Privacy Policy

Current operator:

Retractability Bicycles LLC

Principal location:

Glendale, Arizona, United States

Contact:

support@splittai.app

Effective date:

October 22, 2026

Last updated:

October 22, 2026

Retractability Bicycles LLC, an Arizona limited liability company with a principal business location in Glendale, Arizona, currently operates the Splitt service under the “Splitt” name. In this Privacy Policy, “Splitt,” “we,” “us,” and “our” refer to Retractability Bicycles LLC in its capacity as operator of the Splitt website, applications, and related services.

Splitt AI LLC is expected to be formed as a separate Arizona entity. If that entity later becomes the operator of Splitt, we will update this Privacy Policy, provide notice where required, and follow a documented transfer process. The anticipated formation of Splitt AI LLC does not mean that entity currently operates the service.

This Privacy Policy explains what information we collect, how we use and disclose it, the choices available to you, and how to contact us. It applies to the Splitt marketing website, account and workspace application, and related communications and support interactions that link to this Policy.

Splitt is intended for people in the United States who are at least 18 years old.

1. Information We Collect

The information we collect depends on how you use Splitt and which features are enabled for your workspace.

1.1 Account and profile information

We may collect:

• your name;
• email address;
• authentication identifiers and account status;
• credentials received transiently by the signup/login server flow and forwarded to Supabase Auth for authentication;
• email-verification, password-recovery, multi-factor-authentication, and session information;
• profile and preference settings;
• accessibility, motion, theme, and interface preferences;
• account creation, last sign-in, and security-event information.

Splitt does not intentionally log passwords or store them in Splitt business records. Passwords must never enter analytics, product events, feedback, or application logs. This describes the intended handling policy and inspected server flow, not an independent security audit. Do not send credentials to support.

1.2 Organization, company, and membership information

When you create or use a workspace, we may collect:

• organization and company names;
• workspace identifiers and settings;
• your role, permissions, title, and membership status;
• invitations and membership relationships;
• company profile and onboarding information;
• company industry, stage, website, description, goals, and other details you choose to provide.

1.3 Business records and workspace content

Splitt allows users to record and organize business information. Depending on your use, this may include:

• company facts and business context;
• founder-reported information;
• product stage and prototype status;
• customer, market, partnership, and relationship information;
• projects, tasks, goals, milestones, experiments, priorities, and activities;
• metric definitions and readings;
• business-finance records such as funding events, sales, expenses, commitments, and manually reported cash information;
• comments, notes, descriptions, and other content you enter;
• source and provenance information showing where a record came from.

Splitt distinguishes funding received from current available cash. We do not automatically treat a funding event as proof of current cash.

1.4 Conversations and AI-assisted content

When you use Ask Splitt or another AI-assisted feature, we may collect and process:

• your messages and instructions;
• AI-generated responses, summaries, classifications, and proposed actions;
• the company records, page context, or source material authorized for use in the request;
• tool calls and safe operational metadata;
• citations and research-source references where available;
• whether you reviewed, edited, confirmed, cancelled, or ignored a proposed change;
• model/provider request identifiers, token usage, latency, and estimated cost information.

We do not use your messages as advertising content. We do not sell them. AI providers may process request and response content as service providers. See “AI and automated processing” below.

1.5 Documents, files, and extracted content

If document features are enabled and you upload or attach files, we may collect and process:

• the file and its metadata, including filename, type, size, upload time, and version;
• extracted text and document structure;
• page, slide, section, heading, row, or line references;
• OCR results for scanned or image-based documents;
• document-processing status and error information;
• document chunks used for search and source-grounded answers;
• citations and links between documents and conversations.

Do not upload information unless you have the legal right and appropriate authorization to do so.

1.6 Feedback and support information

If you contact us or submit feedback, we may collect:

• your sender and recipient addresses, message headers, subject line, message body, and conversation metadata when you email us;
• attachments you intentionally include in an email or feedback submission;
• the message you send;
• feedback category and optional rating;
• your account, company, and route context;
• browser and device family;
• application version and recent safe event names;
• a screenshot only when you explicitly choose to attach one;
• communications related to support, privacy, security, accessibility, or copyright requests.

Feedback screenshots may contain information visible on your screen. Review a screenshot before submitting it and remove anything you do not want to share.

