Privacy Policy

This policy explains how Regolyn Inc. (“Regolyn”, “we”) handles personal data when you use regolyn.com and the Regolyn application. The plain-words version lives at Your data; this is the formal one, and we keep them consistent.

What we collect

Account data: your name, email address, and a password hash, or your Google account identifier if you sign in with Google. Product data: the intake you write (your AI use cases, operating footprint, vendor list, pasted policies) and the assessments produced from it. Messages: what you send through our contact, support, and application forms. Technical data: standard server logs (IP address, user agent, timestamps) held briefly for security and debugging.

We do not collect browsing history, we do not buy data about you, and the marketing site sets no advertising trackers.

Why we process it

• To operate your account and produce your assessments (contract)
• To answer messages you send us (legitimate interest)
• To secure the service and prevent abuse (legitimate interest)
• To bill paid plans, where enabled (contract)

Models and training

Your intake is sent to a model provider (OpenAI or Anthropic) solely to produce your assessment, under API terms that exclude training on your content. Regolyn never uses your data to train models and never builds cross-customer datasets from company answers.

Who processes data for us

Vercel (hosting and storage), OpenAI or Anthropic (model inference), Neon (database, where configured), and Resend (transactional email, where configured). All process data on our instructions. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Retention

Account and product data: until you delete it, which you can do at any time in Settings, with immediate effect in the primary store. Messages: up to two years. Server logs: up to 30 days. Infrastructure backups age out on the providers’ standard schedules.

Your rights

Access and portability are self-serve: the export in Settings is the complete record. Deletion is self-serve and immediate. Depending on where you live (including the EEA, UK, and California), you may also have rights to correction, restriction, and objection, and the right to complain to a supervisory authority. Write to privacy@regolyn.com and a person will handle it within 30 days.

International transfers

We are a US company and process data in the United States. Where EU or UK data protection law applies, transfers rely on the providers’ standard contractual clauses and equivalent safeguards.

Children

Regolyn is a business tool and not directed at anyone under 16. We do not knowingly collect children’s data.

Changes

If this policy changes materially, we will note it in the changelog and email account holders before it takes effect.

Contact

Regolyn Inc., 1550 Wewatta Street, Suite 200, Denver, CO 80202, USA. privacy@regolyn.com