Privacy policy

Who operates Reyolk

Contact email

[email protected]

Privacy contact

[email protected]

Information Reyolk collects

Account setup uses your name, email address, password and business name. Passwords are stored as hashes. Business workspaces hold the customer details, conversations, files, appointments, quotations, orders and payment records entered by their users or received through connected channels.

Reyolk also records first-party page visits and interactions, business actions, connection status, error details and security events needed to operate, improve and protect the service. Product analytics exclude form values, message content and IP addresses. A one-way daily device key supports abuse prevention and daily counts without tracking a device across days. Logs exclude passwords, OAuth tokens and full message bodies.

Only share information needed for the task; do not put payment-card details, identity documents or unrelated sensitive information in messages or notes.

When you contact a business using Reyolk

The business you contact handles your enquiry, booking or order. Its staff can access the information you submit. Contact that business for questions about its use of your data, correction or deletion requests, cancellation, or its own policies. Reyolk provides the software used to manage those records.

Google and Gmail data

A workspace owner can connect Gmail with Google sign-in or with a Google app password. When a workspace owner connects Gmail with Google sign-in, Reyolk receives the Google account email address and OAuth access and refresh tokens. Reyolk then reads new messages added to that account's inbox so they can appear in the unified inbox. For imported email, Reyolk stores the sender name and address, message text, timestamps, Gmail message identifiers, and attachment names and types. Attachment content is retrieved from Gmail only when needed for an authorised workspace action.

With Google sign-in, Reyolk uses gmail.readonly to detect and display new inbox mail and gmail.send to send replies from the connected account in the correct Gmail thread. Replies follow the business's configured approval rule: they may wait for the owner to approve them or send automatically when the business has set replies to run automatically. Reyolk has no permission to delete email, change Gmail labels, or archive messages. Gmail syncing and import are limited to the Inbox; Spam and Trash are excluded from imported conversations. A newly connected account is anchored at its current mailbox position rather than importing its existing mailbox; if Google's history cursor expires, Reyolk may read a bounded window of recent inbox messages to resume syncing without gaps.

The Google account email address is used to identify the connected mailbox. OAuth tokens are kept in the application database, are restricted to server-side use, and are never shown in the workspace interface or application logs.

When a workspace owner connects Gmail with a Google app password instead, Reyolk receives the Gmail address and the app password. The app password is encrypted with AES-256-GCM before it is stored, and the encryption key is kept on Reyolk's application servers, separate from the database. It is used only on Reyolk's servers, is never shown again after connecting, is never sent back to the browser, and is never written to logs or the activity record. Reyolk connects to Google's mail servers only over encrypted TLS connections with certificate checks. Reyolk reads the mail Gmail shows in the primary inbox and the mail the account sends; Promotions, Social, drafts and chats are left out. When the mailbox is connected, Reyolk imports its latest 100 emails, and older emails 100 at a time only when the owner asks; after that it reads new mail as it arrives. For this email Reyolk stores the names and addresses of the sender and recipients, the subject, message text, timestamps, Gmail message and thread identifiers, threading headers, read state, and attachment names and types, and keeps a copy of an email's formatted version so it can be shown. When an email is read in Reyolk, Reyolk marks it read in Gmail, and an email read in Gmail shows as read in Reyolk; this is the only change Reyolk makes to the mailbox, and it never deletes, moves, archives or relabels mail. Formatted emails are shown as their senders wrote them, in an isolated frame, and pictures in them load from the senders' servers, as in most mail apps, so a sender can tell that an email was opened. Reyolk sends only the replies and messages that follow the business's approval rules; a reply goes to the sender with everyone else on the email copied, and sent replies appear in the Gmail Sent folder. Disconnecting Gmail in Reyolk deletes the stored app password immediately, and deleting the app password in the Google Account stops access immediately. Google recommends its official sign-in where an app supports it, because an app password cannot be limited to particular permissions; Reyolk is applying for Google's official Gmail access. See connecting Gmail with an app password.

How information is used

Reyolk uses workspace and connected-service data to provide sign-in, the unified inbox, replies, search, customer records, scheduling, billing and the workflows requested by the business. Gmail data is used only to provide and maintain these user-facing features, maintain security, prevent abuse and comply with law. It is not sold, used for advertising or used to build advertising profiles, and Reyolk does not use Google APIs or Google user data to create AI-generated non-consensual intimate imagery.

AI processing

When a business enables an AI feature, Reyolk may send the minimum relevant conversation context and business information to its configured AI service provider to classify a request, create a draft or explain workspace information. AI output is checked against structured business data, and customer-facing messages follow the workspace's configured approval rule: they may require owner approval or send automatically when the business has enabled automatic replies. Google Workspace data is not used to train or improve generalised AI or machine-learning models.

Sharing and service providers

Reyolk shares information only with the workspace members authorised by the business; connected providers when needed to perform a requested function; hosting, database and AI service providers that process data for Reyolk; and authorities when required by law or necessary to protect rights, safety or the service. Reyolk does not sell Google user data or disclose it to data brokers, advertisers or for personalised advertising.

Reyolk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Security

Reyolk uses HTTPS for data in transit, server-side access controls, organisation-scoped authorisation and restricted production access. No internet service can guarantee absolute security. Report a suspected privacy or security issue promptly to [email protected].

Retention, disconnection and deletion

Workspace records are retained while needed to provide the service and until the business removes them or asks Reyolk to delete them, subject to limited legal, security and backup-retention obligations. Archiving a conversation does not delete it. Removing a Gmail connection deletes Reyolk's stored connection credentials and stops future syncing; it does not delete messages from Gmail or automatically remove conversations already imported into the workspace.

You can also revoke Reyolk's Google access from your Google Account security settings. To request access, correction, export or deletion of workspace or Google-derived data, email [email protected]. Reyolk will verify the requester's authority and act on valid requests. Customers of a business should normally contact that business first using the details on its website or correspondence.

International processing and changes

Service providers may process information in countries other than yours. Reyolk uses provider contracts and access safeguards appropriate to the service and applicable law. This policy may change when Reyolk's services or legal obligations change; the effective date above will be updated, and material changes will be communicated through an appropriate service notice.

Browser storage

See the cookies and storage policy for sign-in, preferences, carts and local recovery data.