Privacy policy

This privacy policy explains how Delynt AI ("Delynt AI", "we", "us") handles personal data when you visit delynt.com, contact us, or use our services. Delynt AI is operated by Owais Ahmad Khan and is established in Italy.

For the personal data described in section 2 (website visitors, people who contact us, and the people who manage customer accounts), Delynt AI is the data controller. You can reach us about anything in this policy at [email protected].

For the personal data contained in the mailboxes, CRMs and other systems a customer connects to Delynt AI, the customer is the controller and Delynt AI acts as a processor on the customer's behalf. Section 3 explains what that means.

We collect only what we need for the purposes described below.

• When you contact us through the website form: your name, email address, company name (if you give it), and the content of your message.
• When you email us directly: your email address, name, and whatever you choose to include in the message.
• When you or your organisation become a customer: the name, business email address and role of the people who manage the account, billing details, and our correspondence with you.
• When you visit the website: our hosting servers record standard technical log data (IP address, browser type, requested page, date and time) for security and to keep the site running. The website does not use analytics, advertising or tracking cookies.

When a customer connects a mailbox, CRM or analytics account, Delynt AI processes the data in it only to provide the service the customer has set up, and only on the customer's instructions. That data can include the names, email addresses and message content of people who write to or are written to from the connected mailbox.

We use connected data to:

• screen incoming email with rules, then score what remains for trust and spam, with a written reason
• draft replies, and send them where the customer's approval rules allow
• create and update records in the customer's CRM where the customer has enabled it
• route notifications to the people the customer chooses, through the channels the customer chooses
• produce the analytics and reports shown in the customer's dashboards

We do not use connected data for advertising, we do not sell it, and we never pool it with other customers' data. It is not used to train AI models for anyone other than the customer it belongs to. Requests from people whose data sits in a customer's mailbox are passed to that customer, who decides how to respond, and we help them do so.

Customers who need a data processing agreement can request one at [email protected].

Mailboxes connect through the provider's own consent screen. We never see or store your mailbox password. The permissions requested, and why:

• Read email messages and their metadata (sender, recipients, subject, date): to detect and score enquiries as they arrive.
• Send email as the connected account: to send replies the customer has approved, or that fall within the customer's approval rules.
• Your basic account profile (name and email address): to identify which mailbox is connected and to show it in your account.
• Ongoing access while you are not signed in (an offline or refresh token): so incoming mail can be processed as it arrives, not only when you have the app open.

We request only the permissions a feature you have enabled actually needs. We do not access Google Drive, Calendar or Contacts, or Microsoft OneDrive, Calendar or Contacts, unless a feature you switch on requires it and you grant it on the provider's consent screen.

You can withdraw access at any time from your Google Account (Security, Third-party apps with account access) or your Microsoft account or Microsoft 365 admin centre, without contacting us. Processing of that mailbox stops when access is withdrawn.

Delynt AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data obtained through Google APIs:

• is used only to provide and improve the user-facing features the customer has enabled in Delynt AI
• is not transferred to anyone else except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to users
• is never used to serve advertising, including retargeting or personalised advertising
• is never sold, and is not used to determine creditworthiness or for lending purposes
• is not used to develop, improve or train generalised AI or machine-learning models
• is not read by a person unless the customer has given us affirmative permission for specific messages, it is necessary for security purposes such as investigating abuse, it is needed to comply with the law, or the data has been aggregated and anonymised for internal operations

We apply the same rules to data obtained through Microsoft Graph for Outlook and Microsoft 365 connections.

• To answer enquiries and arrange calls: our legitimate interest in responding to people who contact us (GDPR Article 6(1)(f)), or steps you ask us to take before entering into a contract (Article 6(1)(b)).
• To provide the service to customers and manage their accounts: performance of our contract with the customer (Article 6(1)(b)).
• To keep the website and service secure, prevent abuse and fix faults: our legitimate interest in protecting our systems and our customers (Article 6(1)(f)).
• To invoice, keep accounting records and meet tax and other legal duties: compliance with a legal obligation (Article 6(1)(c)).
• To send you product or company news: only with your consent (Article 6(1)(a)), which you can withdraw at any time using the link in the message or by emailing us.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see section 11).

Every operation in the Delynt AI system is scoped to a single customer account before it can read or act on data. Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production systems is limited to the people who need it to run the service. More detail is on our security page at delynt.com/security/.

If a personal data breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority and, where required, the people affected, within the time limits set by the GDPR. Where we act as a processor, we will notify the affected customer without undue delay.

• Enquiries through the website or by email: up to 24 months after our last contact, unless they lead to a customer relationship.
• Customer account and contract records: for the life of the contract, then for as long as Italian tax and accounting law requires (generally ten years for accounting records).
• Data from connected mailboxes and systems: for as long as the connection is active and the customer uses the service. It is deleted within 30 days of the customer disconnecting the system or ending the contract, and removed from backups within a further 30 days.
• Server and security logs: up to 12 months.

A customer can ask us to delete connected data sooner at any time.

We share personal data only with service providers that help us run the website and the service, under contracts that require them to protect it and use it only on our instructions:

• cloud hosting and infrastructure providers, which store and process the service's data
• AI model providers, which process the text of messages to produce scores, reasons and drafts, under terms that prohibit them from using it to train their models
• Web3Forms, which delivers messages sent through our contact form, and hCaptcha, which protects that form from automated spam
• messaging providers such as Telegram, only where a customer chooses to receive notifications through them

A current list of the providers that process customer data is available on request at [email protected]. We also share data where the law requires it, or to protect our rights, and with a buyer or successor if the business is sold, under the same protections.

Google and Microsoft are not our sub-processors: they provide the mailbox you connect, under your own agreement with them.

Some of our service providers may process data outside the European Economic Area. Where they do, we rely on a European Commission adequacy decision for that country or on the European Commission's Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can ask us for details of the safeguard that applies.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it
• have inaccurate data corrected
• have your data erased
• restrict how we use it
• receive your data in a portable format
• object to processing based on our legitimate interests
• withdraw consent at any time, where we rely on consent, without affecting what was done before

To use any of these rights, email [email protected]. We will reply within one month. If your data sits in a mailbox or system a customer has connected to Delynt AI, we will pass your request to that customer, who controls that data.

You also have the right to complain to a supervisory authority. In Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it). You can also complain to the authority in the EU country where you live or work.

Delynt AI is a service for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

We will update this policy when our practices change. The effective date at the top shows when it last changed. If a change materially affects how we use customer data, we will tell customers by email before it takes effect.

Questions about this policy or about your personal data: [email protected].