Privacy Policy
Last Updated: October 9, 2026 • Effective Date: October 2026
Zero Model Training
Your conversations and personal memories are never used to train global AI models without your explicit consent.
Encrypted Transport & Storage
All communications utilize TLS 1.3 encryption in transit with database-level Row Level Security (RLS).
Full Data Portability
Export your complete conversation history and memories as JSON or wipe them permanently at any time.
01. Introduction & Scope
Sorika Labs (“Reverie AI”, “we”, “our”, or “us”) is committed to protecting your privacy and providing a transparent computing experience. This Privacy Policy outlines our data handling practices when you access or use the Reverie AI application, web clients, application programming interfaces (APIs), and associated intelligence services (collectively, the “Services”).
By accessing Reverie AI, you acknowledge that you have read and understood the data collection, processing, and storage practices described herein. If you do not agree with this policy, please discontinue use of our Services immediately.
02. Information We Collect
We collect information in three primary ways:
A. Information You Explicitly Provide
- Account Credentials: Email address, encrypted authentication tokens managed through Supabase Auth, and user profile information.
- Prompt Inputs & Chat Messages: Queries, system instructions, documents, and code snippets submitted during interactive sessions.
- Media & File Uploads: Images, documents, and attachments uploaded through ImageKit integration for multimodal vision and analysis.
- Custom Memories: Key user preferences, notes, and profile details stored in your personal memory vault.
B. Automated Technical & Session Data
- Usage Metrics: Token consumption, request rate status, session duration, and model provider latency.
- Device Fingerprint & Telemetry: Anonymized client identifier, browser user agent, IP address (hashed for rate limiting), and operating system information.
C. Payment Information
- Payment processing is handled exclusively through our certified payment partner, Razorpay. Reverie AI does not store credit/debit card numbers, CVVs, or banking credentials on our servers. We only retain the Razorpay Order ID, Payment ID, subscription tier, and validity period.
03. How We Process Your Data
Your data is processed strictly for the following legitimate purposes:
- Generating Real-Time AI Responses: Routing your prompts through Sorika Gateway to frontier LLMs to stream responses.
- Contextual Memory Retrieval: Matching your custom memories to relevant queries to provide personalized continuity.
- Rate Limiting & Abuse Prevention: Enforcing atomic token quotas and sliding window rate limits via Upstash Redis to prevent denial-of-service and platform abuse.
- Subscription Fulfillment: Verifying HMAC signatures for Razorpay transactions and granting appropriate token limits.
04. Model Routing & Upstream AI Providers
Reverie AI connects to high-performance inference engines via the Sorika Gateway. When a prompt is submitted:
- Upstream providers process prompts in volatile memory solely to generate the response stream.
- We mandate zero data retention agreements wherever available with upstream inference endpoints.
- Your personal chat inputs are not sold, rented, or distributed to any advertising networks.
05. Data Storage, Retention & Deletion
We believe you should maintain complete sovereignty over your data. Reverie AI gives you granular control directly within the application:
Download an unencrypted, complete JSON file of all your conversation history and memories at any time via Settings ➔ Privacy.
Trigger permanent cascade deletion of your chat history, vector embeddings, and memory stores directly from your device.
06. Third-Party Sub-Processors
We work with trusted infrastructure providers who meet rigorous data protection and security standards:
| Partner / Service | Function | Data Location |
|---|---|---|
| Supabase Inc. | PostgreSQL Database, Authentication & RLS Storage | Encrypted Cloud (AWS / GCP) |
| Upstash Inc. | Serverless Redis for Rate Limiting & Stream Cache | Global Edge Network |
| Razorpay Software | Payment Processing & Subscription Billing | PCI-DSS Compliant Secure Vaults |
| ImageKit Ltd. | Attachment & Media Processing CDN | Global Edge CDN |
| Render Services Inc. | Express Backend & API Compute Gateway | Secure Isolated Cloud Containers |
07. Your Legal Rights (GDPR & CCPA)
Depending on your location, you hold fundamental rights regarding your personal information, including:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete information.
- Right to Erasure (“Right to be Forgotten”): Request full deletion of your profile and data.
- Right to Restrict Processing: Object to processing of data for analytics or model optimization.
08. Contact & Inquiries
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Data Protection Team at:
Sorika Labs — Privacy & Legal Operations
Email: privacy@sorika.org / support@sorika.org
Response SLA: Within 48 business hours