Privacy Policy

1. Who we are

Reqursor Technologies ("Reqursor", "we", "us") is a software company based in Rotterdam, The Netherlands. Our Chamber of Commerce (KvK) number is 42184274. We make two products: Reqursor Platform, an AI platform for ecommerce agencies, and Reqursor Development, an AI development agent that we host for you with Reqursor Credits or that you host yourself with your own key. Reqursor Development licenses are managed in Reqursor Licensing, our license portal.

We are the data controller for the personal data we process as described in this policy, except where this policy says we act as your processor. This policy applies to:

• this website, reqursor.com
• Reqursor Platform, its website (platform.reqursor.com) and its dashboard
• the Reqursor Development website (development.reqursor.com) and the Reqursor Development product
• the Reqursor Licensing portal (license.reqursor.com)

Section 2 covers this website. Sections 3 and 4 explain what each product and its website process. Sections 5 to 11 apply to all of them.

2. This website

Contact form

When you use the contact form on this website, we collect your name, your email address, your company (optional), the subject you choose and your message. We use this information only to reply to you. Your message is delivered to us by email, and we do not use it for marketing.

Ask assistant

The Ask assistant on this website answers questions about Reqursor Technologies and its products. When you send it a question, our server passes the question to our model provider, Anthropic, through the Claude API, which writes the answer from the public pages of our websites. If your message is only a few words long, we also pass your previous question, so that the assistant can tell what you mean.

The same assistant is also offered on the Reqursor Platform website and the Reqursor Development website. A question asked there is sent from your browser to our server on reqursor.com and is handled in the same way, so everything in this section applies to it too.

You do not sign in or give us your name or email address to use it, and you should not put personal data in a question. We do not log your questions or the answers, and we do not store your questions. So that a repeated question can be answered without a new request, we keep the answer under a one way fingerprint of the question, never the question itself, and a question that looks like it holds personal data is answered but not kept.

Anthropic receives your question under its commercial terms with us. Under those terms it states that it does not train its models on data from its API customers. It may keep requests and answers for a limited time, and it may process them outside the European Economic Area. We do not have a zero-retention agreement with Anthropic.

To keep the assistant available and its cost under control, our server counts requests per IP address in memory for a short time, and keeps a running total of what the assistant has cost, without any personal data in it.

Cookies and local storage

This website uses no analytics or advertising cookies. If you choose a light or dark theme, that preference is kept in your browser's local storage and is never sent to us. The Ask assistant stores nothing in your browser.

Technical data

Like any website, our servers process technical data such as your IP address to deliver pages to you and to protect the site against abuse, for example to limit how often the contact form can be submitted or the Ask assistant can be used.

3. Reqursor Platform

This section applies to Reqursor Platform, its website (platform.reqursor.com) and its dashboard.

Account data

When you create a Reqursor Platform account: name, email address, organization name and authentication credentials (password stored as a salted hash, never in plaintext).

Store configuration data

Store definitions, design tokens, page compositions, managed configuration, deployment history and run artifacts. This is the data that powers the platform's deterministic execution engine.

Store business data

Product catalogs, customer orders, media uploads and store platform settings that are not managed by Reqursor Platform. This data lives in your store's isolated Docker volumes and is not accessed, processed or read by Reqursor except during AI migration (with your explicit consent, read-only, and only for the duration of migration).

Usage data

Platform usage metrics: deployment counts, AI operation counts and feature usage patterns. Used to improve the product and calculate billing. No personally identifiable information from your store visitors is collected.

AI interaction data

When you use AI features, we send store configuration metadata (design tokens, block configurations, drift evidence) to our AI provider (Anthropic, through the Claude API). We never send secret values, database credentials, store business data, customer information or data from other organizations.

AI provider data handling

Reqursor Platform's AI features use the Anthropic Claude API. Data sent to the AI provider is:

• Scoped to one tenant per request: no cross-organization data in any AI prompt.
• Minimized: only the configuration metadata needed for the specific operation.
• Excluded from training: Anthropic does not train models on API customer data.
• Free of secrets: passwords, API keys, salts and credentials are never included.
• Free of business data: orders, products and customer records are never included.

Data isolation

Each organization operates in structural isolation. Your stores run in dedicated Docker containers with private networks and volumes. No store can access another store's data. No organization can see another organization's configuration, health status or operational data. This is enforced architecturally, not by policy.

