Privacy Policy

This Privacy Policy explains how Firelink Labs Inc., an Indiana corporation doing business as Relladex (“Relladex,” “we,” “us”), collects, uses, and shares information when you use our websites, applications, and related services (the “Service”).

1. The short version

• We never sell your data. Not now, not ever.
• We collect what we need to run the Service: your account info, your contacts and notes, basic usage data, and (when you choose) data you import from your own accounts and address books elsewhere.
• AI features are processed by third-party providers on our behalf, and every request is gated against storage and training before it is sent.
• If you connect a Google or Microsoft account, we use that access only for the features you connected it for. We never sell that data, use it for advertising, or use it to train AI models. Section 6 has the details, including how we meet Google’s Limited Use requirements.
• You can ask us to access, export, correct, or delete your data at any time by emailing admin@relladex.com.

2. Who we are

The data controller is Firelink Labs Inc., 8437 Bell Oaks Dr, Suite -528, Newburgh, IN 47630, USA. For privacy questions, email admin@relladex.com.

3. What we collect

Waitlist signups

• The email address you submit and the time you submitted it.
• Basic referral context (e.g. UTM parameters or referring page) when present, so we know how people are finding us.

Account information (at launch)

• Name, email address, hashed password (we never store passwords in plain text), and profile preferences.

Your content

• Information you add about your contacts: names, phone numbers, email addresses, organizations, relationship metadata, notes, files, and attachments you choose to upload.

Imported data

• Contacts and related metadata you choose to import from your own accounts and address books on other services, after you grant authorization. We import only what’s needed for the import you requested.

Profile enrichment

• When you add a person or a company, you can ask Relladex to fill in details about them from third-party data providers — job title, employer, work history, company information, and in some cases a work email address. We request this only for people and companies already in your account.
• What comes back is offered to you as a suggestion you accept or ignore, never applied silently over something you wrote.
• Enrichment results are held in a store shared across Relladex accounts, so that something already found once does not have to be found again. That store holds work information: companies, roles, work histories, and business email addresses at those companies. If a colleague of one of your contacts is enriched by another Relladex user, the business address we found for them may be served to that user too.
• Your notes are never placed in that store, and neither is the fact that a given person is in your network. Nobody can see who you know, or what you wrote about them.

Connected mailboxes

• If you connect a Google or Microsoft mailbox, we learn which account it is: its email address, the provider’s identifier for it and, where supplied, its display name. Connecting a mailbox does not let us read, download, or store the contents of your inbox, your address book, or your calendar, and it does not let us send email. Any feature that needs more than this asks you for that permission separately, when you turn the feature on. The Gmail add-on is separate and reads only the message you have open; section 6 covers both.
• You can disconnect a mailbox at any time from the Import page, under Connected accounts. Disconnecting deletes the stored credentials, and for Google we also tell the provider to cancel the authorisation itself, unless another Relladex member has the same Google mailbox connected, in which case we leave it in place for them. Microsoft offers us no equivalent, so for an Outlook mailbox you can additionally remove Relladex from your Microsoft account's app permissions.

Payment information

• Payments are processed by Stripe. We do not store your full card number. We receive limited metadata such as the last four digits, card brand, billing country, and Stripe customer/charge IDs.

Usage and device data

• IP address, device and browser type, operating system, pages visited and actions taken in the Service, and timestamps.

Cookies and similar technologies

• Strictly necessary cookies only, for sessions and security. We do not use third-party advertising cookies or cross-site tracking.

4. How we use your data

We use your information to:

• Provide, operate, maintain, and improve the Service.
• Authenticate you and keep your account secure.
• Communicate with you about the Service, including transactional messages (account, billing, security) and waitlist updates.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms.

Data that reaches us through a Google or Microsoft connection is held to narrower limits, set out in section 6.

5. AI processing

When you use an AI feature, we send the relevant content — the note, contact, or company you asked the assistant to work with — to a third-party AI provider, which returns a result to us. We relay that result to you. Which providers we use is covered by the subprocessor list in section 8.

One AI feature does not work this way, and you should know which. If you record a voice note in a web browser, the words are transcribed by the speech service built into that browser, not by us and not by any provider of ours. That audio goes from your browser to your browser vendor under their privacy policy, not ours. The resulting text is then handled exactly like any note you typed.

Every AI request we send is gated against storage and training. The gate is not a setting or a promise from us — it travels with the request itself, so a provider whose terms would let it keep or learn from your content is never offered the request in the first place. If no provider can serve it on those terms, the request fails rather than going somewhere that keeps it.

That applies to every AI feature and every path in the product, not only the assistant. We do not sell or share Your Content with anyone for advertising or model training.

We do not control, and so do not promise, the country a given request is processed in; that depends on which provider is available to serve it under the terms above.

