RAGFlow Privacy Policy

Last Updated: 2026-10-20

This Privacy Policy explains how RAGFlow (together with its affiliates, “RAGFlow,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes Personal Data in connection with our websites, apps, documentation, community channels, and other services that link to this Privacy Policy (collectively, the “Services”).

Important: This Privacy Policy generally covers (1) visitors and users of our website and Cloud services, and (2) business contacts (sales/marketing).

When we process Customer Data on behalf of an organization (e.g., as a processor), the processing is governed primarily by our contract and Data Processing Addendum/Agreement (“DPA”) with that Customer, not this Privacy Policy.

Summary

What we collect. Account details (name, email address, hashed credentials, organization and role); the content you put into RAGFlow (documents you upload or connect, parsed text, chunks, embeddings, questions, prompts, generated answers, agent and workspace settings); technical and audit logs; and — only when you connect Google — your Google profile and the Google Drive items you select.
Why we use it. To provide the service you asked for: index your content, generate answers and agent responses, keep integrations in sync, operate and secure your account, provide support, and meet legal obligations.
Who we share it with. Infrastructure and AI model providers acting on our instructions under contract, and authorities where the law requires it. We do not sell Personal Data.
How long we keep it. Until you delete the content or your account, or ask us to delete it. Account and imported data are deleted within 30 days of a verified request; encrypted backups expire within 90 days.
Your choices. Delete content in your workspace, revoke Google access at myaccount.google.com/permissions, or email privacy@ragflow.io. See Sections 13 and 15.

1. Who We Are

Controller (typical): For Personal Data we collect for our own purposes (e.g., account administration, billing, website analytics), RAGFlow typically acts as a data controller (or equivalent role under applicable law).
Processor / Service Provider (typical): For Customer Data uploaded to our Cloud services by Customers and their authorized users, RAGFlow typically acts as a data processor (or “service provider” under certain laws), subject to the Customer agreement and DPA.
Contact Information If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:

Email: privacy@ragflow.io

We will make reasonable efforts to respond to your request in accordance with applicable data protection laws.

Legal Entity and Registered Address The Services are provided by InfiniFlow Inc. (“InfiniFlow”), which acts as the data controller for the processing described in this Privacy Policy.

Registered address: Palm Grove Unit 4, 265 Smith Road, George Town, P.O. Box 52A Edgewater Way, #1653, Grand Cayman KY1-9006, Cayman Islands.

For a formal legal notice, contact us at privacy@ragflow.io.

2. Scope and Definitions

“Personal Data” means information that identifies or can reasonably be linked to an individual.

“Customer Data” means data (which may include Personal Data) that a Customer or its authorized users upload, submit, transmit, or otherwise make available to the Services.

Self-Hosted Open Source: If you deploy RAGFlow in your own environment (“Self-Hosted”), RAGFlow generally does not receive or process Customer Data from your Self-Hosted instance unless you enable optional features that send data to us (e.g., cloud connectors, telemetry, support logs), or you otherwise provide data to us.

3. Personal Data We Collect

3.1 Information you provide

We may collect Personal Data you provide, such as:

Account and profile information: name, email, username, authentication credentials (hashed), organization name, role/title.
Billing and transactional information: billing contact details, invoices, subscription plan, payment method details (typically processed by a third-party payment provider).
Support and communications: content of messages, tickets, feedback, recordings, and attachments you provide to support.
Events and marketing: registration details for webinars, community events, newsletters, surveys.
Connected data sources: content and metadata from third-party sources you choose to connect, such as Google Drive files and folders imported into a knowledge base (see Section 12).

3.2 Information collected automatically

We (and authorized third parties) may collect:

Device and usage data: IP address, device identifiers, browser type, OS, language, referring URLs, pages viewed, timestamps, clickstream, and diagnostics.
Cookies and similar technologies: see our Cookie Policy.