Data retention

• Store definitions: retained as long as the organization exists.
• Deployment artifacts: 90 to 365 days depending on type.
• Audit logs: 365 days.
• AI interaction logs: 30 days.
• After account deletion: all data is permanently purged within 30 days of the grace period ending, except the financial records and other data we must keep by law, as section 7 explains.

Dashboard cookies

The Reqursor Platform dashboard uses essential cookies for authentication and session management (required). The dashboard runs no analytics or error reporting tools today. If we turn on such optional tools, we do so only for you if you have accepted them in the cookie banner or in your account settings under Data & Compliance, and you can change your choice at any time.

Reqursor Platform website

The early-access form on the Reqursor Platform website collects your first and last name, work email, company or agency name, the number of online stores you manage (as a range) and the biggest operational pain point you want Reqursor Platform to solve. The contact form on that website collects your first and last name, email address, the subject you choose and your message.

Both forms are delivered to us by email, and early-access applications go to our sales team. We use your details only to reply to you and, if you apply for early access, to assess your application. We do not use them for marketing. To prevent abuse, the number of submissions from one email address or IP address is limited.

The Reqursor Platform website uses no analytics or advertising cookies. If you choose a light or dark theme, that preference is kept in your browser's local storage and is never sent to us.

4. Reqursor Development and Reqursor Licensing

Reqursor Development runs on your infrastructure

Where Reqursor Development runs depends on your license. With a self-hosted license and your own key, it is installed on your own server. Its dashboard, worker and agent sandbox run there, together with your tickets, run history, audit log and encrypted secrets. Where we host Reqursor Development for you, which runs on Reqursor Credits, the same parts run on servers that we operate, and your tickets, run history, audit log and encrypted secrets, and the copies of your repositories that the agent works on, are stored there. For the personal data in an instance that we host we act as your processor, and our Data Processing Agreement covers it.

Reqursor Development sends your code and ticket text only to destinations you choose and configure:

• The model provider you choose: prompts and working context, including the code the agent reads, go to Anthropic, or to Amazon Bedrock, Google Vertex AI or Microsoft Foundry if you use them. As a beta, with your own key and only for a project that opted in, they can go to Kimi from Moonshot AI, which processes data in Singapore under its own terms. The AI Usage Policy says more.
• Our relay, only if you use Reqursor Credits: instead of going straight to a model provider, prompts and working context go to our relay, which passes them on to Anthropic. The section on Reqursor Credits below explains what the relay does.
• Your git remote: commits and pull requests go to the repository you connected, on the branches you allow.
• The integrations you connect: your tracker, email, Slack or webhooks receive the updates you switch on.

With your own key, your prompts go from your server directly to your provider, and never through Reqursor. With Reqursor Credits, they pass through our relay, as described below. The AI Usage Policy explains how Reqursor Development uses AI models and what stays under your control.

Credentials you store in Reqursor Development, such as model provider keys, git and tracker tokens and mail or Slack credentials, are encrypted at rest. From a self-hosted installation they are never sent to Reqursor, and the only stored value that reaches us is your license token, which the license server uses to recognize the install. In an instance that we host for you, they are stored encrypted in that instance. The Reqursor Development dashboard loads no external scripts, fonts or trackers. Our license server receives only the license and credit information described below, and there is no other telemetry. Like any server, it also processes technical data such as your IP address, the time and the type of each request in its access logs, to keep the service secure and to limit abuse. The bare-metal installer downloads the release from the same server.

The daily license check

Once a day, each install checks its license with our license server at license.reqursor.com. The check contains exactly eight fields of license metadata: the random ID the install created when it first started, the license ID, the Reqursor Development version, the operating system, the processor architecture, the number of active users with a developer seat, the number of active projects and the number of runs started in the last 24 hours. The last three are counts only.

A license check never contains code, ticket text, repository or project names, branch names, prompts, model output, user names or email addresses. The Reqursor Development security page lists the exact fields. An install that runs on an offline license file (Enterprise) sends no license check at all.

We keep the raw license checks for at least 13 months and at most 14. After that we reduce them to anonymous monthly totals by plan, version, operating system and processor architecture, and delete the raw checks.

About once a day, the install also asks our license server for the signed list of new releases, so that an administrator can see that an update exists. That request carries only the license token and a standard user agent header. It never downloads or installs anything, and an administrator can turn it off in the settings.

