Ryft — Privacy Policy
Last updated: October 6, 2026 Effective date: October 6, 2026
This Privacy Policy explains how Ryft Security, LLC, a limited liability company formed in Virginia, USA ("Ryft," "we," "us," or "our"), handles personal data in connection with the website ryftapi.com (the "Site"), the purchase of a license, and the Ryft desktop application (the "Software").
Ryft is sold for professional and business use only and is not directed at consumers or children.
1. Data controller
The data controller for the personal data described in this Policy is Ryft Security, LLC. You can reach us about privacy at privacy@ryftapi.com.
2. The short version
- We collect only what we need to sell you a license, deliver it, and run and secure our Site.
- Your card number is handled solely by Stripe — we never receive it.
- The Ryft application is local-first: it does not send your testing data, captured traffic, scan findings, or Target information to us, and it contains no analytics or usage telemetry. (See Section 5.)
- We do not sell or "share" your personal data.
3. Personal data we collect, and why
We (the seller) hold the following categories of personal data in connection with the Site and your purchase:
| Data | Source | Purpose | GDPR legal basis |
|---|---|---|---|
| Buyer email address | You / Stripe at checkout | Deliver the License Key, send the order confirmation, provide support | Performance of a contract (Art. 6(1)(b)) |
| Issued License Key | Generated by us | Fulfil your order, enable activation, support, and anti-piracy | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in preventing misuse |
| Stripe payment / customer metadata (e.g., transaction and customer identifiers, payment status, partial card metadata such as brand/last four — not full card numbers) | Stripe | Process payment, reconcile orders, prevent fraud, handle chargebacks | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in fraud prevention |
| Billing address | Stripe at checkout | Tax determination, invoicing, fraud prevention | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax records |
| Server logs, including IP address | Automatically when you use the Site | Operate, secure, and troubleshoot the Site; detect and prevent abuse | Legitimate interests (Art. 6(1)(f)) in security and reliability |
One strictly-necessary cookie (ryft_preview, ~30-day lifetime) | Set by the Site | Gate access to the Site (private-preview access control) | Strictly necessary and therefore exempt from ePrivacy consent; this cookie stores no personal data. |
We do not currently use any third-party web analytics, and we do not use advertising cookies or trackers. Where we ever rely on consent (for example, if we later add non-essential cookies), we will ask for it first and you may withdraw it at any time.
4. Card data is handled by Stripe
Checkout is operated by Stripe via Stripe Checkout. Stripe collects and processes your card details directly; we never receive or store your full card number. Stripe acts as an independent controller and/or our processor for payment processing and is a PCI-DSS Level 1 service provider. Your payment is also subject to Stripe's own privacy policy.
5. The Ryft application is local-first (a privacy strength)
The Software runs entirely on your own Device. We do not receive your testing data, captured traffic, scan findings, or Target information, and the Software contains no analytics or usage telemetry. Your projects can be stored locally as encrypted bundles that only you can open.
This does not mean the Software never connects to the internet. By design, the Software:
- fetches the resources you direct it at (such as Target APIs and JavaScript bundles) — those connections go to the systems you choose, not to us; and
- may contact our systems to check for software updates or to validate a license.
Beyond update checks and license validation, the Software does not transmit your work product to us.
6. Sub-processors
We use a small number of service providers ("sub-processors") to run our Site and deliver your order. They are listed, with their purpose, data categories, and location, in our Sub-processors page (sub-processors.md), which forms part of this Policy. In summary, all are U.S.-based: Stripe (payment processing), Google Cloud Platform (hosting via Cloud Run and software downloads via Cloud Storage), and Resend (transactional email).
7. International data transfers
Our sub-processors are located in the United States. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with cross-border transfer rules, your personal data may be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA where applicable), as incorporated into our agreements with the relevant sub-processors. Where a sub-processor is certified, we also rely on the EU-U.S. Data Privacy Framework (and its UK extension) in addition to the Standard Contractual Clauses / UK IDTA. You may request more information at privacy@ryftapi.com.
8. Retention
We keep personal data only as long as needed for the purposes described above, then delete or anonymize it:
- Buyer email and License Key: retained for the life of the license and thereafter as needed for support, renewals, and anti-piracy — the License term plus 24 months.
- Order and tax records (incl. billing address, Stripe metadata): retained as required by tax and accounting law — 7 years.
- Server logs (incl. IP): retained for a short period for security and troubleshooting — 30–90 days.
9. Your rights
9.1. EEA / UK (GDPR / UK GDPR)
Subject to conditions and exceptions, you have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent where processing is based on consent. Where we rely on legitimate interests, you may object based on your particular situation. You also have the right to lodge a complaint with your supervisory authority.
9.2. California (CCPA/CPRA)
If you are a California resident, you have the right to know/access, delete, and correct your personal information, and to not be discriminated against for exercising your rights. We do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA, and we do not use personal information for cross-context behavioral advertising. Because we sell only to businesses/professionals, some information may be business-contact information.
9.3. How to exercise your rights
Send requests to privacy@ryftapi.com. We will verify your request and respond within the time required by applicable law. You may use an authorized agent where the law permits.
10. Children
The Site and Software are intended for business and professional use and are not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@ryftapi.com and we will delete it.
11. Security
We use reasonable administrative, technical, and organizational measures appropriate to our size and the data we handle, including encryption in transit (TLS), restricted access to order data, use of reputable processors, and signed, time-limited download URLs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not make any security certification (such as SOC 2 or ISO) or insurance claim; none exists.
If a breach affecting buyers' personal data occurs, we will notify affected individuals and/or the relevant supervisory authority as required by applicable law and without undue delay.
12. Changes to this Policy
We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, take additional steps where required by law. Your continued use of the Site or Software after an update constitutes acceptance of the revised Policy.
13. Contact
- Privacy / data requests: privacy@ryftapi.com
- General support: support@ryftapi.com
- Legal notices: legal@ryftapi.com
- Security / vulnerability reports: security@ryftapi.com
Ryft Security, LLC · Virginia, USA · ryftapi.com