Rinlet privacy policy

Last updated: 31 October 2026

Rinlet is a workspace for small businesses: mail, calendar, tasks, documents and an assistant in one place. This policy says what Rinlet keeps about you, why, who else sees it, and how to have it deleted.

Rinlet is in pre-alpha. It is used by invited businesses only, and nothing is sold through it yet.

Who we are

Rinlet is run from the United Kingdom. For questions about this policy or your data, write to info@rinlet.com.

For your own Rinlet account we decide how your data is used. For what a business keeps in its workspace (its mail, calendar, documents and records), the business decides what goes in and who can see it, and we look after it on the business's behalf.

What we keep

Your account: your name, your email address, and your password, kept only as a one-way hash we cannot read back.
What you put in your workspace: mail, documents, pictures, notes, tasks, chats with the assistant, and copies of the calendars you connect.
Connections you set up: the sign-in details for a mailbox or calendar you connect, such as a mail app password or a Google key. These are encrypted before they are stored.
Technical records: a sign-in cookie that keeps you signed in, and server logs with addresses, times and the pages asked for. We use them to keep Rinlet running and secure.

We do not use advertising, analytics or tracking cookies.

Google user data

When you choose Sign in with Google in a mailbox's settings, Google asks whether Rinlet may see your email address and use your Google calendars. If you agree:

What we receive: your Google email address and account ID; the list of your calendars; and from the calendar you choose, its events: titles, times, places, descriptions and the people invited. We also receive a key that lets Rinlet keep using that calendar without asking you to sign in each time. The key is encrypted before it is stored.
What we do with it: we show the calendar in your Rinlet workspace, keep the copy up to date, and use it to answer you when you ask the assistant about your calendar. Rinlet changes only the one calendar you connect, and only when someone in your workspace adds, moves or removes an event, or approves a change the assistant proposes. It does not touch your other calendars. Google's permission screen asks for full access, because that is the permission Google's calendar connection needs.
Who else sees it: we do not sell Google data, use it for advertising, or use it to train AI models. When you ask the assistant a question, the events it needs are sent to the AI model provider that writes the answer, under terms that do not let the provider use them for training. People at Rinlet do not read your Google data, except with your permission, to keep Rinlet secure, or where the law requires it.
Google's rules: Rinlet's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Stopping it: Sign out of Google in the mailbox's settings deletes the key at once, and Rinlet stops reading and changing your calendar. Changing or disconnecting the calendar deletes our copy of its events. You can also remove Rinlet's access from your Google account at any time at myaccount.google.com/permissions.

Why we use your data

To provide Rinlet to you and to the business you work with: this is the contract between us.
To keep Rinlet secure and working, and to fix problems: these are our legitimate interests.
Where the law requires it.

Who else handles it

AI model providers: they process the parts of a conversation, document or calendar the assistant needs in order to answer you. OpenAI currently runs the assistant's models.
Services you connect: Google, Zoho or your mail provider, when Rinlet reads from or sends through them on your instruction. Their own privacy policies apply to what they hold.
Web pages: when the assistant reads a public web page for you, the page's address goes to the service that fetches it.

Rinlet runs on our own servers in the United Kingdom. OpenAI processes data outside the UK, including in the United States, under the UK Addendum to the EU Standard Contractual Clauses in OpenAI's data processing terms.

How long we keep it

We keep your account and workspace while you use Rinlet. When an account or workspace is closed, we delete its data within 30 days. Copies in backups are deleted within 60 days. Server logs are kept for 15 days.

Your rights

Under UK data protection law you can ask to see the data we hold about you, to correct it, to delete it, to receive a copy to take elsewhere, and to object to or limit how we use it. Write to info@rinlet.com and we will answer within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Rinlet is for businesses and is not meant for anyone under 18.

Changes

When this policy changes we update the date at the top. If a change affects how we use your data, we tell you in Rinlet before it takes effect.