Reqursor Credits and our relay

Reqursor Credits let you pay us for model usage instead of using a model provider account of your own. This section applies only if your license runs on credits. A self-hosted license with your own key sends no model request to our relay, and installs on an offline license file cannot use credits.

• What passes through our relay. Each model request, with the ticket text, project instructions, code and tool results it holds, goes from your install to our relay at inference.reqursor.com. The relay forwards it to our model provider, Anthropic, with our own account, and returns the answer. For the content of these requests we act as your processor, with Anthropic as our sub-processor, and you are the controller of any personal data in them. For the usage records described below, we are the controller. Our Data Processing Agreement covers this processing and applies automatically.
• What the relay does not keep. The relay reads a request in memory to check it and to count the usage. It does not store the request or the answer, and it does not scan or log their content.
• What the relay keeps. It keeps usage records: identifiers, the model, the stage, token counts, the outcome and the time, with opaque references for the run, ticket and project, never their names or any code or ticket text. Delivered records are deleted from the relay after 7 days. Its access logs hold the IP address of the connecting server, the time, the method, route, status, duration and a request ID, but never a body, a query string or a header value, and are kept for at most 30 days. A record that our license server rejects stays on the relay, with identifiers and token counts only, until we have reviewed and deleted it.
• What the license server keeps. The relay sends the usage records to our license server. Your install also asks it, for each run, to reserve, extend and settle credits. These calls carry the install's ID, the opaque references, the amount of credits, the model and strategy, and token counts. The license server keeps these records, your credit balance and your purchases, and shows them to you in the portal.
• Anthropic. Anthropic receives the requests under its commercial terms with us. Under those terms it states that it does not train its models on data from its API customers. It may keep requests and answers for a limited time, and it may process them outside the European Economic Area. We do not have a zero-retention agreement with Anthropic.

License actions you start

Some actions you start yourself also contact the license server, for example activating a license key, buying a license, using Start with credits, moving a license to new hardware or managing billing. Each of these requests carries the install's ID and, depending on the action, details such as the license key, a hardware fingerprint, the version, operating system and architecture, the plan and billing interval you chose, the amount you chose for Start with credits, or your new number of seats and projects. With Start with credits, you pay on license.reqursor.com, where you enter your email address and, if you want, your company name. We email the license key to that address.

The hardware fingerprint is a SHA-256 hash of the machine ID and the data volume's ID. The license server uses it to notice when an install has moved to new hardware, and never to lock it out.

The Reqursor Licensing portal

Reqursor Licensing (license.reqursor.com) is where Reqursor Development customers buy a license, see their licenses and installs, move an install to new hardware and manage billing.

• Sign-in: we email you a one-time sign-in link, so there is no password. Sign-in works for the contacts on a license or trial.
• Payments: payments run through Stripe. You pay with Stripe Checkout, and you manage invoices, payment methods and cancellation in the Stripe customer portal.
• Licenses and installs: the portal shows each license on your account, its status and renewal date, and which installs use it.
• Credits: the portal shows your credit balance and usage, and lets you buy credits. A credit purchase is a one-off payment through Stripe Checkout.
• Emails: we email you a one-time sign-in link, your license key when you buy a license or use Start with credits, and notices about your license, such as a renewal or expiry reminder, a change to your plan or a moved install. If you use credits, we also email you a receipt for a top-up, and notices when your balance runs low or runs out.
• Cookies: the portal sets only strictly necessary cookies. One keeps you signed in for up to 7 days after you sign in, or until you sign out. While you buy a license, another cookie remembers your checkout for up to 24 hours. The portal uses no analytics or advertising cookies. If you choose a light or dark theme, that preference is kept in your browser's local storage and is never sent to us.

Support requests

If you email us for support at [email protected], we process your name, email address and the content of your message, and anything you attach. A diagnostics bundle from Reqursor Development masks stored secrets, but you should read it before you send it. We use this information only to answer and follow up on your request.

Demo requests

The contact form on the Reqursor Development website, used to request a demo, the license terms or a security review, collects your first and last name, work email, company, the number of developers on your team, the plan you are interested in, where you would run Reqursor Development and an optional message. Your request is delivered by email to our sales team, and we use your details only to reply to it. To prevent abuse, the number of requests from one email address or IP address is limited.

