1. Scope
This policy explains how personal information is handled through the Relinta website, web application, browser extension, APIs, agent connections and optional integrations (the Service). References to we, us and our mean the operator providing the Service under the Relinta name.
This notice is not blanket consent to processing and does not replace any required customer data processing agreement. Your contract, workspace role and feature settings determine which features you can use, but do not remove another person's privacy rights.
2. Information we process
The information depends on the features you use:
- Account and billing information: email address, account and workspace identifiers, membership, subscription, purchase and transaction records. Payment processors handle payment details; we receive information needed to administer purchases and subscriptions.
- Workspace and professional information: leads, names, professional identifiers and URLs, profile photos, headlines, employment, locations, company information, lists, notes, imported files, custom fields, campaigns, templates, prompts and settings that you or authorized users supply or obtain through enabled features.
- Communication information: conversations, messages, drafts, comments, reminders and attachments used with the Service, including the associated sender, recipient and activity information.
- Connected-account information: account identifiers, connection status, authorization tokens and related session information. Optional browser, rental or account-access features can also process explicitly supplied logins, passwords and two-factor authentication secrets. These are different from payment-card details handled by payment processors.
- Technical information: browser and device information, connection and usage events, errors, security records and troubleshooting information. AI troubleshooting records may include prompts, relevant context and generated results.
We receive information from you, other authorized workspace users, your connected accounts, enabled service providers and professional sources accessed through the features you use, including LinkedIn. Some information comes from people other than the individual it concerns. Professional information about a lead can be personal information even when publicly visible; private conversations are not public-source information.
Some professional reference information, such as normalized company facts, is maintained in a shared catalog and reused across workspaces rather than collected again for each customer. Customer-specific notes, lists and private conversations are not part of that company catalog. Removing a company from your workspace is not necessarily deletion of its independently maintained catalog record.
3. How we use information
The following describes our purposes and, where European-style lawful-basis requirements apply to processing for which we act as controller, the relevant basis. It does not make us a controller or processor merely by applying a label.
| Purpose | Information involved | Basis or role |
|---|---|---|
| Create accounts, authenticate users and administer access | Account, contact, membership and connection information | Performance of a contract with the individual; otherwise legitimate interests in administering a business customer's access |
| Operate selected campaigns, imports, inbox, AI and integration features | Selected workspace information, communications, instructions and relevant connected-account information | Customer instructions where we act as processor; a separate identified basis is needed for any independent controller use |
| Administer subscriptions, payments and accounting | Account, billing and transaction information | Contract administration or legitimate interests in managing the customer relationship; legal obligations for required financial records |
| Support users, diagnose failures and protect the Service | Support communications, technical records and relevant diagnostic context | Legitimate interests in resolving failures, preventing abuse, protecting users and defending claims; legal obligations where applicable |
| Measure usage and improve usability | Interaction events, device/browser information and session recordings | Consent where required; otherwise legitimate interests in understanding service performance only where that processing is lawful |
Information required for authentication, billing or a selected feature must be provided for that function to work. Optional integrations can be left disconnected. Refusing non-essential tracking does not remove your contractual access to the core Service.
For customer-controlled lead and conversation data, the customer normally determines the outreach purpose and instructions. We determine purposes for our own account administration and security, and must separately assess any independent reference-catalog processing. A customer's agreement to our Terms is not consent from every lead or message sender. Required processor terms, and the customer's own transparency and lawful-basis duties, are not replaced by this notice.
4. Google account connections
Connecting a Google mailbox is optional. When the connector is available, it requests basic Google identity permissions and gmail.modify. That Gmail permission permits reading, composing, sending and modifying mail, but does not itself mean that every permitted operation is performed by Relinta.
The initial connection flow verifies your Google identity, mailbox address and authorization status, and stores the authorization needed to maintain the connection. Connecting alone does not import your inbox or send messages. Before introducing message access, sending or other uses beyond the disclosed connection flow, we will explain the feature and obtain any additional consent required by Google or applicable law.
Google information is used only for disclosed, user-facing features and permitted security or legal purposes. It is not sold to data brokers, used for advertising or credit decisions, or used to train general-purpose AI models. Transfers to service providers must be necessary for the enabled feature, authorized as required, and subject to compatible restrictions. Relinta personnel must not read Google content except with explicit agreement for specified content, for permitted security purposes, or where legally required.
Our use and transfer of information received from Google APIs is limited by the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace developer policy. This includes information derived from Google data; relabeling it as analytics or diagnostics does not remove those restrictions.
Disconnecting removes the saved authorization credential for that Relinta connection and stops its further authorized use. Connection metadata and information already retained for a disclosed purpose require separate deletion handling; disconnecting is not a promise that every related record is immediately erased. It does not revoke separate connections. You can also revoke the application's grant through Google Account connections. Contact us to request deletion of retained Google information; no Relinta account is needed to make a lawful privacy request.
