Legal

Effective: October 8, 2026

Services

Services means the service described in the Enterprise Master Subscription Agreement.

For a Customer's Documents, prompts, Conversations, Output, and the personal information of that Customer's Users, including name and sign-in email, the Customer is the controller and Oil Rag is the processor. Those terms are in the Data Processing Addendum. The billing, security, and legal records that stay after the Subscription ends are disclosed in this Privacy policy. Those records are not a second role.

Opening the public site does not create a User, and Request a Demo is an email the site does not store.

Records

Billing records are the Billing email recipient and the Company's Subscription, invoices, and payment status. Card and bank account numbers are collected in Stripe-hosted fields.

Security records are the product audit of sign-in, User administration, Break-glass, Access Grants, and Document actions.

Legal records are the acceptance of the Enterprise Master Subscription Agreement: the Company, the accepting User, that User's role, the time in UTC, and the agreement's effective date.

Customer Feedback is Oil Rag's own record. The record is the message, the submitter's name, the sign-in email, and the Company.

Oil Rag notifies the Customer of a Security incident as the Data Processing Addendum states.

An EEA-to-US transfer of the covered personal information is handled in the Data Processing Addendum.

The Sub-Processors list names the providers. The Cookie policy states the cookies. The Security summary describes the controls.

How long we keep them

Oil Rag keeps billing, security, and legal records while it needs them for billing, security, or the agreement.

Customer Feedback stays until the submitter asks Oil Rag to delete it, or until Oil Rag no longer needs it to read the product inbox. Deleting the User does not delete the submission.

Requests

A request about a User's personal information is the Customer's request under the Data Processing Addendum.

A person writes to legal@oilrag.ai about the billing, security, and legal records, and about Customer Feedback.

Oil Rag confirms the writer before it discloses or changes a record. For a Company's billing, security, and legal records, the writer is a Customer Admin of that Company. The Billing email recipient is a Customer Admin. A Global Admin is not a writer for those records, including a Global Admin who accepted the agreement. For Customer Feedback, the writer matches the sign-in email on the submission.

Oil Rag may ask for the Company name and the request.

A reply states the categories this Privacy policy names, who the Billing email recipient is, and the Customer Feedback submissions that match the writer. The reply does not attach invoices, card or bank numbers, or the product-audit log.

Oil Rag will correct the Billing email recipient. Oil Rag does not rewrite an invoice, a product-audit event, the acceptance time, or the feedback text. A mistake in Customer Feedback is handled by deleting that submission.

Oil Rag will not delete billing, security, and legal records while they are still needed for billing, security, or the agreement. That limit does not apply to Customer Feedback. A person may ask that a submission be deleted.

Oil Rag replies to the confirmed request at legal@oilrag.ai. The reply may grant it or refuse it. If Oil Rag refuses, the person may reply to that message and ask for one further look.

Children

The service is for a User provisioned for a Customer. Oil Rag does not knowingly collect personal information from a child.

California

The categories are the billing records, the security records, the legal records, and Customer Feedback.

Billing records come from the Customer Admin and from Company billing. Card and bank account numbers come from Stripe-hosted fields. Security records come from the service. Legal records come from the accepting User at Start collection. Customer Feedback comes from the User who submits it.

Oil Rag uses billing records for Company billing, security records for security, and legal records for the agreement. Oil Rag uses Customer Feedback to read the product inbox.

Oil Rag does not sell personal information. Oil Rag does not share personal information for cross-context behavioral advertising, including for a person under 16.

A person may ask to know and to correct, using the path in Requests. Deletion stays inside the limits in Requests.

Oil Rag does not deny the service because someone made a request.

Card and bank details are used for Company billing.

A person uses that same path for another U.S. state law.

Changes

A later version applies when it is posted.

Contact

Questions go to legal@oilrag.ai.