5. How we use data

We use personal data only for the purposes described in this policy:

• To reply to you: answering contact form messages, early-access applications, demo requests and other questions.
• To provide our products: running Reqursor Platform, and licensing and supporting Reqursor Development.
• To bill our customers: processing payments and invoices for the products they use.
• To keep our services secure: protecting our websites and products against abuse.
• To communicate with customers: service notifications, security alerts and, with your consent, product updates.

We never sell personal data or share it with advertisers.

6. Who receives your data

We share personal data only with the providers we need to run our services, and only for that purpose. Our sub-processor list for Reqursor Development names them:

• Stripe, which processes payments and invoices for Reqursor Development licenses.
• Our hosting providers, which host the license server and its database, our relay and the instances that we host for customers.
• Cloudflare, whose network carries the traffic between your browser and an instance that we host for you.
• Anthropic, which receives model requests from our relay if you use Reqursor Credits, and from Reqursor Platform, whose providers its own data processing addendum covers. It also receives the questions that you send to the Ask assistant on this website.
• Our own mail server, which sends our emails and receives the messages and forms you send us.

We may also share data where the law requires it, for example with authorities, and with advisers who are bound by confidentiality, such as our accountant. Some providers may process data outside the European Economic Area. Where that happens, we rely on the safeguards that data protection law allows, such as the European Commission's standard contractual clauses. We do not give your code, tickets or prompts to anyone, except that, if your license runs on Reqursor Credits, prompts pass through our relay to Anthropic as described above, and an instance that we host for you is stored with our hosting provider and reached through Cloudflare's network, as our sub-processor list describes. With your own key, prompts go from your server straight to your provider and never through Reqursor.

7. How long we keep data

We keep personal data only as long as we need it to run our services. In practice that means for as long as your business is our customer and, for people at that business, for as long as they are a contact on a license. When the customer relationship ends, we delete or anonymize the data, unless the law says otherwise or requires us to keep records.

• Financial records. In the Netherlands we must keep our financial administration, including invoices and payment records, for 7 years. We keep a copy of those records for that period, also after you stop being a customer and also if you ask us to delete your data, to the extent the law requires it.
• Trials and prospects. If a trial ends without a purchase, we keep the trial data for as long as we need it to deal with the trial and any contact that follows.
• Legal claims. We may keep data for longer where we need it to establish, exercise or defend a legal claim.
• Shorter periods. Some data we keep for a shorter time: raw license checks, as described in the section on the daily license check, and the records and logs of our relay, as described in the section on Reqursor Credits. The retention periods for Reqursor Platform in section 3 also apply.
• Messages to us. We keep contact form messages, demo requests and support emails for as long as we need them to deal with your request and any relationship that follows.
• Ask assistant. We do not keep your questions. A stored answer is kept only while it is among the most recent answers the assistant has given. How long Anthropic keeps a request is described in the section on this website.

8. Your rights

Under the GDPR and other applicable data protection laws, you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, except where the law requires us to keep it, such as financial records (see section 7).
• Restriction: have the processing of your data limited.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to the processing of your data.
• Withdrawal of consent: withdraw your consent at any time, where we process data based on it.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with a data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens.

Some products also let you act on your data directly:

• Reqursor Platform: access and export your data in standard formats (JSON, CSV) with the Data Export feature, update your profile and organization data, delete your account and its data, except the records we must keep by law (see section 7), and object to analytics through your cookie preferences.
• Reqursor Licensing: see your licenses and installs in the portal, and manage invoices, payment methods and cancellation in the Stripe customer portal.

9. Security

We protect personal data with appropriate technical and organizational measures.

For Reqursor Platform, we use TLS encryption for all data in transit, encrypt secrets at rest, enforce per-store isolation via Docker, drop all Linux capabilities from containers, and never store plaintext credentials in Git, logs or artifacts.

For Reqursor Development, the security page describes what the product sends where, what the license check contains and how the agent is isolated.

10. Changes to this policy

We may update this policy when our websites, products or practices change. The latest version is always published on this page, and the date and revision number at the top show when it last changed.

11. Contact

For questions about this policy or your personal data, or to exercise your rights, email [email protected]. For other legal questions, email [email protected]. For support and billing questions, email [email protected], and for anything else, [email protected].

You can also use the contact form. Reqursor Technologies, Rotterdam, The Netherlands. Chamber of Commerce (KvK) number: 42184274.