Privacy Policy
Privacy Policy
Effective date: July 26, 2026
Kim Hyun-min (the “Operator”), the personal information controller of RelayDesk (the “Service”), complies with applicable laws, including the Personal Information Protection Act, and establishes and publishes this Privacy Policy to protect users’ personal information.
1. Purposes of Processing Personal Information
The Service processes personal information only to the extent necessary for the following purposes.
- Account registration, email verification, sign-in, password reset, and account management
- Connecting the Gmail or Microsoft Outlook account selected by the user and managing its connection status
- Automatically collecting email, checking duplicates, classifying and summarizing messages, and analyzing urgency and whether a reply is needed
- Providing original-email viewing, supported mailbox shortcuts, important-email marking, and custom keyword features
- Detecting service errors, responding to incidents, maintaining security, and preventing abuse
- Receiving and handling user inquiries and issue reports
- Account deletion, email disconnection, and deletion of user data
The Service does not use processed personal information for personalized advertising and does not sell it.
2. Categories of Personal Information Processed
A. Account registration and authentication
- Email address
- User identifier generated by Supabase Auth
- Records related to registration, sign-in, email verification, and password resets
- Information required for authentication and session maintenance
Password authentication information is processed through Supabase Auth. The Operator does not directly view or store users’ original passwords.
B. Email account connection
- Connected email address
- Email service provider information
- Nylas grant ID and connection identifiers
- Connection status, creation time, and latest synchronization time
- Connection error details, error time, and consecutive error count
- Email message and thread identifiers
C. Automatic email organization
- Sender name and email address
- Receiving account
- Email subject, preview, body HTML, and text
- Received time and processing time
- Information related to links and attachments contained in email
- Automatically generated summary, classification, status, urgency, whether a reply is needed, and the reason
- Detected deadlines, money-related status, and security-risk status
- Whether the user marked the email as important and matched keywords
Because email content is created by senders or other third parties, message bodies or attachment information may contain personal or sensitive information. The Service automatically processes such content only as necessary to provide email organization features.
D. Personalization and inquiries
- Work type or onboarding settings
- Custom keywords selected or entered by the user
- Notification settings such as the morning briefing (delivery time and on/off) and the time zone detected by the browser to calculate delivery times
- Inquiry type, inquiry details, submission status, and the page where the inquiry originated
E. Information that may be generated automatically while using the Service
- IP address
- Browser and device information
- Access date and time
- Service usage records
- Error and security logs
- Cookies or similar technologies used to maintain login sessions
The Service currently does not collect online behavioral information for personalized advertising.
3. Legal Basis for Processing Personal Information
The service processes personal information needed to provide the sign-up, email connection, email organization, and account management features requested by users.
Email connection and analysis take place only when the user starts the connection process and grants permission. Users can pause, resume, or permanently delete an email connection.
If the Service separately processes personal information that is not essential to providing the Service, users will be informed and consent will be obtained when required by applicable law.
4. Retention and Use Period
As a general rule, the Service deletes personal information without undue delay when an account is deleted or the processing purpose has been achieved.
| Category | Retention period |
|---|---|
| Account and authentication information | Until account deletion |
| Email connection information | Until the user permanently deletes the connection or deletes the account |
| Collected email, original content, and automated analysis results | Until the user clears the dashboard, permanently deletes the email connection, or deletes their account |
| Custom keywords and onboarding settings | Until account deletion |
| User inquiries and issue reports | Until account deletion |
| Nylas OAuth state | Records older than 24 hours are regularly deleted and are also deleted when the account is deleted |
| n8n workflow execution data | During beta testing, some workflows may store execution data, including email content, addresses, and analysis results. These records are deleted according to the server’s execution-history pruning settings or manual deletion by the operator. |
| RelayDesk operational error logs | 30 days from creation |
| Vercel Runtime Logs | Up to 1 hour under the currently used Hobby plan |
| Other access and security logs | A limited period required by service-provider policies and operational/security needs |
Where applicable law requires retention for a specified period, the relevant information may be stored separately for the legally required period.