6. Google & Microsoft account data

You can connect a Google or Microsoft account to Relladex, and you can add the Relladex add-on to Gmail. Each is optional, and each asks for its permissions on Google’s or Microsoft’s own consent screen. This section sets out what each one can reach, what we do with it, and how it is removed. It covers everything we receive through these connections, and anything we derive from it.

What each connection can access, and why

• Mailbox connection (Google or Microsoft). We receive the email address of the account you connect, the provider’s identifier for it and, where the provider supplies one, its display name, so we know which mailbox is yours (Google: openid, email; Microsoft: openid, email, User.Read). For Microsoft we also ask for offline_access, which keeps the connection working without asking you to sign in again. That is all a mailbox connection asks for: none of these lets us read your messages, your address book, or your calendar, or send email as you.
• Bring in Contacts (Google or Microsoft). Only when you press Bring in Contacts for a connected mailbox do we ask that account for permission to read its saved contacts and the people it has emailed (Google: contacts.readonly, and contacts.other.readonly for what Google calls “Other contacts”; Microsoft: Contacts.Read, and People.Read for the people Microsoft ranks as relevant to you). Each time you press it, and only then, we read from that one account the names, email addresses, phone numbers, companies and job titles there. We do not read your messages, and we do not email anyone.
• To leave out entries that are not people, such as newsletters, no-reply senders and shared inboxes, we send their names, email addresses, companies and job titles, never phone numbers or anything from a message, to a third-party AI service. None of this data is used to train AI models. Nothing is added to your Relladex until you have looked through the names and chosen to import them.
• Gmail add-on. If you install it, the add-on asks to run inside Gmail, to read the message you have open, and to see your email address (gmail.addons.execute, gmail.addons.current.message.readonly, userinfo.email). When you open a message, it reads that message’s sender and text so it can tell you whether the sender is already in your Relladex, and point out contact details in their signature that you do not have yet. It uses your email address only to find the Relladex account that has connected the same mailbox, and shows nothing from your contacts unless that connection exists. It cannot list, search, or open any other message, and it does not send the message to any AI provider.

How we use it

We use data from these connections only to provide the features described above. The same limits apply to Google and Microsoft data alike:

• We never sell it, and we never transfer it to advertising platforms, data brokers, or information resellers.
• We never use it for advertising of any kind, including retargeting and personalized or interest-based ads, and we never use it to judge anyone’s creditworthiness or for lending.
• We never use it to develop, improve, or train AI or machine-learning models, generalized or personalized, ours or anyone else’s. That includes all data obtained through Google Workspace APIs. When you use an AI feature on something that arrived through a connection, the request is gated exactly as section 5 describes: a provider whose terms would let it keep or learn from your content is never offered it.
• We share it only where we must: with the service providers that run Relladex for us (section 8), and only as far as a feature you are using needs; for security, such as investigating abuse; to comply with the law; or as part of a merger, acquisition, or sale of assets, and then only with your explicit consent first.

Who can read it

No one at Relladex, or working on our behalf, reads data from these connections, with three exceptions: when you ask us to and agree that we may look at specific data, for example to help with a support request; when it is necessary for security, such as investigating a bug or abuse; or when the law requires it.

How it is stored, kept, and deleted

• The access and refresh tokens Google or Microsoft issue for a mailbox connection are stored on our servers, in a table that only our server code can read. The Relladex app cannot read them, even when you are signed in as yourself. They are protected by the safeguards in section 10.
• The Gmail add-on stores no credentials and keeps no copy of the messages it reads. Google hands it a short-lived permission for the one message you have open, each time you open one. Nothing from a message is saved to your Relladex unless you choose to add it there.
• We keep a record of each mailbox you connect: its address and account identifier, the permissions you granted, and when you connected it.
• Unfinished connections. If you start connecting a mailbox, or start Bring in Contacts, but do not finish, the authorization Google or Microsoft issued is held for at most about 20 minutes. After that we delete it and, for Google, ask Google to revoke it. The exception is a Google account that is already connected to Relladex: Google keeps one authorization per account for each app, so revoking it would disconnect that mailbox too, and we only delete our copy.
• Bring in Contacts does not save the names, addresses or numbers it reads; they reach your Relladex only if you choose to import them. For entries the AI check left out, we keep the provider’s identifier for each entry and a short reason from a fixed list, such as “newsletter”, so later Bring in Contacts runs skip them. We delete these when you disconnect the account, or close your Relladex account.
• Disconnecting. You can disconnect a mailbox at any time from the Import page, under Connected accounts. That deletes the stored tokens and, for Google, asks Google to revoke the authorization itself. Microsoft gives apps no way to do that, so for an Outlook mailbox you can also remove Relladex from your Microsoft account’s app permissions. The exception is a Google mailbox that another Relladex member also has connected: Google keeps one authorization per account for each app, so revoking it would disconnect them too, and we leave it in place for them. We delete our copy of your tokens either way. We keep the record of the mailbox, marked as disconnected.
• You can remove the Gmail add-on at any time from Gmail, or from the third-party access settings of your Google Account.
• Closing your account disconnects every mailbox on it, usually within minutes, exactly as above: the stored tokens are deleted and, for Google, we ask Google to revoke the authorization, unless another Relladex member has the same Google mailbox connected, in which case we leave it in place for them. Restoring a closed account (section 9) does not reconnect a mailbox; connect it again if you want it back.

