Privacy policy

Rykon Mail is provided by Rykon Technologies Inc. ("we", "us"). We handle personal data in two different roles, and this policy explains both.

Where we rely on legitimate interests, we have weighed them against your rights; you may object at any time (section 10).

You can create a Rykon Mail account, or sign in to one, with your Google account instead of a password. It is your choice, and an account made with a password can always be used without Google.

When you choose it, Google asks for your permission and then tells our identity service at id.rykonmail.com your Google account ID, your email address, whether Google has verified that address, and your name. We ask Google for nothing more: only the basic “email” and “profile” permissions. We cannot read your Gmail, contacts, files or calendar, and we never post or act on your Google account. Google never sends us your Google password.

We keep your Google account ID with your Rykon Mail account so we recognise you the next time you sign in, and your name and email become your account’s name and email, which you can change. Google also gives our identity service a sign-in token that expires after about an hour; it is kept only with that link to your account and is not used for anything else. We use what Google shares only to sign you in and run your account, never for advertising, and we do not sell it or share it with anyone.

An address Google has verified counts as confirmed, so an account made with Google needs no confirmation email. If you already have a Rykon Mail account with the same address, it is joined to your Google account only when you have confirmed that address with us; otherwise sign in with your password first and connect Google from your account settings.

You can stop using Google at any time: set a password with “Forgot username or password?” on the sign-in page, and remove Rykon Mail from your Google Account under Security, third-party connections. The link is deleted with your account.

Rykon Mail’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

As Processor, and only to provide the service, we process:

When a customer moves mail in from another provider, the old mailbox’s password goes to our mail server for the duration of the move and is deleted when the move finishes or is stopped. It is never stored in our own records.

Writing help, the campaign studio and drafted agent replies use AI models through a gateway we run ourselves. The models are provided by Anthropic, with OpenAI used only if Anthropic is unavailable. A request carries only what the feature needs: the brief, the draft or block being written, and the account name. Contact lists and audience data are never sent. A drafted agent reply carries the incoming message it answers (sender, subject and up to 8,000 characters of text), and is the one AI feature that sends a third party’s message.

The instructions the model follows are set on our servers and cannot be changed by a request. We do not use Customer Data to train AI models, and AI features run only when a customer uses them.

We use the service providers listed on our subprocessors page to host and deliver Rykon Mail, each under a written agreement that limits them to providing their service. We may also disclose personal data where the law requires it, to protect the rights and safety of our customers, users or the public, or as part of a merger or sale of our business, in which case this policy continues to apply.

We do not sell personal data and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We have not done so in the past twelve months.

Rykon Mail’s servers, databases and mail storage are in Germany. Some providers process data in the United States: Amazon SES sends outbound mail from the United States, and Stripe, Anthropic and OpenAI are in the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data) in the provider’s data processing terms, or on the provider’s certification under the EU-US Data Privacy Framework where it holds one. You may ask us for a copy of the relevant safeguards.

We protect personal data with technical and organisational measures appropriate to the risk, described on our security page: encryption in transit, sealed credentials, hashed API keys, a private network for the control plane, per-customer sending identities, an append-only audit log and encrypted offsite backups. No system is perfectly secure; we tell you of a breach as section 12 describes.

Depending on where you live, you have the right to access the personal data we hold about you; to correct it; to have it deleted; to restrict or object to its processing, including processing based on legitimate interests; to receive it in a portable format; and to withdraw consent where we rely on it. California residents have the rights to know, delete, correct and opt out of sale or sharing (we do neither), and not to be discriminated against for using them.

To exercise a right, write to privacy@rykonmail.com with "Privacy request" in the subject, or use the export and closure tools in the console. We acknowledge a request within 10 days and answer within one month (45 days for California requests), which we may extend where the law allows and will tell you if we do. We may ask you to confirm your identity first. An authorised agent may act for you with your signed permission.

If your data is in a customer’s mailbox or list, that customer is the Controller: contact them first. See your privacy rights for how, and what we do to help.

You also have the right to complain to a data protection authority, in particular in the EU member state where you live or work, or to the UK Information Commissioner’s Office. We would welcome the chance to address your concern first.

Rykon Mail is a service for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

If a breach affects personal data we control, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and the people affected where the breach is likely to result in a high risk to them. For Customer Data, we notify the customer as the data processing addendum sets out.

Our websites and consoles use only strictly necessary cookies and preference storage in your browser. There are no analytics, advertising or third-party tracking cookies or scripts. The cookie policy lists every one.

Privacy questions and requests: privacy@rykonmail.com, subject "Privacy request". We will tell you by email, and on this page, before a material change to this policy takes effect.