Last updated: May 2026
Ringfence is a product of Settleby Ltd, a company registered in England and Wales (No. 15107426, VAT GB448267759).
This Privacy & Cookie Policy explains how Settleby Ltd ("we", "us") collects, uses, and protects personal data when you use Ringfence — the ringfence command-line tool, local proxy, and cloud dashboard at ringfence.dev. Settleby is the data controller for personal data processed in connection with the Service.
We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and — where applicable — the EU General Data Protection Regulation. Section 11 sets out a notice for residents of California, USA.
Ringfence is built around a privacy boundary. The local agent runs on your machine and is the only component that ever sees prompt or completion content. The cloud receives metadata only:
This boundary is enforced in the local proxy's source code. If you operate the local agent in offline mode, no metadata is transmitted at all and budget enforcement continues to work.
Subscription billing is handled by Stripe. Stripe acts as an independent data controller for payment-related data, including card details. We receive from Stripe a customer identifier, a subscription identifier, the plan you selected, and the renewal date. We do not store card numbers or bank credentials.
When the local agent is configured to report to the cloud, it sends signed heartbeats containing the metadata listed in section 2. These heartbeats are linked to your team and to the agent identifier you issued, but contain no prompt or completion content.
Our cloud servers log standard request information for security and reliability: timestamp, method, path, status code, IP address, and user-agent. Logs are retained for up to 90 days.
If you contact us, we keep a record of the message and our response so we can follow up. If you opt in to product updates, we will email you occasionally about new features; you can unsubscribe at any time.
We do not sell or rent personal data. We do not use your data to train AI models, and we do not share your data with advertising networks.
We rely on a small set of trusted providers to operate the Service:
Each provider acts as either an independent controller (Stripe for card data) or a processor under a written agreement that includes the equivalent of UK GDPR Article 28 obligations. The current list of sub-processors for paid customers is also reflected in section 7 of the Data Processing Addendum at /dpa.
Your data is primarily processed in the United Kingdom. Where any sub-processor transfers data outside the UK or European Economic Area, we rely on the UK International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses, supplemented where necessary by additional safeguards.
Under the UK GDPR (and the EU GDPR where applicable) you have the right to:
To exercise any of these rights, email hello+privacy@ringfence.dev. We will respond within 30 days.
We take reasonable technical and organisational measures to protect personal data, including:
If we become aware of a personal data breach affecting your data, we will notify the relevant supervisory authority within 72 hours where required by law, and notify you without undue delay where the breach is likely to result in a high risk to your rights.
ringfence.dev uses a small number of cookies, all strictly necessary for the Service:
We do not use advertising cookies, third-party analytics cookies, or social media trackers. If we ever introduce optional analytics, we will ask for your consent through a cookie banner before any such cookie is set.
If you reside in California, the California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA) gives you certain rights regarding personal information.
Categories of personal information we collect, as described in section 3: identifiers (email), commercial information (subscription details), internet activity (operational logs), and inferences derived from heartbeat metadata.
We do not "sell" or "share" personal information for cross-context behavioural advertising as those terms are defined under the CPRA. We have not done so in the past 12 months.
California residents have the right to know, delete, correct, and limit the use of sensitive personal information. Because we do not sell or share, the "Do Not Sell or Share" right is moot, but we honour confirmation requests on demand.
To exercise these rights, email hello+privacy@ringfence.dev. We will not discriminate against you for exercising any of them.
The Service is not directed at children under 16, and we do not knowingly process their personal data. If you believe a child has provided personal data to us, contact hello+privacy@ringfence.dev and we will delete it.
We may update this Privacy & Cookie Policy from time to time. Material changes will be notified by email and reflected in the "Last updated" date at the top of this page. Older versions are available on request.
Settleby Ltd, registered in England and Wales (No. 15107426).
Privacy enquiries: hello+privacy@ringfence.dev
If you are unhappy with how we have handled your data, you can lodge a complaint with the UK Information Commissioner's Office at ico.org.uk or with your local EU supervisory authority.