3.3 Information from other sources

We may receive Personal Data from:

Business partners (e.g., resellers, referral partners)
Public sources (e.g., professional profiles)
Security providers (e.g., fraud detection)

3.4 Content processed in the RAGFlow application

When you use the application, we process the content you choose to put into it:

Documents and files you upload or connect (for example PDF, Word, spreadsheet, presentation, image, audio and web pages), together with parsed text, extracted tables, generated chunks, embeddings and metadata such as file name, size, type and timestamps.
Conversations: your questions, prompts, instructions, the model responses returned to you, and any feedback you give on them.
Workspace configuration: knowledge base and dataset settings, agent and workflow definitions, model configuration, API keys and integration credentials.
Technical and audit logs: access logs, request identifiers, error traces, IP address and timestamps, used to operate and secure the Services.

This content may contain Personal Data about you or about third parties whose data you are authorized to process. You are responsible for having a lawful basis to upload it.

3.5 Model providers

To generate answers, RAGFlow sends the prompts and the retrieved passages needed for a response to the AI model provider you configure. Those providers act as our subprocessors or as your own processors (in Self-Hosted deployments) and are contractually restricted from using your content to train or improve their general models, where such terms are offered. If you use a self-hosted model, that content does not leave your infrastructure.

4. How We Use Personal Data

We may use Personal Data for the following purposes:

4.1 Provide and operate the Services

Create, maintain, and secure accounts
Provide core functionality, customer support, and service communications
Process subscriptions, billing, payments, and account administration
Parse and index your content, embed it, and generate answers and agent responses using the models you configure
Maintain conversation history and workspace state so that you can continue working across sessions

We do not use Customer Data, imported documents, conversations or prompts to train or fine-tune generalized AI or machine learning models, and we do not permit our model providers to do so.

4.2 Improve, develop, and protect the Services

Debug, monitor performance, analyze usage, and improve features
Maintain safety, integrity, and security; prevent abuse and fraud

4.3 Communicate and market (where permitted)

Send product updates, newsletters, and promotional messages (subject to your preferences and applicable law)
Conduct surveys and market research

4.4 Comply with law and enforce agreements

Meet legal obligations and respond to lawful requests
Enforce our Terms of Use and protect rights, property, and safety

We may process Personal Data for other purposes when you consent, where required.

De-identified / Aggregated Data: We may create and use de-identified or aggregated data where permitted by law; such data is generally not subject to this Privacy Policy to the extent it cannot reasonably identify you.

5. Legal Bases (EEA/UK/Switzerland and Similar Jurisdictions)

Where applicable, we rely on one or more legal bases, including:

Contract necessity (to provide Services)
Legitimate interests (to secure and improve Services, prevent fraud)
Consent (e.g., certain cookies/marketing where required)
Legal obligation (e.g., accounting, compliance)

We do not sell Personal Data, and we do not share it for cross-context behavioral advertising. We may share Personal Data with:

6.1 Service providers / subprocessors

Vendors that help us provide the Services under contractual confidentiality and security obligations, for example: cloud hosting and content delivery (Vercel), website analytics (Google Analytics), email delivery and support tooling, and payment processing. A current list of subprocessors for Customer Data is available in our Data Processing Agreement or on request.

6.2 Affiliates and corporate group

For internal business purposes consistent with this Policy.

6.3 Business partners

Where you engage with a partner integration, reseller, or event sponsor, we may share relevant information as needed and as permitted by law.

6.4 Legal and safety

To comply with law, protect rights, investigate fraud/security incidents, or respond to lawful requests.

6.5 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction.

7. International Transfers

We may process and store Personal Data in countries other than where you reside. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or equivalent transfer mechanisms) and may implement supplementary measures.

8. Data Retention

We retain Personal Data for as long as necessary to:

Provide the Services
Comply with legal obligations
Resolve disputes and enforce agreements

Retention periods may vary by data type, context, and legal requirements. We may retain certain data longer where required or permitted by law.

