Data processing

A run sends the specification, relevant conversation history, coding-style preferences, and — when the workflow requires it — project source to the services needed for that run:

• Anthropic — Agent mode runs (build, existing project, debug and optimize) use Anthropic Claude, called directly through Anthropic's API.
• OpenRouter — Plan mode (planning, generation and verification), the check every request receives before a run starts, chat titles, and related AI features. OpenRouter routes each call to a model from one of several providers that we select.
• Exa — only if you turn on Exa Search for that run; the query is sent to Exa.

Tools that stay on our infrastructure (Icarus Verilog, Yosys, Verilator, the RAG service) process source inside our environment. The RAG service is part of the same deployment.

Whatever the selected run needs: your prompt, prior turns in that chat, attached files the agent reads, and tool results. We do not send your billing card details to model providers. We do not send other customers’ projects.

We do not train models on customer content. The API services we use, as we understand their current terms, do not use API inputs to train foundation models by default. A service may retain prompts for abuse monitoring for a limited period under their own policy. We do not control a provider’s logs; if you cannot send a specification to a third-party API, do not submit it here.

Chats persist until you delete them. Project workspaces idle for 30 days (24 hours if never attached to a chat) are removed. You can delete your account from Settings → Account. See the Privacy Policy for the full list.

Connections to RTLBridge and to subprocessors listed here use TLS in transit. Encryption at rest depends on the host; contact us if you need it confirmed for a business deployment.

• Anthropic (Agent mode inference)
• OpenRouter (Plan mode and other AI features, routed to models from several providers)
• ZarinPal (payments in Toman)
• PostHog, EU-hosted (product analytics and masked session replay; off if you opt out)
• Sentry (error reporting; request bodies and secrets are scrubbed; off if unset)
• Exa (optional web search on a run)
• Our SMTP provider (signup codes, waitlist and support email)
• Google and GitHub (only if you use social login, for identity assertion)

Business customers who need a signed DPA can request one at info@rtlbridge.ir. This page is the description of processing we will attach; we do not generate a DPA from the product itself.