Retriever AI (rtrvr.ai) Privacy Review: Safe for Client Work?

Short answer: Retriever AI’s free plan is paid for with sponsored content, which means excerpts of what you ask the agent to do can reach advertising partners, and the company also packages its production runs into training data for other AI labs. Our verdict is AVOID FOR PAID CLIENT WORK. Policy reviewed October 2026, six days after the free browser agent launched on Product Hunt. Retriever AI, branded rtrvr.ai, is a Chrome extension and cloud service that clicks, types and fills forms for you: it finds leads, sends LinkedIn messages, completes job applications and moves results into Google Sheets. For a solo consultant, that is real time saved. It also means an AI agent working inside your signed-in accounts, on pages that may hold client names, invoices and contracts. Below is what the documents say, checked against how we vet privacy claims.

What Retriever AI does with your data

Privacy at a glance

The most unusual part of Retriever’s model is how the free tier is funded. Per the rtrvr.ai privacy notice (last updated October 1, 2026, retrieved 2026-10-14), every free-plan task runs in “Free Mode”, and Free Mode is supported by sponsored cards shown next to your results. To pick and measure those ads, the company and its ad partners may process a slice of your agent conversation along with device and platform signals. On the cloud dashboard, it adds that limited account information can also be passed to an advertising partner, with an opt-out under Settings, Sponsored cards. Bringing your own API key on the free plan removes the model cost but not the sponsored content, according to the terms.

Two exceptions matter. Users the company identifies as being in the EU, EEA or UK get contextual ads only, with no personal data shared. And paid plans can switch Free Mode off entirely.

On training, the messages conflict. The permissions and privacy page in the docs says your data does not train AI models and that rtrvr does no model training. Yet the company’s Data and Evals page says it turns more than 7 million production runs into trajectories, environments and evals for teams building agents, with redaction scoped per buyer. The published sample runs include a job application and a LinkedIn message sent by a user. The privacy notice also excludes one feature’s browsing context from “workflow data licensing”, which tells you that category of use exists.

Model routing is wider than the docs suggest. The docs mention a contract with Google, but the live models page showed GPT-6 Luna (via OpenAI and Azure) handling 59% of calls, and GLM 5.3 Flash, the Free Mode model, served 57% of the time through Z.ai, the API platform of Chinese lab Zhipu. Google’s Gemini models carried under 1% of traffic.

What this means for solo freelancers

Browser agents are only as private as the pages they read. Retriever reads the full interactive state of every page it touches, so anything visible to you during a task is visible to the pipeline. Three scenarios stand out.

If you run client prospecting on the free plan, the brief you type (“find 50 HR directors at Acme’s competitors and message them”) is part of your agentic interaction. Based on the policy as written, an excerpt can go to an ad partner to select a sponsored card. A client’s go-to-market plan is exactly the kind of confidential detail an NDA covers, and you have no say over which partner sees it.

If you use it on a client’s invoicing portal or CRM, that page state may end up in the production runs the company curates for AI labs. The task mix the company publishes includes business systems and invoicing (7.5% of runs), professional outreach (11.2%) and document work (12%). Redaction is promised, but its scope is set with the buyer, not with you, and there is no documented opt-out for standard paid plans.

If you work for EU clients, the controller-processor question gets messy fast. The vendor names itself the controller of the data it handles, allows storage anywhere in the world, routes model calls through several providers including one based in China, and publishes no data processing agreement or sub-processor list that we could find. Based on the policy as written, this approach carries a real documentation gap: you would struggle to tell a client where their personal data went. Our explainer on what a data processing agreement means for solo consultants covers what to ask for.

The extension also syncs up to 500 open-tab URLs and titles once a day by default to power its “For you” suggestions. Tab titles often carry client names and project codes.

How to use it safely

If you still want Retriever for your own lead generation, set it up like a contractor you do not fully trust.

1. Install it in a dedicated Chrome profile. Chrome profile icon, Add, name it “rtrvr only”, and install the extension there. Never sign that profile into client Google Workspace, banking or password-manager accounts. The vendor’s own docs recommend this.
2. Turn off “For you” collection. Open the extension, go to For you preferences, stop open-tab collection and leave Chrome history access off. Clear the feature’s existing context while you are there.
3. Pay to leave Free Mode, or stay on public data. On Starter ($9.99/month) or above, open the model picker and switch Free Mode off so tasks run on credits with no sponsored content. On the free plan, limit tasks to public web research.
4. Disable ad-partner sharing in Cloud. In the cloud dashboard, open Settings, Sponsored cards, and turn off “Share data with ad partner”. Enabling Global Privacy Control in your browser also counts as an opt-out.
5. Keep Cookie Sync off for client logins. Cookie Sync copies chosen Chrome logins into rtrvr’s cloud storage and refreshes them as often as every 15 minutes. Use it, if at all, only for your own social accounts.
6. Redact before you prompt. Replace client names with codes like “Client A” in instructions, and do not point the agent at portals showing other people’s personal data.