5. Deletion Procedures and Methods
When personal information is no longer necessary because its processing purpose has been achieved or the account has been deleted, the information is deleted without undue delay.
- Electronic files and database records are deleted using methods designed to make recovery difficult.
- Separate files or printed materials, if any, are securely deleted or destroyed.
- Information that must be retained by law is stored separately and deleted when the required retention period ends.
The following information is deleted when an account is deleted.
- Supabase Auth account
- Stored email and original email content
- Email connection information
- Nylas OAuth state
- Custom keywords and onboarding-related information
- User inquiries and issue reports
- Connected Nylas grant
Deleting the Nylas grant revokes RelayDesk’s access to that email account.
6. Email Disconnection and Data Deletion
Users can manage each email connection from the dashboard using the following features.
- Pause collection: Stops collecting new email while keeping existing data and connection information.
- Resume collection: Restart email collection for a paused email account.
- Permanently delete connection: Deletes the Nylas grant, collected email, and original content for that connection.
- Delete account: Delete all email connections and Nylas grants, the user account, and the user’s data stored in the service.
Account deletion and permanent connection deletion cannot be undone.
7. Outsourcing of Personal Information Processing
The Service uses the following providers to deliver the Service reliably.
| Processor | Processing services |
|---|---|
| Supabase, Inc. | User authentication, database storage, and per-user access control |
| Nylas, Inc. | Gmail and Microsoft Outlook OAuth connections, access permissions, and email data integration |
| Google LLC | Email classification, summarization, and related analysis through the Gemini API |
| The Constant Company, LLC(Vultr) | Operation of the n8n automation server |
| Vercel Inc. | Hosting the RelayDesk web application and processing requests |
| Plus Five Five, Inc.(Resend) | Sending registration-verification and password-reset emails |
The Operator reviews and manages relevant agreements and provider privacy/security policies so processors handle personal information safely within the scope of the outsourced purpose.
8. Cross-Border Transfer of Personal Information
In the course of providing the Service, personal information may be transferred, stored, or processed outside Korea as described below.
| Recipient | Destination country/region | Transferred information | Purpose of transfer | Timing and method | Retention/use period |
|---|---|---|---|---|---|
| Supabase, Inc. | Australia (Sydney) | User identifiers, email connection information, emails and original contents, analysis results, keywords, and support requests | Authentication and data storage | Transfer over encrypted networks when using the Service | Until account deletion or the purpose is achieved |
| Nylas, Inc. | United States | Connected email addresses, OAuth permission information, and email bodies, metadata, and attachment information | Email account connection and email data integration | Transfer over encrypted networks during email account connection and synchronization | Until connection deletion, account deletion, or the period specified by the provider’s policy |
| Google LLC | United States and other countries where Google or its subprocessors operate facilities | Subject, body, metadata, and analysis-request content needed for email analysis | Email classification, summarization, urgency, and reply-needed analysis | Encrypted transfer through the API during email analysis | A limited period required for analysis processing, safety, and abuse prevention |
| The Constant Company, LLC(Vultr) | Japan (Tokyo) | Email connection identifiers and email content temporarily processed during collection, classification, and storage | n8n-based automation for email collection, analysis, and storage | Transfer and processing over encrypted networks during automation execution | During beta testing, email-processing data may be stored in some n8n execution records. Records are deleted according to the server’s execution-history pruning settings or manual deletion by the operator. |
| Vercel Inc. | United States and countries where service infrastructure is located | Access information, request paths, authentication-session information, and sanitized server-error information | Providing the web application and processing API requests | Transfer over encrypted networks when accessing the Service | Runtime Logs are retained for up to 1 hour under the current Hobby plan; other security and infrastructure information is retained for a limited period under provider policies. |
| Plus Five Five, Inc.(Resend) | United States | Recipient email address and authentication or password-reset email content | Sending authentication emails | Transfer over encrypted networks during authentication/reset requests | A period required for email delivery and security |
International transfers are limited to what is needed for the email connection, email organization, authentication, and web service requested by users. Users who do not wish to transfer data internationally can avoid connecting an email account or stop using the service and delete their account. Email integration and organization features will then be unavailable.
