Rampt

Privacy Policy

Last updated: July 25, 2026

Who we are

Rampt is operated by Astral AI Inc., 2 Marina Blvd B300, San Francisco, CA 94123 ("Rampt", "we"). Contact: hello@getrampt.co.

The two roles we play

1. For our own website, demo, and customer accounts, we are the data controller.

2. For the end-user data our SDK processes inside a customer's product, we are a data processor acting on the customer's instructions. That processing is governed by our Data Processing Agreement, and the customer is responsible for providing their own users appropriate notice.

What we collect as a controller

• Customer account data: workspace name, contact email, and the keys we issue (an ingest key and an admin token). We never see or store payment card details; payments are processed by Stripe, whose privacy policy applies to checkout.
• Website data: standard server logs. We do not use advertising trackers, cross-site tracking, or sell data.
• The public demo (the Assay test bed): sessions there, including text a visitor types, are public sample data shown on an open dashboard. The demo says this before a visitor starts. Do not enter private information in the demo.

What the SDK processes for customers (as processor)

The Rampt SDK records first-session behavioral events inside the customer's product, per the public event schema: session and interaction events, time measurements, the messages the panel showed (which are always sentences the customer authored), and a user identifier the customer supplies. Two categories deserve plain words:

• Partial text: when a user types into an intake question and deletes it, the cleared text can be kept as stall evidence. It is redacted automatically after a retention window (default 30 days, customer-configurable), and customers can disable its storage entirely.
• What we never collect: payment details, passwords, or the content of the customer's product beyond the elements Rampt is explicitly configured to touch. The SDK makes no AI calls at runtime and Rampt does not use anyone's personal data to train AI models.

Retention, export, deletion

• Customers can export their workspace's raw event data (NDJSON) at any time, self-serve.
• Partial text redacts on the schedule above. Workspace data is deleted within 30 days of a customer's termination request.
• Demo test-bed data is sample data and may be cleared at any time.

Subprocessors

Subprocessors of end-user data: hosting, Vercel Inc.; database, Neon Inc. Payments are handled by Stripe Inc., which processes billing as an independent controller in its own right, not a subprocessor of end-user data. We give customers 30 days' notice of changes to the subprocessor list via the DPA.

Your rights

Depending on your location (including under GDPR and CCPA), you may have rights to access, correct, delete, or export personal data, and to object to processing. For data we control, contact hello@getrampt.co. For data processed inside a customer's product, contact that customer (the controller); we assist them as the DPA requires.

Changes

We will post changes here with a new effective date, and notify customers of material changes.