Privacy Policy

Last updated: 14 October 2026

This policy explains what personal information Raff collects, why, who we share it with, how long we keep it and what you can do about it. It covers our websites (rafftechnologies.com and its subdomains, including app, api, docs, marketplace and mcp), the Raff dashboard, the Raff API, the CLI and Terraform provider, and the Raff MCP server that connects AI assistants to Raff.

1. Who we are

Raff is operated by two companies under common ownership:

• Raff Technologies LLC, 30 N Gould St #48506, Sheridan, Wyoming 82801, United States
• Dynamis Teknoloji Anonim Şirketi, Beytepe Mah. 5399 Sk. No: 1 B İç Kapı No: 133, Çankaya/Ankara, Türkiye (MERSİS: 0323136402600001)

The company you contract with depends on your billing address, as set out in our Terms of Service: Dynamis Teknoloji A.Ş. if your billing address is in Türkiye, Raff Technologies LLC everywhere else. That company is the controller of your personal information under this policy. The two companies share the platform, infrastructure and support team, so each processes personal information on behalf of the other.

2. Two kinds of data

Information about you. Your account, billing details, how you use Raff, and your conversations with us. We decide how this is used, and this policy describes it.

Customer Content. Everything you put into the services: files and software on your servers and volumes, data in your managed databases, objects in your buckets, code, images, environment variables and logs of your Raff Apps and Functions, and workloads in your Kubernetes clusters. You decide what it is and how it is used. We process it only to run the services for you, as set out in our Data Processing Addendum. If your Customer Content contains personal information about other people, you are responsible for it, and those people should contact you first.

We do not look through Customer Content, sell it, use it for advertising or use it to train AI models. We access it only when:

• you ask us to, for example in a support request, and give us access;
• it is needed to keep the service running or secure, for example to restore a server, investigate abuse reported under our Acceptable Use Policy or stop an attack;
• the law requires it.

3. Information we collect

3.1 Account and sign-in

• Email address and password. Passwords are stored by our sign-in provider as one-way hashes; we never see them.
• If you sign in with Google or GitHub: your name, email address and profile picture from that provider.
• Your display name and profile picture, if you add them.
• Your phone number, which we verify by SMS before you can buy services.
• Two-factor authentication through an authenticator app. We store that the factor exists, not your codes.
• At onboarding: how you heard about Raff, the version of the Terms you accepted and any referral code.
• If you are invited to a team: your email address, from the person who invited you.

3.2 Billing

• Name, company name, billing address, country, tax or VAT number, and whether the account is personal or business.
• Payment cards are entered directly on the payment page of Airwallex or, for payments in Türkiye, Garanti BBVA. We receive only the card brand, the last 4 digits, the expiry date and the payment result. We never receive or store the full card number or security code.
• Invoices, payments, account balance, credits, coupons and usage of each service.

3.3 Using Raff

• The resources you create (servers, databases, buckets, clusters, Apps, Functions and others) and their settings.
• Usage measurements, such as server hours, storage and traffic, which we need for billing and capacity.
• An activity record (audit log) of actions taken in your account through the dashboard, the API, the CLI, Terraform or an AI assistant. Each entry records who acted, when, from which IP address and browser or client, and what was requested. Secrets such as passwords and keys are removed before the entry is saved.
• When you last signed in.

3.4 Security and fraud prevention

• IP addresses of requests to our websites and API.
• When you finish onboarding: basic information about your browser and device (browser type, language, platform, screen size, time zone and number of processor cores). We use it to detect fake and duplicate accounts.
• At sign-up, a Cloudflare Turnstile check that you are a person.
• To block disposable email addresses, we send only the domain part of your email address (for example, gmail.com) to UserCheck.

3.5 Support and messages

• Support chat and email conversations, including attachments you send, ratings and comments. If you use the chat without an account, we collect the email address, name and messages you give us.
• Answers you give in short surveys, such as satisfaction scores or the reason you deleted a resource.
• Whether our emails were delivered, opened or clicked, so we can fix delivery problems and stop sending emails nobody reads.
• If you turn on browser notifications: the notification address your browser gives us and a device label.