1.7 Usage, analytics, and device information

Subject to your privacy choices and our configuration, we may collect:

• page and feature views;
• semantic interaction events, such as which named control or feature was used;
• signup, onboarding, activation, and feature-adoption events;
• aggregate click and section-engagement information;
• coarse click-position or viewport buckets used for privacy-conscious interaction maps;
• browser type, operating system, device category, viewport category, and language;
• page route templates and referrer categories;
• approximate geographic information supplied by hosting or analytics providers;
• performance, reliability, retry, and sanitized error categories;
• analytics session identifiers designed not to contain business content;
• dates and times of activity.

We do not intentionally collect through analytics:

• passwords;
• AI prompts or responses;
• document contents or filenames;
• form-field values;
• company names or user-generated titles;
• financial amounts;
• clipboard contents;
• keystrokes;
• raw DOM content;
• precise mouse trajectories;
• cross-site browsing histories.

1.8 Technical, security, and log information

We may collect information necessary to operate and protect the service, such as:

• IP address and request metadata;
• session and authentication events;
• host, origin, and security-header information;
• fraud, abuse, and rate-limit signals;
• audit logs and administrative actions;
• server and database logs;
• error and diagnostic information;
• document-worker and background-job health;
• records needed to investigate incidents, enforce our Terms, and protect users.

2. How We Collect Information

We collect information:

• directly from you when you create an account, use the service, upload content, or contact us;
• from other authorized users in your organization or company;
• automatically from your browser, device, and use of the service;
• from connected services you choose to authorize;
• from service providers that help us host, authenticate, communicate, analyze, or provide AI features;
• from public sources only when a feature that uses public information is enabled and you direct or authorize its use.

Public web research is not currently enabled as a general production feature.

3. How We Use Information

We may use information to:

• create, authenticate, and secure accounts;
• provide company workspaces and enforce roles and permissions;
• store and organize business records;
• provide conversations, AI-assisted suggestions, document processing, OCR, source retrieval, and citations;
• prepare reviewed business updates and proposed actions;
• calculate deterministic summaries, priorities, and product states from recorded information;
• display Business Pulse, projects, tasks, goals, metrics, finances, and Knowledge;
• operate feedback, announcements, support, and accessibility processes;
• send transactional or relationship communications, including verification, security, password-reset, and product-service notices;
• analyze aggregate product performance and feature usage, subject to privacy controls;
• prevent fraud, abuse, unauthorized access, and cross-company data exposure;
• debug and improve reliability, accessibility, security, and usability;
• enforce our Terms and comply with law;
• establish, exercise, or defend legal claims;
• complete a merger, financing, reorganization, or transfer of the Splitt business, subject to the protections described below.

We do not use personal information to make decisions about credit, employment, housing, insurance, medical treatment, or other legally significant eligibility decisions.

4. AI and Automated Processing

Splitt uses automated models to generate suggestions, summaries, classifications, OCR results, and proposed actions when the relevant features are enabled.

AI output can be incomplete, inaccurate, outdated, or unsuitable. Important information should be independently reviewed. Splitt does not provide legal, medical, tax, accounting, investment, or other licensed professional advice.

Where Splitt presents a reviewed action, the action is not saved until an authorized user confirms it. Manual forms may save when a user submits them. Not every suggestion or output is independently verified.

The founder-confirmed launch stack uses the OpenAI API for authorized AI-assisted requests. OCR is available where enabled; the founder reports it enabled, but hosted OCR processing has not been fully verified. OpenAI documents that API data is not used for training by default; the founder confirms no intentional opt-in to training-data sharing. Zero Data Retention and the exact retention tier are not verified. Provider retention, regional processing, abuse monitoring and legal exceptions still require review.

We do not currently enable general public-web research in production.

For more information, see the AI Features Notice and Subprocessor List.

5. How We Disclose Information

We may disclose information in the following circumstances.

5.1 Within your company or organization

Authorized members of a company or organization may access information according to their role and permissions. Some access may be inherited through organization ownership or administration. Users should not upload information they are not authorized to share with other members of their workspace.

5.2 Service providers and subprocessors

We use service providers to host, authenticate, store, communicate, analyze, and provide AI-assisted features. These providers may process information on our behalf under their own contractual and legal obligations.

