Privacy Policy
Last updated: July 9, 2026
1. Information We Collect
We collect information you provide directly when using Rebiha:
- Account data: Name, email address, password (hashed), billing information processed by Stripe
- Training data: Datasets you select from our catalog for fine-tuning AI models
- Job metadata: Model selections, training parameters, job status, and completion timestamps
- Usage data: IP address, browser type, pages visited, and feature interactions (via standard server logs)
Training Data & Model Weights: We do not retain your training datasets — they are consumed during the fine-tuning process and not stored afterward. Fine-tuned model weights are retained for 30 days after job completion to allow download and verification, then scheduled for deletion. You may request early deletion at any time by contacting us.
2. How We Use Your Information
- To provide and operate the fine-tuning service
- To process payments and send billing notifications
- To communicate job status, errors, and completion
- To improve service performance and troubleshoot issues
- To comply with legal obligations and prevent fraud
We do not use your training data or fine-tuned weights to train our own models, sell to third parties, or for any purpose beyond delivering your specific job.
3. Data Retention
We follow the principle of minimal retention under Quebec Law 25:
- Account data: Retained while your account is active. Deleted within 30 days of account closure upon request.
- Training datasets: We do not store your training data. Datasets selected from our catalog are consumed during the fine-tuning job and not retained afterward.
- Fine-tuned model weights: Retained for 30 days after job completion to allow download, then scheduled for deletion. Early deletion available on request.
- Job logs & metadata: Retained for 90 days for troubleshooting and billing verification, then anonymized.
- Payment records: Retained for 7 years as required by tax law.
4. Data Transfers & Subprocessors
Your data is processed in the following jurisdictions:
- Google Cloud Platform (us-east4, Virginia, USA): Training jobs and model weights are processed on GCP VMs. This constitutes a transfer outside Quebec under Law 25.
- Stripe (USA): Payment processing and billing data.
We rely on standard contractual clauses and Google's & Stripe's SOC 2 / ISO 27001 certifications for these transfers.
5. Security
We implement the following measures:
- TLS 1.3 encryption for all data in transit
- GCP encrypts model weights at rest by default using AES-256
- Access controls and authentication for all systems
- Regular security reviews and dependency updates
No system is perfectly secure. In the event of a data breach affecting personal information, we will notify affected users and the Commission d'accès à l'information du Québec within 72 hours as required by Law 25.
6. Your Rights
Under Quebec Law 25, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information (subject to legal retention requirements)
- Withdraw consent for data processing
- File a complaint with the Commission d'accès à l'information
7. Cookies & Tracking
We use essential cookies for authentication and session management. We do not use third-party tracking cookies, analytics pixels, or advertising identifiers.
8. Children's Privacy
Our service is not intended for users under 18. We do not knowingly collect data from minors.
9. Changes to This Policy
We may update this policy as our service evolves. Material changes will be notified by email and posted on this page with a revised date.
10. Contact & Privacy Officer
This privacy policy is governed by the laws of Quebec, Canada, including the Act respecting the protection of personal information in the private sector (Law 25).