9. Security

We implement reasonable technical and organizational measures designed to protect Personal Data. However, no system is 100% secure; we cannot guarantee absolute security.

10. Your Rights and Choices

Depending on your location, you may have rights such as:

Access, correction, deletion
Restriction or objection
Data portability
Withdraw consent (where processing is based on consent)
Opt out of certain marketing communications

How to exercise rights: email privacy@ragflow.io.

We may verify your identity and authority. If applicable, you may appeal a decision per local law.

Marketing opt-out: You can unsubscribe via links in emails; you may still receive service-related messages.

11. Third-Party Services and Links

Our Services may link to third-party websites or services. Their privacy practices are governed by their own policies, not ours.

RAGFlow offers optional integrations with Google. You can sign in with a Google Account, and you can import Google Drive content into a knowledge base. These integrations are activated only after you explicitly authorize them, and only the scopes required for the feature you enable are requested.

12.1 Google user data we access

Basic profile (openid, email, profile): your name, email address, and profile picture.
Google Drive (read-only): the files and folders you explicitly select, their metadata (name, ID, MIME type, modified time, size), and their content.

12.2 How we use Google user data

To authenticate you, create and administer your account, and secure access to it.
To import the Google Drive items you select, parse and index them, and keep them in sync so that you can search and ask questions about them inside your workspace.
To provide customer support and investigate security incidents when you ask us to.

12.3 What we do not do with Google user data

We do not use it for advertising or ad personalization.
We do not sell it.
We do not use it to develop, train, or improve generalized AI or machine learning models.
We do not transfer it to third parties except: as needed to provide or improve the feature you requested, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice.
We do not allow humans to read it unless you give explicit consent, we need it for security purposes, or we must do so to comply with law.

OAuth access and refresh tokens are stored encrypted and are used only to perform the actions described above.
Imported content is stored in your workspace and retained until you delete it, disconnect the integration, or request deletion.
Google user data may be processed by our subprocessors strictly to host and operate the Services, under contractual confidentiality and security obligations (see Section 6 and our Data Processing Agreement).
Where Google user data is transferred internationally, we rely on the safeguards described in Section 7.

12.5 Limited Use

RAGFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

13. Data Deletion and Revoking Access

Revoke access: you can remove RAGFlow's access to your Google Account at myaccount.google.com/permissions.
Disconnect integrations: you can disconnect a data source or integration in your workspace at any time; synchronization stops immediately.
Delete content: you can delete imported documents and datasets in your workspace at any time.
Delete your account and data: email privacy@ragflow.io from the address associated with your account. We verify the request and then delete or de-identify the associated Personal Data — including imported Google user data and stored OAuth tokens — within 30 days.
Backups: residual copies may persist in encrypted backups for up to 90 days before being deleted in the ordinary course.
Exceptions: we may retain limited records where required by law, for tax and accounting purposes, to resolve disputes, or to enforce our agreements.

14. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect Personal Data from them. If you believe a child has provided us with Personal Data, contact privacy@ragflow.io and we will delete it.

15. AI Features and Prohibited Content

RAGFlow generates answers and agent responses by combining your content with AI models. Generated output may be inaccurate or incomplete and should be reviewed before you rely on it.

Prohibited content and uses. You may not use the Services, including any Google integration, to create, request, store or distribute:

AI-generated non-consensual intimate imagery (NCII) or any sexual content depicting a real person without their consent;
child sexual abuse material (CSAM) or any sexual content involving minors;
content that harasses, threatens, defrauds or unlawfully discriminates against individuals;
content that infringes intellectual property or privacy rights, or that violates applicable law.

We may remove such content, suspend or terminate the responsible account, and report it to the competent authorities where required by law. We do not use Google APIs to generate, host or distribute any of the content described above.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date. Your continued use of the Services after the change becomes effective means you acknowledge the updated Policy where permitted by law.