Privacy Notice

Who controls your data

Ritla is operated by Omran Khleifat, an individual based in Dubai, United Arab Emirates, who decides how the personal data described here is used and is responsible for it (the “controller”). Every privacy question and data request goes to hello@ritla.app and is answered by that person.

What we collect

The email address you sign in with, and the names of the workspaces and projects you create. The URLs you submit and the settings of each scan. Invitations you send to colleagues, which hold their email address.

What you type into our forms: the request-access form (email, website, the plan you asked about and your note) and the services enquiry form.

For the free public scanner, a salted one-way hash of your IP address, used only to apply rate limits. We do not store the address itself.

Billing records Polar sends us when you buy or change a plan: which plan, its status and renewal dates, and identifiers that link the subscription to your workspace. Card details go to Polar and never reach us.

Analytics events, only if you accept analytics cookies (section 4), and error reports when something breaks.

We do not buy data about you from anyone, and we do not infer anything about you beyond the list above.

Scan data and the URLs you submit

A scan loads each page the way a browser would and keeps what is needed to show you a finding: text fragments from the page, CSS selectors, and full-page screenshots at each screen width. The URL itself is often the sensitive part, especially for a staging or unreleased site, and we treat it that way.

Scans are visible only to members of your workspace, and to us when you ask for help or we need to investigate a fault. A report is only visible to anyone else if you choose to share its link.

When you scan a site you do not own, we hold content that belongs to someone else, on your authority (see section 5 of the Terms). If the owner of a scanned site asks us to remove what we hold about it, we will.

Cookies and analytics

The only cookie Ritla sets for itself is the sign-in session, which is strictly necessary and needs no consent.

We use Google Analytics 4 on the production site to count visits, only with your consent. A bar at the top of the page asks first, and no analytics code runs until you accept, so declining means no analytics cookies and no identifiers. Advertising storage is always denied, because Ritla runs no advertising. You can change or withdraw your choice at any time from Cookie settings at the foot of every page.

How long we keep it

Findings, scores and fix guidance are kept for as long as your account exists. Screenshot evidence is deleted automatically on a per-plan clock, from 30 days on a free or lapsed workspace up to 365 days on the largest plan, except that each project's most recent finished scan keeps its evidence regardless of age. Evidence from an anonymous public scan is deleted after 7 days.

When you delete your account, we delete it together with its workspaces, projects, scans and screenshots within 30 days. We keep billing records for as long as tax and accounting law requires, and Polar keeps its own records as the seller.

Who processes it on our behalf

Supabase (database, sign-in and file storage), Vercel (hosting of the site and its API), Railway (the scan worker and its headless browser), Resend (sign-in and notification emails), Sentry (error reports), Google Analytics 4 (visit counting, with consent) and Polar (payments, tax and invoicing, as merchant of record).

Each receives only what it needs to do its job for us. If we add or replace one, we update this list and the date at the top of the page.

Legal bases and international transfers

We process your data because it is needed to provide the service you signed up for (your account, scans and billing), because we have a legitimate interest in keeping Ritla secure and working (rate limiting and error reports), because you consented (analytics), or because the law requires it (billing records).

The providers above run their services outside the United Arab Emirates, so your data is transferred abroad to reach them. We rely on their contractual data protection commitments for those transfers.

The UAE Personal Data Protection Law applies to our processing. If you are in the European Union or the United Kingdom, the GDPR or UK GDPR may also apply, and the rights in section 8 are available to you in full.

Your rights, including erasure

You can ask for a copy of your data, a correction, its deletion, or that we stop or restrict a particular use of it, and you can withdraw consent to analytics at any time. Email hello@ritla.app from the address on your account. There is no self-serve delete button yet, so a person carries out the request by hand, within 30 days.

If you are not satisfied with our answer, you can complain to the data protection authority where you live.

Security

Each workspace is isolated in the database itself, not only in application code. Screenshots are held in private storage and reached through short-lived signed links. All traffic is encrypted in transit. The scanner is prevented from reaching private or internal network addresses.

If a breach affects your personal data, we will tell you without undue delay, and notify any authority the law requires.

Children

Ritla is a tool for people who build websites and is not directed at children. You must be 18 or over to hold an account. If we learn that an account belongs to someone younger, we delete it.

Changes to this notice

We may update this notice. For a material change we will email the address on your account before it takes effect, and the date at the top of this page always shows the version in force.

Contact

Privacy questions and data requests: hello@ritla.app. Postal contact: Omran Khleifat, Dubai, United Arab Emirates.