Privacy

Privacy policy

What personal data Rykloud collects, why, the legal basis, who else handles it, how long it is kept and the rights you have.

Version: 1.0
Effective: 5 November 2026
Last updated: 5 November 2026

1.Who we are and our two roles
1.1
Rykloud is provided by Rykon Technologies Inc. ("we", "us"). We handle personal data in two roles, and this policy explains both.
As Controller
For Account Data (the people who sign in to and use Rykloud), visitors to our websites, and people who contact us. This policy is our notice to you for that data.
As Processor
For Customer Data: whatever an organisation runs and stores in its environments. The organisation decides how that data is used and is its Controller; we process it only on its instructions under our data processing addendum.
2.What we collect
Your Rykon account
Your name, email address, password (stored only as a hash by our sign-in service), second factors you add, and sign-in records (time, IP address, browser).
Your organisations
Which organisations you belong to and your role, invitations you sent or received, and your notification choices.
The activity record
What you did in the console and what Rykloud did for you: who, when, from which IP address, what changed and its price, and a reference. It is append only.
Terms acceptances
Which version of these documents you accepted in the console, when, and the IP address and browser it was accepted from.
Billing
Once billing is switched on: the billing contact and organisation, charges and invoices. Card details go to Stripe and never reach us.
Support
What you write to us, and the references you quote, so we can find what happened.
Our websites
Server logs of requests (IP address, page, time, browser). No analytics, advertising or tracking scripts run on rykloud.com or app.rykloud.com.
2.1
We do not collect the contents of your environments for our own purposes. They are Customer Data, which we process as your Processor.

3.Why we use it, and the legal basis

Purpose
Signing you in, running your organisations and environments, and the activity record
Legal basis
Performance of our contract with your organisation
Purpose
Recording acceptance of these terms
Legal basis
Our legitimate interest in proving the agreement, and legal obligations
Purpose
Security: detecting misuse, keeping the service and other customers safe
Legal basis
Legitimate interests
Purpose
Emails about your environments and account, as you choose them in Settings
Legal basis
Performance of the contract
Purpose
Billing, invoices and tax records
Legal basis
Contract and legal obligations
Purpose
Answering support requests
Legal basis
Contract and legitimate interests

Purpose	Legal basis
Signing you in, running your organisations and environments, and the activity record	Performance of our contract with your organisation
Recording acceptance of these terms	Our legitimate interest in proving the agreement, and legal obligations
Security: detecting misuse, keeping the service and other customers safe	Legitimate interests
Emails about your environments and account, as you choose them in Settings	Performance of the contract
Billing, invoices and tax records	Contract and legal obligations
Answering support requests	Contract and legitimate interests

3.1

We do not sell personal data, use it for advertising, or use it to train artificial intelligence models.

4.Who else handles it
4.1
The companies that process data for us are named, with what for and where, on the subprocessors page. We add a new one there, with 30 days’ notice, before it receives personal data.
4.2
Rykloud and the Rykon products (Rykon Mail and Rykon AI) share one Rykon account. To show you the products you use, the console asks each product whether you have an account there; the products do not see your Rykloud environments unless your organisation links them.
4.3
We disclose personal data to authorities only where the law requires it, and tell the organisation concerned unless the law forbids that.
5.International transfers
5.1
Rykloud’s own services run in Germany today, the current region; a new region for them is listed on the subprocessors page before it holds personal data. Some subprocessors are in the United States (email delivery, payments), under Standard Contractual Clauses. An environment, and the data in it, lives in the cloud and region its organisation chooses.

6.How long we keep it

Data
Console session
Kept
12 hours, or until you sign out
Data
Your Rykon account
Kept
Until you ask us to delete it
Data
Organisation membership and invitations
Kept
While the organisation exists; an invitation expires unused
Data
The activity record and terms acceptances
Kept
While the organisation or account exists. They are append only, so they are not edited; the period after closure is not yet set and will be published here before we rely on it
Data
Environments and their saved copies
Kept
Until an owner destroys them, or within 30 days of the organisation closing
Data
Database backups
Kept
Encrypted, on a rolling schedule; the period is not yet published and will be stated here
Data
Billing and tax records
Kept
As long as tax law requires
Data
Support email
Kept
As long as needed to answer, and to keep a record of what was agreed

Data	Kept
Console session	12 hours, or until you sign out
Your Rykon account	Until you ask us to delete it
Organisation membership and invitations	While the organisation exists; an invitation expires unused
The activity record and terms acceptances	While the organisation or account exists. They are append only, so they are not edited; the period after closure is not yet set and will be published here before we rely on it
Environments and their saved copies	Until an owner destroys them, or within 30 days of the organisation closing
Database backups	Encrypted, on a rolling schedule; the period is not yet published and will be stated here
Billing and tax records	As long as tax law requires
Support email	As long as needed to answer, and to keep a record of what was agreed

7.Security
7.1
How we protect the service and your environments is on the trust page: isolation per environment, approval before spend, an append-only activity record, encryption of saved copies before they leave the machine that wrote them, and mutual TLS inside.
8.Your rights
8.1
You may ask for access to, correction, deletion or a copy of your personal data, and object to or ask us to restrict its use. Write to support@rykloud.com from the address on your account. We confirm a request within 10 days and complete it within 45 days, and tell you if the law lets us keep something and why.
8.2
For data in an organisation’s environments, ask that organisation first; we help it answer. You may also complain to the data protection authority where you live.
9.Children
9.1
Rykloud is a business service and is not meant for anyone under 16.
10.Changes
10.1
We will give 30 days’ notice by email and on this page before a material change to this policy.
11.Contact
11.1
Rykon Technologies Inc.. Privacy questions and requests: support@rykloud.com.

Change log

Version 1.0
5 November 2026
First published.

Privacy policy

1.Who we are and our two roles

2.What we collect

3.Why we use it, and the legal basis

4.Who else handles it

5.International transfers

6.How long we keep it

7.Security

8.Your rights

9.Children

10.Changes

11.Contact

Change log