Privacy Policy
Last updated 21 October 2026 · Version 2026-10-21
RACE AI is operated by its founder, Rishwi Thimmaraju, from Hyderabad, India. Our company is being incorporated; these pages will name it once it is registered, and these terms will move to it. This policy explains what we collect when you use raceai.tech and the RACE AI desktop app, why, who processes it for us, and your rights.
In short: we collect what we need to run RACE; we send your research to AI providers only to answer your requests; we never sell data or use your research to train AI; your data is stored in the United States; and you can download or delete everything from Settings.
1. Who is responsible
RACE AI is the data fiduciary (controller) for the personal data described here. Contact our Grievance Officer, Rishwi Thimmaraju, at support@raceai.tech or Creative Residency, SS Nagar, Habsiguda, Hyderabad, Telangana 500013, India. When a university or employer gives you RACE under a written agreement, that institution may be responsible for your account data and we process it on its behalf; its own privacy notice then also applies.
2. What we collect
| Data | Examples |
|---|---|
| Account | Name, email, password (stored hashed by Supabase), Google profile photo, and the field and role you choose during onboarding |
| Age check | That you confirmed being 18 or older, and when. The date of birth you enter at signup is used only for this check and is not stored. (A date of birth you choose to add to your profile is stored as part of your profile.) |
| Agreement records | Which Terms, Privacy Policy and Acceptable Use versions you accepted, when, your product-news choice, a hashed IP address and your browser type |
| Research content | Projects, chats, questions, uploaded files and PDFs, notes, code, LaTeX documents, Knowledge Discovery items and project memory |
| Usage | Features used, credits and tokens per request, model used, run status, errors and answer feedback |
| Billing | Plan, subscription status, payment history and invoices. Card and UPI details stay with the payment provider; we never see full card numbers. |
| Technical | IP address, device and browser type, error reports |
| Your API keys | Provider keys you add in Settings, encrypted before storage |
| Messages | Support emails and feedback |
We do not ask for sensitive data such as health, religion or caste. Do not put other people's personal data into RACE unless you are allowed to (see the Acceptable Use Policy).
3. Why we use it
- To run RACE (answer questions, search the literature, build Knowledge Discovery, compile documents, run code, keep project memory) — based on the consent you give at signup.
- To bill, keep tax records and prevent fraud — because the law requires it.
- To keep RACE secure and fix errors — a legitimate use under the DPDP Act.
- To send service emails (sign-in codes, billing and trial reminders, invitations, research briefs you switch on).
- To send product news — only if you tick the optional box; unsubscribe at any time.
We do not sell personal data, show ads, build advertising profiles, or use your content to train our own or anyone else's AI models. AI is not used to make decisions about you that have legal or similar effects.
4. AI processing
To answer a request, RACE sends the relevant prompt, files and project context to the AI model you or Auto chose: OpenAI (GPT models), Google (Gemini) or Anthropic (Claude). We use their paid business APIs, under which they do not train on your content; they may keep requests for a limited time to detect abuse, as their terms allow. RACE also summarises your projects into project memory so later answers have context; it is deleted with the project.
5. Who receives data
| Recipient | What | Where |
|---|---|---|
| Supabase | Database, files, sign-in | United States |
| Vercel | Hosting, code sandbox, cookieless page analytics | United States and global edge |
| OpenAI, Google, Anthropic | Prompts, files and context for each AI request | United States and other regions |
| Dodo Payments, Razorpay | Payments, tax and invoices | India and other regions |
| Resend | Emails we send you | United States |
| Sentry | Error reports without request bodies, cookies or sign-in headers | United States |
| OpenAlex, Semantic Scholar, arXiv, Crossref, Europe PMC, CORE, Unpaywall, Exa | Search queries only, not your files | Various |
| texlive.net | LaTeX source, only when our own compiler is unavailable | Germany |
| Project members | Content of projects you share with them | — |
Each provider processes data only to provide its service to us, under its data processing terms. We disclose data to authorities only when Indian law or a valid legal order requires it. If RACE changes hands, data moves with it under this policy and we will tell you.
6. Transfers outside India
Your data is stored and processed outside India, mainly in the United States, as the Digital Personal Data Protection Act, 2023 allows for countries the Government has not restricted. For people in the EU or UK, transfers rely on our providers' Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and research content | While your account is open |
| Items you delete | In Trash for 30 days, then deleted |
| Your account after you ask to delete it | Deleted 7 days after the request (you can cancel until then) |
| Agreement records | While your account is open |
| Payment and tax records | 8 years, as Indian tax and company law require, without your research content |
| Security logs | Up to 1 year |
| Error reports | Up to 90 days |
8. Security
We use HTTPS everywhere, encryption at rest, row-level security so each account sees only its own data and the projects shared with it, encrypted API keys, an isolated sandbox for code, signed payment webhooks, and access to production limited to named administrators. No system is perfectly secure. If a breach affects your personal data, we will tell you promptly in plain language and report it to the Data Protection Board of India and CERT-In as the law requires.
9. Your rights
Under India's Digital Personal Data Protection Act, 2023 (and the GDPR if you are in the EU or UK) you can:
- get a copy of your data: Settings, then Data & Privacy, then Download my data;
- correct or complete it in your profile;
- delete it: Settings, then Data & Privacy, then Delete account, or ask us;
- withdraw consent: switch off product news in Settings or use the unsubscribe link, or close your account (withdrawal does not undo processing already done);
- nominate someone to act for you if you die or cannot act;
- complain to our Grievance Officer and, if you are not satisfied, to the Data Protection Board of India (or your EU or UK data protection authority).
Email support@raceai.tech from your account email. We acknowledge within 48 hours and respond within 30 days.
10. Age
RACE AI is only for people aged 18 or over, and we check this at signup. If we learn that someone under 18 has an account, we close it and delete its data. Tell us at support@raceai.tech if you think this has happened.
11. Cookies
We use only essential cookies and browser storage: to keep you signed in, protect against forged requests and remember your preferences. Our page analytics are cookieless. We do not use advertising or cross-site tracking cookies.
12. Changes
We tell you about material changes by email and in the app at least 14 days before they apply, and ask for your agreement where the law requires.
Grievance Officer
Rishwi Thimmaraju, Founder and Grievance Officer · support@raceai.tech · Creative Residency, SS Nagar, Habsiguda, Hyderabad, Telangana 500013, India. We acknowledge complaints within 48 hours and resolve them within one month.