Current provider categories include:

• Supabase for authentication, database, storage, and related infrastructure; the founder reports the project region as West US (Oregon), without verification of every processing or backup location;
• Vercel for hosting, delivery, and Web Analytics;
• OpenAI API for authorized AI-assisted processing; OCR is available where enabled and hosted acceptance remains pending;
• Resend for outbound email delivery and inbound support, privacy, legal, security, accessibility, and copyright communications, including message content and attachments;
• Splitt first-party product analytics, operated by Splitt rather than a separate external subprocessor.

Google OAuth/Workspace and TypeSafe/Jev are treated as inactive for publication and are not active launch subprocessors. Repository support or local shadow testing does not establish production use. Actual activation or shadow processing requires an updated disclosure.

We do not currently use Stripe for live billing.

See the Subprocessor List for additional detail and current status.

5.3 Legal and safety reasons

We may disclose information when we reasonably believe it is necessary to:

• comply with law, legal process, or a valid governmental request;
• protect the rights, property, or safety of Splitt, users, or others;
• investigate fraud, abuse, security incidents, or violations of our Terms;
• enforce agreements;
• establish, exercise, or defend legal claims.

5.4 Business reorganization or transfer

We may transfer information in connection with a merger, financing, reorganization, change of control, sale of assets, or transfer of all or part of the Splitt business.

Splitt AI LLC is expected to be formed as a separate Arizona entity. If that entity becomes responsible for operating Splitt or processing personal information covered by this Policy, we will update this Policy and provide notice where required. A business transfer will not by itself authorize the new operator to use previously collected information for materially different, incompatible purposes without any additional notice or consent required by law.

5.5 With your direction or consent

We may disclose information when you direct us to do so, authorize an integration, or otherwise consent.

6. Sale, Sharing, and Advertising

Splitt does not sell personal information.

Splitt does not share personal information for cross-context behavioral advertising.

Splitt does not use customer business content or user account information to target third-party advertising.

If these practices change, we will update our disclosures and provide any choices required by law before the changed practice begins.

7. Cookies, Storage, and Analytics

Splitt uses cookies and browser storage for authentication, security, account flows, preferences, drafts, interface state, notices, and analytics choices.

Optional browser analytics are subject to Splitt’s privacy-control design. Where enabled, Splitt honors Global Privacy Control and Do Not Track signals by disabling optional browser analytics. Necessary authentication, security, and service functionality may continue because they are required to provide the service.

Vercel Web Analytics is designed as a cookie-free analytics service that uses aggregated data and a request-derived visitor hash that resets daily. Splitt nevertheless gates optional analytics according to its privacy controls and excludes private, sensitive, and legal routes.

You can manage available analytics choices through the product’s privacy controls. Withdrawing analytics permission does not delete operational, security, audit, or completed business-action records that are separate from optional browser analytics.

For more information, see the Cookie & Tracking Policy.

8. Data Retention

We retain information for as long as reasonably necessary to provide Splitt, maintain security, comply with law, resolve disputes, enforce agreements, and support legitimate business operations.

Our operational target is to delete or de-identify eligible active-service content within seven days after a verified deletion request. Eligibility depends on identity, authority, shared-workspace rights and applicable retention obligations. This is an operational target, not a guarantee of complete deletion within seven days. No public self-service deletion flow currently exists; requests are handled through support@splittai.app. The production fulfillment process and its capacity to meet this target have not been fully verified.

Information may be retained longer when necessary for:

• security, fraud prevention, and abuse detection;
• audit and accounting obligations;
• legal claims, litigation holds, or regulatory requirements;
• backup rotation and disaster recovery;
• records that must be retained to document consent, Terms acceptance, or completed transactions;
• de-identified or aggregated analytics that no longer reasonably identify a user;
• information belonging to another authorized user or company that cannot be deleted solely because one member leaves.

Retention matrix

This matrix distinguishes code-supported behavior from operational targets. Retention limits for analytics are pruning thresholds, not a guarantee that a job runs at an exact time.

No account-deletion trigger is represented as automatically clearing account-linked analytics. Authorized request handling must assess those records separately.

Third-party providers may retain information under their own policies and contractual terms. Support, privacy, legal, security, accessibility, and copyright email sent to support@splittai.app is processed and stored through Resend. We have not enabled an inbound webhook or automated AI triage for that inbox at launch; authorized people review and respond to those messages. If that practice changes, we will update this Policy and provide any notice required by law.