5. Sharing and access
Information may be accessible to:
- Authorized workspace users and administrators, according to the workspace's permissions and the features involved. Workspace notes, conversations and shared access information are not necessarily private to the person who entered them.
- Service providers supporting hosting, databases, file storage, AI processing, analytics, payments, email delivery, support and enabled browser services. Relevant content may be sent to an AI provider when an AI feature is used.
- Destinations you authorize, including Telegram or Slack chats, webhook recipients and connected agents. Notifications can contain full messages and attachments. People with access to the selected destination may receive that content under the destination provider's own terms.
- Account suppliers, when you submit a supplier-related request, including your contact email, the selected profile and relevant request details so the supplier can respond. Direct payment to a supplier does not mean that no request information passes through Relinta.
- Authorities or other parties, where required by law or reasonably necessary to address fraud, security incidents or legal claims.
Access by service personnel is limited to legitimate operational purposes. The stricter Google-data restrictions above apply to Google information. We do not sell private message content or Google mailbox data to data brokers.
A genuine reorganization or transfer of the Service may involve information necessary for that transaction and continued operation, subject to confidentiality, applicable law and any required notice. This is not permission to disregard Google restrictions or transfer information for incompatible purposes.
6. Cookies and product analytics
We use cookies and browser storage for authentication, security, preferences and usage measurement. Product analytics uses PostHog and can include interaction events and session replay showing screens, ordinary displayed text and ordinary inputs. Designated credential and secret fields are excluded from capture. This does not mean that all personal information or message content is masked: recordings and diagnostic records can include ordinary workspace content.
Browser controls can restrict cookies or storage, although some features may stop working. You can contact us about tracking choices. Any requirements for prior consent, refusal or withdrawal of consent for non-essential tracking apply independently of this policy; browser controls do not replace those requirements.
7. Retention and deletion
Retention is different for each category:
- Workspace content: remains available for the workspace until deleted through the relevant feature or workspace-deletion process, subject to applicable rights and necessary legal retention. Self-service workspace deletion has a seven-day recovery period before scheduled permanent cleanup; required account and billing checks can affect that workflow. This product workflow is not the only way to exercise a statutory erasure right.
- AI troubleshooting: full sanitized request/response payloads are normally eligible for automated removal after 30 days. Smaller input/output previews and accounting or operational metadata can remain after full payloads are removed. Thirty days is not a promise that every AI-related record has been erased; final workspace cleanup also removes its AI invocation records.
- Other operational records: replay cursors, idempotency records, diagnostic records and task history have purpose-specific automated expiry rules. They do not all share one retention period.
- Connection credentials: remain while needed for an enabled connection and are removed or disabled through its disconnection/deletion process. Limited identity and disconnection-status records may remain for connection management and security.
- Billing, legal and security records: can remain after cancellation for applicable recordkeeping, disputes, fraud prevention and legal claims. A legal hold must be limited to relevant information and the applicable purpose.
Deleting information from active systems does not necessarily remove it immediately from rotating backups. Backup expiry follows the backup rotation and successful cleanup, not the seven-day workspace recovery period. Restoration must preserve applicable deletion restrictions. Copies already delivered to recipients or independently maintained professional-source records require their own assessment; they are not automatically deleted by removing a workspace record. These qualifications do not remove applicable access, objection or erasure rights.
Deleting a Relinta workspace does not delete your underlying LinkedIn or Google account. Disconnecting an integration and requesting deletion of retained information are separate actions.
8. Security and international processing
We use technical and organizational measures intended to protect information, including access controls and protection of stored connection secrets. No service can guarantee absolute security.
We and our providers may process information in countries other than yours. Where applicable law requires transfer safeguards, a valid mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, must be in place before the transfer. You can request information about relevant safeguards and how to obtain a copy, subject to lawful confidentiality restrictions.
9. Your choices and rights
You can manage available workspace settings, disconnect accounts and integrations, and request access, correction, export or deletion. Depending on applicable law and the processing involved, you may also have rights to portability, restriction, withdrawal of consent, objection and appeal of a denied request. Withdrawal does not retroactively make earlier consent-based processing unlawful.
Direct marketing: where applicable law gives you a right to object to direct-marketing processing, you can exercise it at any time. A marketing objection must be respected for that purpose; necessary account, security or billing notices are different from marketing.
You do not need to create an account, buy a plan or first obtain a customer's permission to contact us about your own information. We may verify identity proportionately, avoid disclosing another person's information and coordinate with the responsible customer when acting as its processor. Requests must be handled within applicable statutory time limits, with reasons for any lawful refusal or extension. You may complain directly to the competent data protection authority, including where applicable the authority in your place of residence, work or the alleged infringement; contacting us first is not mandatory.
The Service is intended for adult professional users, not children. Contact us if you believe a child has provided personal information through it.
10. Changes and contact
We may update this policy as the Service or applicable requirements change. Material changes will be communicated as required, and any required consent will be obtained before information is used for a new purpose. A privacy-policy update does not by itself authorize an incompatible use of information.
Privacy questions and requests: support@relinta.com.