, edge, database, security infrastructure and Turnstile abuse prevention;
• DigitalOcean for managed database, compute and object-storage infrastructure;
• Stripe for checkout, billing, fraud prevention and subscription administration;
• Resend for transactional and operational email;
• OpenAI for automated classification of source material where that processing is enabled;
• professional advisers, auditors, insurers and authorities where reasonably necessary or legally required; and
• a buyer, investor or successor in connection with due diligence, financing, reorganisation or a business transfer, subject to appropriate confidentiality.

We do not sell personal data. We do not share Customer account data with publishers merely because their material appears in Service results. The final subprocessor list and links to provider privacy terms must be confirmed against production configuration before publication.

7. International transfers

Providers may process data outside the country where a user is located. Where required, Rabona will use an adequacy decision, approved contractual clauses or another lawful transfer mechanism, together with supplementary measures where appropriate. The applicable DPA describes transfers for processor activities.

8. Retention

We retain account and configuration data while needed to provide the Service and for a reasonable period after closure for security, dispute, backup and legal purposes. Billing and tax records are kept for legally required periods. Security, audit and usage records are kept only as long as reasonably necessary for fraud prevention, capacity, billing, enforcement and incident investigation. Public-source records and derived facts may be kept to preserve provenance, corrections, deduplication and the integrity of the news record, subject to applicable law and rights.

Raw publisher snapshots and extracted objects may have shorter operational retention than derived metadata. Deletion from active systems may not immediately remove data from encrypted backups, which are isolated and expire under backup schedules. Counsel and engineering must approve and document the final category-specific retention schedule before publication; this policy does not promise an unimplemented deletion period.

9. Security

We use measures designed to protect data, including access controls, separation of public and privileged surfaces, protected credentials, transport encryption, scoped service roles, input and rate controls, and security-relevant logging. No system is completely secure. Users must protect credentials, use authorised devices and promptly report suspected compromise.

10. Individual rights

Depending on location, a person may have rights to access, correct, delete, restrict or object to processing; receive portable data; withdraw consent; or complain to a supervisory authority. Rights can be limited by law, the rights of others, freedom of expression and information, and Rabona’s need to establish or defend legal claims. We may verify identity and authority before acting.

Requests concerning Customer Data should first be sent to the relevant customer, which controls that data. Requests concerning public news material should identify the person, source URL, Rabona result and requested correction or action so provenance and competing rights can be assessed.

11. Business users and children

The Service is intended for business users aged 18 or over and is not directed to children. If we learn that a child’s account data was submitted contrary to this policy, we will take appropriate steps to remove it. Public-source reporting that concerns a minor is handled as source material rather than an account created by that minor and may require a separate rights assessment.

12. Automated processing

Rabona uses automated systems to extract, group, classify, summarise and reconcile public-source material and to detect abuse or account risk. These systems may produce inaccurate inferences. They are not used by Rabona to make decisions producing legal or similarly significant effects about account holders. Customers must not use Service output for such decisions unless they independently satisfy all legal requirements, including human review where required.

13. Changes to this policy

We may update this policy as the Service, providers or law change. We will post the updated date and give additional notice where a change is material or law requires it. Earlier versions may be retained for audit and dispute purposes.