9. Security

We use administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. These measures include role-based access, tenant isolation, authentication controls, logging, private storage, and other safeguards appropriate to the service.

No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting account credentials, using a strong unique password, maintaining control of your email account, and promptly reporting suspected unauthorized access.

To report a suspected security issue, email support@splittai.app with the subject line “Splitt Security Report.” Please do not include passwords, authentication tokens, or unnecessary sensitive information in an initial report.

10. Your Choices and Rights

Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, or other control over personal information.

You may:

• update certain profile and workspace information through the service;
• request account deletion through support@splittai.app;
• manage optional analytics choices;
• request access, correction, or deletion by email;
• object to or opt out of certain processing where applicable.

Splitt does not currently provide a self-service data-export tool. You may email us to request access to or a copy of personal information, subject to identity verification, applicable law, and the rights of other users and organizations.

Send privacy requests to support@splittai.app with the subject line “Splitt Privacy Request — [Access / Correction / Deletion / Export / Account Closure / Other].” Identity and authority may be verified. Company and shared-workspace data may require additional authorization. Some security, audit, legal, backup and transaction records may be retained where required or reasonably necessary. Do not send passwords or authentication tokens.

If you are acting for another person, we may require proof of authorization.

11. California Disclosures

11.1 California Online Privacy Protection Act

This Policy describes:

• categories of information collected;
• categories of third parties with whom information may be disclosed;
• how users can request review or correction;
• the effective date of the Policy;
• our treatment of Do Not Track and similar privacy signals.

11.2 California Consumer Privacy Act

Splitt may not currently meet the statutory thresholds that define a covered “business” under the California Consumer Privacy Act. If and to the extent the CCPA applies, California residents may have rights including access, correction, deletion, and information about collection and disclosure practices.

Splitt does not sell personal information or share it for cross-context behavioral advertising. Splitt honors Global Privacy Control for optional browser analytics under its current privacy-control design.

We will not discriminate against a user for exercising an applicable privacy right.

12. Children and Age Restrictions

Splitt is not intended for anyone under 18. You may not create an account or use Splitt if you are under 18.

We do not knowingly collect personal information from children. If you believe a person under 18 has provided information to Splitt, contact support@splittai.app with the subject line “Splitt Privacy Request — Minor.”

13. United States Availability

Splitt is initially offered only to users located in the United States. We do not currently represent that Splitt is designed to satisfy the laws of every country or jurisdiction.

Do not use Splitt from a jurisdiction where doing so would violate applicable law or these Terms.

14. Communications

We may send transactional or relationship communications, including:

• account verification;
• password recovery;
• security notices;
• service changes;
• legal-policy updates;
• account and workspace notices;
• product announcements related to your use of Splitt.

If we send commercial marketing email, we will provide the notices and opt-out mechanisms required by applicable law. Opting out of marketing does not prevent necessary transactional or security messages.

15. Third-Party Links and Services

Splitt may link to or integrate with third-party services. Their privacy practices are governed by their own policies. We are not responsible for third-party services that we do not control.

Review a provider’s terms and privacy disclosures before authorizing an integration or submitting sensitive information.

16. Changes to This Policy

We may update this Policy as Splitt changes. We will update the “Last updated” date and provide additional notice where required or appropriate.

If a change materially affects how previously collected personal information is used, we will provide any additional notice or consent required by law rather than relying solely on silent retroactive changes.

You may contact us to request information about prior policy versions.

17. Contact Us

For privacy questions or requests, contact:

Retractability Bicycles LLC Splitt Privacy Glendale, Arizona, United States Email: support@splittai.app Suggested subject: “Splitt Privacy Request — [Access / Correction / Deletion / Other]”

The same monitored inbox receives general support, legal, security, accessibility, and copyright messages. Please use the subject line requested in the relevant notice so the message can be routed appropriately.

We do not currently publish a street address or telephone number. If a law, legal process, or selected compliance procedure requires a physical mailing address, that process will remain unavailable until an appropriate address is designated.

Splitt is a product operated by Retractability Bicycles LLC.

Contact support@splittai.app. For privacy requests, use the subject “Splitt Privacy Request”. Do not send passwords or authentication tokens.