Legal

Privacy Policy

Effective: May 2026 · Version 1.1 · Israeli PPL Amendment 13 + GDPR compliant

The short version: A2RAG processes queries in-memory and returns a routing decision. We never store query content, documents, or answers. Your users' data never reaches our servers. We collect only what's necessary to run the service.

1. Who We Are

Stav Vaknin, doing business as A2RAG
Tel Aviv, Israel
Contact: stav@aibee.co.il
Website: a2rag.ai

This policy complies with: Israeli Protection of Privacy Law (Amendment 13, August 2025), Israeli Data Security Regulations 2017, GDPR, and CCPA.

2. The Core Privacy Guarantee

When your application calls the A2RAG API:

Query content is processed in-memory and immediately discarded
Retrieved documents stay in your environment
Draft answers stay in your environment
We return a routing decision only (answer / clarify / abstain)

We cannot reconstruct any user query, document, or conversation.

3. What We Collect

Account data (you — the developer or business)

Data	Purpose	Legal basis
Name, email	Account management, onboarding	Contract
Company name	Account management	Contract
IP address at signup	Security, fraud prevention	Legitimate interest

API usage metadata (never content)

Data	Example	Retention
Decision action	"clarify"	90 days
Confidence score	0.85	90 days
Query type, domain, language	"generic_policy", "en"	90 days
Response latency	12ms	90 days
IP addresses (API calls)	Rate limiting only	30 days maximum

Under Israeli Amendment 13, IP addresses are personal data and are deleted after 30 days.

Optional: Anonymous telemetry (free tier)

With your consent, the free tier sends anonymous decision metadata (action, confidence, latency — no content) to improve model accuracy. This is disclosed at signup and can be disabled at any time.

4. What We Never Collect

Content of user queries
Retrieved documents or knowledge base content
Draft answers generated by your LLM
Personal information about your end users
Conversation history or message content

5. Data Storage & Location

Data	Location	Encryption
Account data	AWS EU (Frankfurt, eu-central-1)	AES-256 + TLS 1.3
API usage logs	AWS EU (Frankfurt, eu-central-1)	AES-256 + TLS 1.3

EU AWS region ensures GDPR compliance and Amendment 13 cross-border transfer requirements.

6. Security

API keys: one-way hashed (SHA-256), never stored in plaintext
All communication: TLS 1.3 minimum
Access control: role-based, logged, audited
Incident response: breaches reported within 72 hours
IP log retention: maximum 30 days (Amendment 13 compliance)

7. Your Rights

Under Israeli PPL (Amendment 13) and GDPR:

Access - request a copy of data we hold about you
Correction - request correction of inaccurate data
Deletion - request deletion of your account and data
Portability - receive your data in a structured format
Object - object to processing based on legitimate interest

To exercise any right: stav@aibee.co.il - Response within 30 days.

Israeli regulator: Privacy Protection Authority (Magen)

8. Cookies

a2rag.ai uses only essential cookies (session management, CSRF protection). No advertising cookies, no tracking pixels, no third-party analytics.

9. Children

A2RAG is a developer tool intended for businesses. We do not knowingly collect data from individuals under 18.

10. Changes

Material changes: 14 days email notice before effect. Current version always at a2rag.ai/privacy.

11. Contact

stav@aibee.co.il
Stav Vaknin, Tel Aviv, Israel