For a broader routine, our guide on how to opt out of AI training for freelance work walks through the same checks for other tools.

Privacy-friendlier alternatives

The honest alternative to an ad-funded cloud agent is either an agent you run yourself or tighter control over the accounts any agent can reach. These options match that category.

• Browser Use (open source): what it gives you that Retriever does not is local control. You run the agent on your own machine with your own model API key, so no ad partner, no vendor trajectory corpus and no cookie copies in someone else’s cloud. The library is free; you pay only your model provider. Best for technical freelancers and developers comfortable with Python.
• Bitwarden: open-source password manager with a free personal tier and team plans around $4 per user per month. It lets you keep client credentials in a vault the agent never sees, instead of in a browser profile an extension can read. Best for solos who want auditable code.
• NordPass: a lower-cost password manager with secure item sharing and breach alerts, useful for separating client logins from the profile you automate. Personal plans start at a few dollars a month on longer terms. Best for budget-minded freelancers who want a simple setup.
• YubiKey 5 Series: a hardware security key, roughly $50 one-time. If an agent or extension is ever compromised, a phishing-resistant second factor keeps client accounts locked. Best for anyone whose single Google login opens several client workspaces.

Whichever agent you pick, the test is the same three questions: who pays for the model calls, where do your page states end up after the task, and can you get a signed processing agreement. A tool you run on your own key answers all three in your favor. A password manager and a hardware key do not replace an agent, but they shrink what any agent, extension or leaked session can reach.

If you mainly want an agent for scheduled research rather than form filling, compare our reviews of Airtop’s cloud browser agent and Perplexity Computer before you commit client accounts to any of them.

The verdict

Frequently asked questions

Does Retriever AI train on my data?

The company’s own pages disagree, which is the problem. The docs say rtrvr does no model training and that your data does not train AI models. The company’s Data and Evals page says it turns over 7 million production runs into trajectories and evals sold to teams building agents, with redaction agreed per buyer. Third-party data from Gmail or Drive integrations is excluded from training generalized models. Treat everything else you run as potentially reusable.

Is the free version of rtrvr.ai safe for client data?

No, based on the policy as written. Free-plan tasks always run in Free Mode, which is funded by sponsored cards. To serve those, the company and its ad partners may process an excerpt of your agent conversation plus device signals, and in the cloud dashboard some account data can be shared with an ad partner unless you opt out. Bringing your own API key does not remove sponsored content. Use the free plan for public research only.

Is Retriever AI GDPR-friendly for EU client work?

Based on the policy as written, it is hard to document. Users identified in the EU, EEA or UK get contextual ads only, which helps. But the vendor allows worldwide data transfers, routes models through several providers including Z.ai, and we found no public processing agreement or sub-processor list. If you handle personal data for an EU client, get those documents in writing first or keep that work out of the tool.

Can I use Retriever AI for HIPAA data?

Based on the public documents, no. Neither the privacy notice nor the terms mention HIPAA or offer a business associate agreement, and the company does not describe any healthcare-specific safeguards. Private Mode on the higher tiers keeps task content out of server logs, but zero retention alone does not create the contract HIPAA requires. Keep patient records, therapy notes and insurance portals away from this agent entirely.

What does Private Mode change?

Private Mode is Retriever’s zero data retention option. It processes tasks in memory and keeps task content out of server-side logs and storage, and it cannot be combined with Free Mode. The pricing page lists it on the Team plan at $99.99 a month and Scale at $499.99, while the privacy notice says Enterprise and Scale. Confirm with the vendor which plan you need before paying, and ask in writing whether Private Mode runs are excluded from the trajectory corpus.

Sources

• rtrvr.ai Privacy Notice, last updated 2026-10-01 (retrieved 2026-10-14)
• rtrvr.ai Terms of Service (retrieved 2026-10-14)
• Retriever AI Docs: Permissions and privacy (retrieved 2026-10-14)
• Retriever AI Docs: Cookie sync (retrieved 2026-10-14)
• rtrvr Data and Evals page, plain-text version (retrieved 2026-10-14)
• rtrvr Models page, live 24-hour provider shares (retrieved 2026-10-14)
• rtrvr Pricing (retrieved 2026-10-14)
• Retriever AI on Product Hunt, launched 2026-10-08 (retrieved 2026-10-14)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 14, 2026.