RohiLabs, a company incorporated in Alberta, Canada (“RohiLabs”, “we”, “us”), operates Reeto, an AI content studio available at reeto.ca. We are based in Alberta, Canada. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA.
RohiLabs is a subsidiary of Rohi Labs Inc., a United States corporation. Where our parent company processes personal information on our behalf, it does so under contract and only for the purposes described in this policy.
1. Who to contact
For any privacy question, or to exercise any right described in this policy:
Privacy Officer, RohiLabs
[email protected]
Alberta, Canada
If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada. If you are in the EU or UK, you may complain to your local supervisory authority. If you are a California resident, you may contact the California Privacy Protection Agency.
2. Information we collect
Information you give us
Account information. Your email address and password (stored hashed, never in plain text). If you sign in with Google, we receive your Google email address, name, and profile photo so we can create your Reeto account and sign you in. We do not read your Gmail, contacts, Drive, or calendar.
Organisation and team information. Your organisation name, the email addresses of people you invite, and their assigned roles.
Brand information. Everything you enter in your brand guide: brand name, handle, niche, tagline, colour values, font choices, logo, voice rules, banned words and aesthetic notes. If you upload a brand guide document or provide a website URL, we process that source to extract these values.
Content you create. The ideas, answers, text, photographs and other material you supply, together with the posts generated from them.
Payment information. We do not store your card details. Payments are processed by Stripe, which holds your card data. We store your Stripe customer identifier, your subscription status and your billing period.
Support communications. Anything you send us by email or through in-app support.
Information we collect automatically
Usage data. Pages visited, features used, posts created, generations run and exports made. We use this to operate the service, diagnose faults and understand which features are useful.
Technical data. IP address, browser type, device type, operating system and timestamps. IP addresses are collected as part of ordinary server logging and for security purposes such as detecting abuse.
Cookies and local storage. See section 8.
3. How we use your information
We use personal information to:
- Create and manage your account and organisation
- Provide the service, including generating and rendering content
- Process payments and manage subscriptions
- Enforce plan limits such as brand count, seat count and monthly render allowances
- Send transactional messages such as receipts, scheduling reminders and security notices
- Respond to support requests
- Diagnose faults, monitor performance and prevent abuse
- Improve the service in aggregate
- Comply with legal obligations
Legal bases (for users in the EU and UK)
| Purpose | Legal basis |
|---|---|
| Providing the service and managing your account | Performance of a contract |
| Processing payments | Performance of a contract |
| Security, abuse prevention, fault diagnosis | Legitimate interests |
| Product analytics in aggregate | Legitimate interests |
| Marketing email, where sent | Consent |
| Meeting legal and tax obligations | Legal obligation |
4. Artificial intelligence processing
Reeto uses third-party AI models to generate and review content. You should understand what this means for your data.
What is sent to AI providers. When you generate content, we send the relevant inputs to our AI providers. This includes your brand configuration, the idea or answers you supplied, and the resulting draft copy for review. Where you upload an image for analysis, that image is sent to the provider that performs the analysis.
Which providers. Google (Gemini API and Vertex AI) and Anthropic (Claude API). Each processes data under its own terms, as an independent processor or sub-processor.
Training. We do not train our own models on your content. We use these providers under terms intended to prevent your content being used to train their models. We cannot, however, control a provider’s own policies, and we will update this policy if those terms change materially.
Reference images. If you upload a reference image, it is analysed once to extract abstract design parameters such as spacing, type hierarchy and colour temperature. The image itself is deleted immediately after analysis. It is not stored, not retained in any database, and never used to render output.
Search grounding. One AI stage may perform a web search to identify current content patterns for your niche. Your brand name and content are not published or made public by this process.
Automated decisions. AI stages select content angles, write copy and flag output that appears off-brand. These decisions affect the content produced and nothing else. They have no legal or similarly significant effect on you, and you can edit, regenerate or discard any output at any time.
6. International transfers
We are based in Canada and use service providers in the United States and elsewhere, including our United States parent company. If you are outside Canada, your personal information will be transferred outside your jurisdiction.
For transfers of EU and UK personal data we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism with each recipient, together with the European Commission’s adequacy decision in respect of Canada for commercial organisations subject to PIPEDA.
7. Retention
| Data | Retained for |
|---|---|
| Account and organisation records | While your account is active |
| Brand configurations and content | While your account is active |
| Uploaded reference images | Deleted immediately after analysis |
| Generated content and rendered assets | While your account is active |
| Payment and billing records | 7 years, to meet Canadian tax and accounting obligations |
| Server and security logs | 12 months |
| AI execution logs | 12 months |
| Support correspondence | 3 years |
When you delete your account, we delete your account data, brands and content within 30 days, apart from records we are legally required to keep, such as billing history. Backups are overwritten on a rolling cycle and are fully purged within 90 days.
9. Your rights
Subject to your jurisdiction, you may:
- Access the personal information we hold about you
- Correct anything inaccurate
- Delete your account and associated data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent where we rely on it, without affecting past processing
- Complain to a supervisory authority
Most of these can be exercised directly in the application. For anything else, contact our Privacy Officer. We respond within 30 days.
10. Security
We protect personal information using encryption in transit (TLS) and at rest, hashed passwords, row-level security in the database so that organisations cannot access one another’s data, role-based access control within organisations, and restricted internal access on a need-to-know basis.
No system is completely secure. If a breach occurs that creates a real risk of significant harm, we will notify affected users and the relevant regulators as required by law.
11. Children
Reeto is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it.
12. Changes to this policy
We may update this policy. If we make a material change, we will notify you by email or through the application before it takes effect. The date at the top of this page reflects the most recent revision.
These pages sit alongside our Terms of Service.