3.6 Websites and dashboard

• Visit counts without cookies: we count every visit, for everyone, without storing anything on your device: Cloudflare Web Analytics, and PostHog in a mode that keeps nothing on your device.
• Product analytics (PostHog): pages viewed, the campaign that brought you (UTM tags), key steps such as sign-up and checkout, and session recordings that show how pages are used. Recordings hide everything typed into forms, and in the dashboard they hide all text. When you are signed in, analytics are linked to your user ID and email address.
• Google Analytics and advertising measurement (Google Ads and Meta): page views and the sign-up, checkout and purchase steps, so we can see which pages and ad campaigns work. For conversions, Google receives your email address and phone number in hashed form.
• Error reports (Sentry): technical details when the dashboard or website fails, linked to your user ID and email address.

Your choice. If you are in the EEA, the UK, Switzerland or Türkiye, we ask first: analytics and advertising cookies are used only after you accept, and Meta is not loaded until then. Everywhere else they are on by default. Wherever you are, you can change your choice at any time with Cookie settings at the bottom of our website. When analytics and advertising are off, we still count your visit without cookies, Google receives only signals without cookies, and we do not link analytics to your name or email. See our Cookie Policy.

3.7 Agents inside your servers

Some features run a small Raff program inside your server. They send us only what the feature needs:

• Browser terminal (Linux servers): connects your server to the terminal in the dashboard. It sends the server's ID, hostname and agent version. It does not record terminal sessions.
• Raff Guardian (Windows servers, when you turn it on or use Raff Keep): sends health and security information about the server, so we can show it to you and carry out actions you approve. This includes disk space, updates, services and installed applications, firewall and antivirus status, certificates, backups, licence status, the list of Windows user accounts, and failed sign-in attempts with their source IP addresses. It does not read your files or documents.

3.8 AI assistants and the Raff MCP server

See section 6.

3.9 Information from other sources

• Google or GitHub, when you sign in with them (section 3.1).
• GitHub, when you connect it to deploy Raff Apps or Functions: your GitHub username, the repositories you allow, and the source code you choose to deploy.
• Payment providers: payment status and fraud signals.
• Business contacts: if you contact our sales team or fill in a form such as the Windows migration request, we keep your name, email address, company and message.

4. How we use information and our legal bases

5. AI features in Raff

• Raffy, our support assistant, answers support chats and emails. To do this it sends the conversation (up to the last 20 messages), your account name and, if you attach a server to the chat, that server's status, plan, IP addresses, usage and a check of its open ports to Anthropic, which generates the answer. A person from our team can take over at any time.
• Function import: when you import an AWS Lambda function into Raff Functions, the source code you upload is sent to Anthropic to convert it.

Anthropic processes this information as our service provider and, under our agreement, does not use it to train its models. We do not use your information or Customer Content to train AI models.

6. AI assistants and the Raff MCP server

You can connect AI assistants such as Claude, ChatGPT, Cursor or Claude Code to Raff through the Raff MCP server at mcp.rafftechnologies.com. The assistant can then work with your Raff resources on your behalf.

How the assistant signs in. Either you approve the assistant on a Raff page (Sign in with Raff) and choose the account it works in, or you give it a Raff API key. Either way it acts as you, with your permissions in that account, and never as a Raff administrator. The assistant never sees your Raff password.

What we receive. Only the requests the assistant sends to use a Raff tool: the tool name and its inputs, such as a database ID or an SQL statement you asked it to run. We return the result, such as a list of databases, query results or a connection string.

What we do not receive. Your conversation with the assistant, your chat history, other messages, files you share with the assistant or its memory. The assistant decides what to send in each request.

What we keep. The MCP server stores no requests or results. Each tool request becomes a call to the Raff API and is kept in your account's activity record like any other API call (section 3.3), together with the IP address of the assistant's servers.

What the assistant receives. The results we return go to the company that runs the assistant (for example Anthropic for Claude or OpenAI for ChatGPT) and are handled under that company's privacy policy. Results can include data from your databases, logs and, when you ask for them, database passwords. Ask only for what you want the assistant to see, or connect it in read-only mode.

Payments. The assistant cannot buy anything without showing you the price first and getting your confirmation in the chat.

Removing access. Remove an app at any time in Settings → Security → Connected apps. It loses access within a minute. To stop an assistant that uses an API key, delete the key.

