RelyKit
Privacy
What this service holds about you, how long it holds it, and who else can see it. Written from the database schema, not from a template.
Who is who
There are two relationships here and they have different rules.
You, our customer. We are the controller of the small amount of data we hold about you directly: the email address you sign in with, and what you told us on your application to send.
The people you send to. We are a processor. You decide who receives your mail and what it says; we carry it and record what happened. We do not market to your recipients, sell anything to them, or use their addresses for anything other than delivering the message you asked us to deliver. The data processing agreement is the formal version of that sentence.
What we hold
Everything, listed. If it is not here, we do not have it.
| About you | Why |
|---|---|
| Email address | It is how you sign in. There is no password. |
| A recovery email address, if you give us one | So losing access to the address above does not end your account. It is optional, you can remove it at any time, and we send it nothing but a recovery link when somebody asks for one. |
| Account name and status | To show you the right account. |
| Your application to send | Organisation, website, what you intend to send and where the addresses come from, expected volume, and an optional contact name and phone. A human reads it before any account may send, which is what keeps this service off blocklists. |
| The IP address each sign-in link was requested from | So an account takeover can be investigated. |
| Your browser's user-agent string, per session | So you can recognise your own sessions. |
| About the mail you send | Why |
|---|---|
| Sender, recipients, subject, your tags, timestamps, status | This is the delivery record. It is what the dashboard shows you. |
| Every delivery event, with the receiving server's own reply | So you can see why something bounced rather than only that it did. |
| Suppressed addresses | So we never send again to an address that bounced or complained. |
We do not hold your name unless you gave it, a postal address, or any payment card details. There are no passwords in the system at all.
Message content
The body of a message, its headers and its attachments are stored so the dashboard can show you what you sent and so a support question has an answer. They belong to the correspondence between you and your recipient, not to us.
They are deleted after 30 days. Not marked for deletion — removed, by a job that runs every hour. The delivery record stays, because that is the thing you rely on; the words do not.
We do not read message content. One automated check looks for the patterns common to phishing and holds a matching message for a person to look at before it is sent, which is the only circumstance in which a human at RelyKit sees the body of a message. That check exists because a service that lets anybody send anything is a service that gets its sending domains blocked for everybody.
How long
| What | Kept |
|---|---|
| Message bodies, headers, attachments | 30 days |
| Delivery records and events | While the account exists |
| Your account and application | While the account exists |
| Sign-in links | 15 minutes, then unusable; the row is kept as an audit trail |
| Sessions | 30 days, or until you sign out |
Delete your account and all of it goes with it, in one operation. See your rights.
Who else touches it
Two companies, both named, both necessary to deliver mail at all.
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Sending the mail (SES) and carrying delivery events back (SNS, SQS) | us-east-1 |
| DigitalOcean | The servers and the database this runs on | New York |
That is the whole list. No analytics service, no advertising network, no session recorder, no chat widget. The website sets one cookie, for your session, and one preference for light or dark. There is nothing to consent to because there is nothing tracking you, which is why you have not seen a banner.
Your rights
Ask and you get, without a form and without a fortnight. These are not aspirations; they are commands the software has.
- A copy of everything we hold about your account — the account, the people on it, your application, domains, keys, suppression list, webhooks, flows and the events your application posted. Message contents are excluded on purpose: they are your recipients' correspondence rather than yours, and handing them over because somebody asked for "my data" would be a leak.
- Correction of anything wrong. Most of it you can edit yourself.
- Deletion. The account and everything belonging to it, including message content and delivery records. Irreversible, and we will say so before doing it.
- To object or complain, to us first and to your data protection authority if we do not resolve it.
Write to privacy@relykit.com. We aim to answer within a few days and will not exceed thirty.
How it is protected
- Everything in transit is encrypted. The API refuses plain HTTP, and the SMTP relay refuses to authenticate without TLS, so a key cannot be sent in the clear by misconfiguration.
- API keys, session tokens, sign-in links and recovery codes are stored only as hashes. A copy of the database hands nobody a working credential.
- Sign-in is a single-use link that expires in fifteen minutes. An optional second factor can be turned on, and is required of administrators where the operator has configured it.
- The database is reachable only from the application server, not from the internet.
- Every administrative action is recorded with who did it and what changed.
If you have found a problem, write to security@relykit.com. We would rather hear it from you than from somebody else.