Privacy Policy

This Privacy Policy explains how Virtuoso Arts d/b/a rearranger.ai ("rearranger.ai", "we", "us", "our") collects, uses, and protects personal data when you use the rearranger.ai service at https://rearranger.ai (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

If you have questions about this policy, please contact us at [email protected].

1. Data we collect

1.1 Account information

When you create an account, we collect your name and email address. If you sign up via Google OAuth, we receive your name, email address, and Google account identifier. We store a hashed version of your password — we never store your password in plain text.

1.2 Uploaded files

To provide the conversion service, you upload keyboard style files (.sty, .prs, .aks) to our servers. These files are processed by our conversion pipeline and the converted output is made available for you to download. We treat these files as your content — we do not read, analyse, or retain them beyond what is necessary to provide the service.

Retention: Uploaded files and converted output files are automatically and permanently deleted 24 hours after the conversion job completes, regardless of whether you have downloaded them.

1.3 Usage data

We collect technical usage data including:

• IP address and approximate geolocation (country/region level)
• Browser type and version
• Pages visited and features used within the Service
• Timestamps of login, conversion start, and download events
• Error logs and performance data

This data is used to operate and improve the Service and to diagnose technical problems. It is not used for advertising purposes.

1.4 Billing information

Subscription payments and credit pack purchases are processed by Stripe, Inc. We do not store your full card number or CVV on our servers. We receive and store your billing name, address, and the last four digits of your card for invoice purposes. Stripe's processing of your payment data is governed by Stripe's Privacy Policy.

1.5 Communications and AI support chat

If you contact us by email or use the AI support chat, we retain the correspondence to respond to your request and for customer support records. AI support chat messages are sent to Anthropic's Claude API for processing — Anthropic does not use this data for model training. Chat transcripts are not stored on our servers unless escalated to a support ticket, in which case they are retained with the ticket. We send transactional emails (account confirmation, password reset, payment receipts) and, if you opt in, occasional product update emails. You can unsubscribe from non-essential emails at any time.

2. How we use your data

We use the data we collect for the following purposes:

• Providing the Service: processing your conversion jobs, authenticating your account, and delivering your downloaded files.
• Billing and payments: managing your subscription, processing credit purchases, and issuing invoices.
• Improving the Service: analysing usage patterns (in aggregate, not per-user) to improve conversion quality and UI design.
• Security and fraud prevention: detecting and preventing abuse, unauthorised access, and fraudulent transactions.
• Legal compliance: retaining records as required by applicable law (e.g. tax records for invoices).
• Customer support: responding to your requests and resolving technical issues, including via AI-assisted chat.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Legal bases for processing (GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the Service you signed up for, including account management, conversion jobs, and billing.
• Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, security monitoring, and aggregate analytics to improve the Service.
• Legal obligation (Art. 6(1)(c) GDPR): retaining invoices and financial records as required by tax law.
• Consent (Art. 6(1)(a) GDPR): for optional communications such as product update emails. You may withdraw consent at any time.

4. Data retention

• Uploaded and converted files: deleted automatically 24 hours after job completion.
• Account data: retained for as long as your account is active. On account deletion, your personal data is removed within 30 days, except where we are required to retain it by law (e.g. invoice records for 7 years for tax purposes).
• Usage logs: aggregated and anonymised after 90 days; raw logs deleted after 12 months.
• AI support chat: chat analytics (category, message count, duration) are retained; full transcripts are not stored unless escalated to a ticket.
• Invoices and financial records: retained for 7 years to comply with EU accounting regulations.

5. Your rights under GDPR

If you are located in the EU/EEA, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your personal data, subject to legal retention obligations.
• Right to restriction: request that we limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a machine-readable format (JSON) and transfer it to another service.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: where we rely on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You may also lodge a complaint with your national data protection authority.

6. Data sharing and processors

We share personal data only with the following categories of processors, under data processing agreements where required by GDPR:

• Stripe, Inc. — payment processing (US, with Standard Contractual Clauses)
• Anthropic, PBC — AI support chat processing (US, with Standard Contractual Clauses; zero data retention policy for API usage)
• Cloud infrastructure provider — server hosting and storage (EU data centres)
• Email delivery provider — transactional email delivery

We do not transfer personal data to countries outside the EU/EEA except where adequate safeguards (Standard Contractual Clauses or adequacy decisions) are in place.

7. Security

We implement appropriate technical and organisational measures to protect your personal data including:

• TLS encryption for all data in transit
• Encryption at rest for all stored data
• Access controls limiting data access to authorised personnel only
• Automatic file deletion after 24 hours
• Password hashing using bcrypt with appropriate cost factors

No system is perfectly secure. In the event of a data breach that is likely to result in high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by GDPR.

8. Cookies

rearranger.ai uses only essential session cookies required for authentication. We do not use third-party advertising or tracking cookies. We use localStorage to store your authentication token client-side.

9. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Service at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact

Data controller: Virtuoso Arts, operating as rearranger.ai.
Privacy enquiries: [email protected]
General enquiries: [email protected]