We do not use what passes through the MCP server for advertising or to train AI models.

7. Who we share information with

We do not sell personal information. We share it only as described here.

Service providers that help us run Raff. They may use the information only to provide their service to us:

Others:

• Your team. Owners and admins of an account can see its members, their roles and the account's activity record.
• Apps you connect. AI assistants and other apps you connect receive what you ask them to fetch (section 6).
• Authorities. When the law requires it, for example a court order. Where we can, we tell you first.
• Protecting rights and safety. To enforce our Terms, investigate abuse, or protect our customers, the public or Raff.
• A new owner. If Raff is merged, acquired or sells its assets, information may pass to the new owner under this policy, and we will tell you.

8. International transfers

Our platform runs in data centers in the United States, and Dynamis Teknoloji A.Ş. is in Türkiye. Your information is therefore processed in the United States and Türkiye, and by the providers in section 7 in the countries listed. When we transfer personal information from the EEA, the UK, Switzerland or Türkiye to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses or another safeguard the law accepts, as described in our Data Processing Addendum. For transfers from Türkiye we also follow Article 9 of KVKK.

9. How long we keep information

When you delete your account, your sign-in and profile are deleted at once, along with support conversations, notifications, API keys, team memberships and settings. You must delete your resources and settle any balance first. We keep only what the law or the table above requires, such as billing records and the activity record, and delete it when that period ends.

10. Security

• All connections to Raff use TLS. New managed databases accept only encrypted connections.
• Passwords are stored as one-way hashes, and API keys as salted hashes. Passwords and keys for your databases, Apps and Functions are stored encrypted.
• Two-factor authentication is available for every account.
• Access to production systems is limited to staff who need it for their work. Support access to a server managed by Raff Guardian needs your permission and is logged.
• We monitor our platform for attacks and abuse.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will tell you and the authorities as the law requires. Report security issues to [email protected].

11. Your rights and choices

Depending on where you live, you can:

• see the personal information we hold about you and get a copy in a portable format;
• correct it;
• delete it, or delete your whole account in Settings → Danger zone;
• object to or restrict some uses, such as marketing or processing based on legitimate interests;
• withdraw consent at any time, for example for analytics and advertising cookies in Cookie settings, without affecting earlier processing;
• complain to a data protection authority.

You can also do a lot yourself: unsubscribe from marketing with the link in any email, choose which notification emails you get in Settings → Notifications, remove connected AI apps in Settings → Security → Connected apps, and delete API keys.

To use your rights, email [email protected] from the email address on your account. We may ask you to confirm your identity, and we answer within the time the law sets (usually one month). We will not treat you differently for using your rights.

Additional information by region

EEA, UK and Switzerland. Our legal bases are in section 4. You can complain to the supervisory authority where you live or work.

Türkiye. Dynamis Teknoloji A.Ş. processes your personal information under the Law on the Protection of Personal Data No. 6698 (KVKK). Our KVKK Aydınlatma Metni explains your rights under Article 11 and how to apply.

California and other US states. In the last 12 months we collected the categories in section 3: identifiers (such as name, email address, phone number and IP address), commercial information (purchases and billing), internet activity (website and product use) and account sign-in details. We used and disclosed them for the purposes in sections 4 and 7. We do not sell personal information. Using Google Ads and Meta to measure advertising may count as "sharing" for cross-context behavioral advertising under California law; you can opt out with Cookie settings at the bottom of our website. You can ask to know, correct or delete your information, or appoint an authorized agent to ask for you.

Canada, Australia and other countries. You have the rights your local law gives you, which you can use as described above.

12. Children

Raff is a service for businesses and developers. You must be at least 18 to create an account, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We will post any change here and update the date at the top. If a change is significant, we will tell you by email or in the dashboard before it takes effect.

14. Contact

• Privacy: [email protected]
• Support: [email protected]
• Abuse reports: [email protected]
• Security issues: [email protected]

Raff Technologies LLC, 30 N Gould St #48506, Sheridan, Wyoming 82801, United States

Dynamis Teknoloji Anonim Şirketi, Beytepe Mah. 5399 Sk. No: 1 B İç Kapı No: 133, Çankaya/Ankara, Türkiye. Phone: +90 312 911 31 27. MERSİS: 0323136402600001