For paid Google Gemini API services, Google states that user prompts and responses are not used to improve its products. However, data may be retained for a limited period for safety and policy-violation detection and may be temporarily processed in countries where Google or its agents operate facilities.
9. Use of Google User Data
The service uses the email access permissions granted by users according to the following principles.
- Email data is used only to provide requested features, including collection, classification, summaries, original-content viewing, and links to the original mailbox where supported.
- We do not sell connected email data.
- We do not use Gmail data for personalized advertising or advertising profiling.
- We do not disclose Gmail data to third parties except providers necessary to deliver Service functionality.
- The Operator does not routinely read users’ email.
- Access is limited to the minimum necessary when required to resolve a user-requested issue, respond to a security incident, or comply with legal obligations.
- If support requires reviewing original email content, the user will be informed of the purpose and scope in advance where practicable.
The Service aims to comply with applicable requirements of the Google API Services User Data Policy.
10. Automated Processing Using AI
The Service may use the Google Gemini API to automatically classify and summarize email and analyze status, urgency, and whether a reply is needed.
- Automated analysis results are reference information intended to help users manage email.
- Analysis results are not guaranteed to be accurate or complete.
- Notification and service emails that RelayDesk itself sends to users (from relaydesk.dev@gmail.com) are excluded from analysis to prevent repeated alerts, and are not displayed in or stored by the dashboard.
- The service lets users check original email content and, where supported, open messages in their original mailbox.
- Automated analysis results are not used to make legal decisions that materially affect users’ rights or obligations.
- Users may contact the Operator with questions, objections, or requests for explanation regarding analysis results or personal-information processing.
11. Security Measures for Personal Information
The Operator applies the following measures to prevent loss, theft, leakage, forgery, alteration, or damage of personal information.
- Per-user data access restrictions using Supabase Row Level Security
- Storage of service-role keys, Nylas API keys, and other secrets in server environment variables
- Protection of data in transit using HTTPS
- Providing email disconnection and user data deletion features
- No administrative screen for routine viewing of original email content
- Restricted access to operational accounts and management of authentication credentials
- Storage of selected n8n execution records needed for beta testing, with access restricted to the operator
- Separate operational error logs store only the minimum information needed for incident response, such as workflow identifiers, the stage where an error occurred, sanitized error information, and timestamps, and are automatically deleted after 30 days.
- Restricting operator access because n8n execution records may contain email data, and reviewing sensitive-data redaction in server error logs
- No arbitrary access outside the purpose and scope of personal-information processing
Because no internet service can eliminate every risk, the Operator continuously reviews and improves safeguards appropriate to the current scale and technical level of the Service.
12. User and Legal Representative Rights and How to Exercise Them
Users may exercise the following rights regarding their personal information.
- Request confirmation of processing and access to personal information
- Request correction or deletion of personal information
- Request suspension of personal-information processing
- Pause, resume, or permanently delete an email connection
- Delete the account and associated data
- Ask questions, raise objections, or request explanations regarding automated AI analysis
Account deletion is available from the RelayDesk dashboard under Settings & management → Delete accountYou can delete your account directly there. Other requests can be submitted to relaydesk.dev@gmail.com.
Where identity verification is necessary, the Operator may request information needed to verify the requester. A request may be limited in whole or in part where permitted by applicable law.
13. Cookies and Session Information
The Service may use authentication sessions or cookies necessary to maintain sign-in status and security. This information is used to provide essential Service functionality and is not used for personalized advertising.
Users may restrict cookie storage through browser settings, but sign-in and certain Service functions may not work properly as a result.
14. Privacy Officer and Contact Information
- Personal information controller and privacy officer: Kim Hyun-min
- Service: RelayDesk
- Contact email: relaydesk.dev@gmail.com
Questions about personal-information processing, exercising rights, or seeking remedies may be submitted to the email address above.
Users who need consultation or wish to report a personal-information infringement may contact relevant Korean authorities, including the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.
15. Changes to This Privacy Policy
This Privacy Policy applies from its effective date. If it changes, the Service will announce the changes and effective date through the Service interface or website before they take effect. Changes that materially affect user rights will be separately notified as required by applicable law.