Google API Services User Data Policy

Relladex’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes, such as Gmail and Google Calendar, will also adhere to the Google Workspace User Data and Developer Policy.

7. We never sell your data

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising, in each case as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar laws.

8. Sharing & subprocessors

We share data only with the service providers we need to run Relladex: database and file storage, application hosting, AI processing, payment processing, referral payouts, profile enrichment, web search and news, market data, maps and geocoding, and transactional email delivery. Each subprocessor is bound by confidentiality and data-protection obligations and may use the data only to provide services to us.

When you open the Map, the map provider receives your IP address and the area of the map you are viewing, so it can send map images. Your contacts' city names are matched to map positions on your device and are not sent to anyone. If a contact has a saved street address, that address is sent once to a geocoding service (for U.S. addresses, the U.S. Census Bureau's public geocoder) to find its map position. We save that position with the contact and look it up again only if the address changes.

We may also disclose information when we believe in good faith it is required by law, legal process, or to protect the rights, safety, or property of Relladex, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this Privacy Policy.

A current list of subprocessors is available on request — email admin@relladex.com.

9. How long we keep data

We keep your account data and Your Content for as long as your account is active. Closing your account from the app deactivates it and signs you out, and we keep your data so that you can restore the account by signing back in — closing it is not by itself a request to erase it.

When you ask us to erase your data, email admin@relladex.com — we delete or irreversibly anonymize it within 30 days, with backups purged on our normal rotation thereafter. We may retain limited information longer when needed to comply with legal obligations, resolve disputes, or enforce our agreements.

10. Security

We use industry-standard safeguards to protect your data, including encryption in transit, encryption at rest where applicable, access controls, least-privilege practices, and audit logging. No service can be 100% secure, and we cannot guarantee the absolute security of your data. If you believe your account has been compromised, contact us immediately at admin@relladex.com.

11. International transfers

Relladex is based in the United States, and we process data in the United States. If you access the Service from outside the U.S., you understand that your data will be transferred to and processed in the U.S., which may have different data protection rules than your home country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for transfers from the European Economic Area, the United Kingdom, and Switzerland.

12. Children

The Service is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact admin@relladex.com and we will delete it.

13. Your rights (EU/UK — GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and equivalent laws.

Legal bases. We process your data on these bases:

• Performance of a contract — to provide the Service you've requested.
• Legitimate interests — to secure the Service, improve it, prevent abuse, and run our business, where those interests are not overridden by your rights.
• Consent — for things you opt into, such as marketing emails. You may withdraw consent at any time.
• Legal obligation — when we must process data to comply with the law.

Your rights. Subject to applicable law, you can request access, correction, deletion, restriction, or portability of your data; object to certain processing; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email admin@relladex.com. We do not currently have an EU representative; if our processing reaches a scale that requires one, we will appoint one and update this policy.

14. Your rights (California — CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you certain rights.

Categories of personal information we collect (mapped to CCPA categories): identifiers (name, email, account ID, IP); customer records (account info); commercial information (subscription and transaction metadata); internet/network activity (usage and device data); geolocation (approximate, derived from IP); and inferences drawn from the above to operate the Service. When you upload contacts or notes, we also process the personal information of your contacts on your behalf.

Purposes. We collect this information for the purposes described in “How we use your data” above.

No sale or sharing. We do not sell or share personal information for cross-context behavioral advertising.

Your rights. You may request to know, access, delete, or correct your personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising your rights.

How to submit a request. Email admin@relladex.com from the address associated with your account. We will verify your identity by confirming you control that address and, when needed, by asking you to confirm details we already have on file.

Authorized agents. You may use an authorized agent to submit a request on your behalf. The agent must provide written proof of authorization, and we may still ask you to verify your identity directly.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will give reasonable notice (for example, by email or in the Service) and update the “Last updated” date at the top. Continued use of the Service after the changes take effect means you accept the updated policy.

16. Contact us

For privacy questions or to exercise any of your rights:

Firelink Labs Inc. (DBA Relladex)
8437 Bell Oaks Dr
Suite -528
Newburgh, IN 47630
admin@relladex.com