Last updated: October 2026
Privacy Policy
Remi AI Ltd
Stored in Europe
All infrastructure hosted on Hetzner in Germany.
No model training
Your data never enters a training pipeline.
Your rights protected
Access, correct, delete, or export your data.
EU-hosted analytics
Product analytics from PostHog. Chat and document content is masked before capture.
1. Who We Are
Remi AI Ltd is the data controller for personal data processed through the Remi platform. We are registered in England and Wales. Contact: privacy@remiapp.ai
2. What Data We Collect
Account Data
Email address (for authentication via magic link login), name (if provided), account and workspace membership.
Usage Data
Chat messages and AI responses, uploaded documents and their extracted text, facts and knowledge items, integration connection status, credit usage and cost records, login times, session data, IP addresses, browser and device information.
Voice Data
When you speak to Remi, your voice goes to a speech-to-text provider (section 4), which returns the words. Voice messages you send in a chat, and Remi's spoken replies, are stored as audio files. Dictation audio isn't stored, and an AI model tidies the dictated words without keeping them. What you then send is stored like anything you type. When you dictate into a web page with the browser extension, the website's domain, the page's title and the field's label are sent too, so the text suits where it's going. In Remi Desktop, meeting notes start only after you agree, for each call: your microphone and your computer's sound (on a call, the other people) are transcribed, and the transcript stays on your computer unless you save it to Remi.
Technical Data
Vector embeddings of your documents (mathematical representations, not human-readable). Event logs recording all actions for audit trail purposes.
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Provide the platform and AI services | Performance of contract (Art. 6(1)(b)) |
| Process your documents for AI retrieval | Performance of contract (Art. 6(1)(b)) |
| Route prompts to AI providers | Performance of contract (Art. 6(1)(b)) |
| Maintain audit trails and event logs | Legitimate interest (Art. 6(1)(f)) |
| Send service notifications | Legitimate interest (Art. 6(1)(f)) |
| Billing and usage tracking | Performance of contract (Art. 6(1)(b)) |
| Prevent fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
We do not use your data to train AI models.
We do not sell your data.
We do not profile you for advertising.
4. How AI Processing Works
When you send a message, your prompt and relevant document context is sent to an AI provider to generate a response. When you use your voice, a speech-to-text provider turns it into text first, and Remi's spoken replies are made by a text-to-speech provider.
- Your message is received by Remi's API
- Pathfinder analyses your message and plans what tools to use
- If relevant, documents are searched via vector similarity and matching excerpts are included as context
- The prompt and context is sent to an AI provider
- The provider generates a response and returns it
- The response is streamed back to you
EU-based providers (data stays in the EU):
| Provider | Data Location | Purpose |
|---|---|---|
| Mistral | EU | Response generation |
| Remi-hosted models | EU | Response generation |
| Deepgram (EU) | EU | Speech to text for voice messages, dictation on the website and live dictation in the browser extension |
US-based providers (data processed in the US):
| Provider | Data Location | Purpose |
|---|---|---|
| OpenRouter | US/EU (varies) | Routes to third-party providers |
| Anthropic (Claude) | US | Response generation |
| OpenAI (GPT) | US | Response generation |
| Google (Gemini) | US | Response generation and embeddings |
| ElevenLabs | US/EU (varies) | Speech to text in Remi Desktop, Remi's spoken replies and audio you ask Remi to make |
You control which providers your workspace uses. Remi's default automatic routing prioritises EU providers. If you manually select a US-based model, your prompt data will be processed in the US. US-based providers for response generation do not retain your data for model training under their API terms. Speech to text and spoken replies always use the providers listed above, and your workspace's model settings don't change them.
5. Where Your Data is Stored
All Remi-managed infrastructure is hosted in the EU.
| Data Type | Provider | Region |
|---|---|---|
| Account data, messages, events, usage | Neon PostgreSQL | EU only |
| Document files | Hetzner S3-compatible storage | EU only |
| Voice messages and Remi's spoken replies (audio) | Hetzner S3-compatible storage | EU only |
| Document vector embeddings | ChromaDB (self-hosted on Hetzner) | EU only |
| Real-time session tokens | Ably | EU/UK |
Your data leaves the EU in two cases: when prompts are sent to a US-based AI provider for response generation, which only happens if your workspace is configured to use one, and when a US-based speech provider (section 4) processes dictation or meeting notes in Remi Desktop, Remi's spoken replies, or audio you ask Remi to make. Transfers for response generation are covered by Standard Contractual Clauses (SCCs).
7. Data Retention
- Account data: retained while active, deleted within 30 days of closure.
- Chat messages and AI responses: retained while active, deleted within 30 days of closure.
- Documents and embeddings: retained while active, deleted within 30 days of closure or when you delete the document.
- Event logs: retained for 12 months after closure for audit, then deleted.
- Billing records: retained for 6 years as required by UK tax law (HMRC).
8. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your data (subject to legal retention requirements)
- Port your data in a machine-readable format
- Restrict how we process your data
- Object to processing based on legitimate interest
- Withdraw consent where processing is based on consent
Email privacy@remiapp.ai. We respond within 30 days.
9. Security
- All data in transit is encrypted (TLS/HTTPS)
- Credentials and API keys are encrypted at rest using AES via our keyring system
- Access is authenticated via JWT tokens with session management
- All actions are logged in our event store
- Database access is restricted and monitored
11. Children
Remi is a business platform. Not intended for anyone under 18.
12. Changes
We notify you of material changes via email at least 30 days before they take effect.
13. Complaints
Contact us at privacy@remiapp.ai. You can also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
14. Contact
Remi AI Ltd. Email: privacy@remiapp.ai