Privacy Policy
Draft pending legal review. This policy describes how the Service is built and currently behaves. It has not yet been reviewed by a qualified lawyer.
Who we are
Rellooma (“the Service”) is operated by Metric One Technologies Ltd, a company registered in England and Wales (company number 17481814) whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom (“we”, “us”). For any privacy question, contact privacy@rellooma.com.
The Service lets a business connect its own messaging channels and manage the resulting customer conversations. Each business operates in an isolated workspace. For its own account and billing data we are the data controller. Where a business uses the Service to handle its customers’ messages, that business is the data controller for those customer records and we act as a processor on its instructions.
What we collect
- Account and workspace data: the email address, name and sign-in credentials of each user, the workspace business profile, the knowledge, FAQs and price list the business chooses to enter, and role assignments within the workspace.
- Connected channel data: when a business connects a WhatsApp Business account or an Instagram professional account, the messages and events that Meta delivers to us for that account, including message content, the sender’s platform identifier, timestamps, delivery and read status, and attached media.
- Customer records: contact details and notes that the business enters directly, imports by file, or that are derived from an incoming conversation.
- Billing data: subscription state and the customer, subscription and transaction references issued by Paddle, our merchant of record. Card and other payment details are entered on Paddle’s checkout and never reach our servers.
- AI provider keys: where a business supplies its own AI provider key, the key itself, stored encrypted.
- Operational records: audit events recording who changed what and when, and request logs used to keep the Service secure. Audit events deliberately contain metadata only, never message content or credential values.
How we use it
To operate the Service: authenticating users, protecting forms against abuse, isolating each workspace, delivering incoming messages into the correct workspace, running the automations and AI-assisted replies a business has configured, producing the exports a business requests, sending service emails such as sign-in links and team invitations, and billing for the subscription.
We process this data to perform our contract with the business, to meet legal obligations such as tax and accounting, and for our legitimate interest in keeping the Service secure. Optional product emails are sent only with consent, which can be withdrawn at any time in Settings → Legal.
We do not sell personal data, and we do not use customer conversation content for advertising or to train AI models.
AI processing
AI-assisted replies use an AI provider key that the business supplies (Google Gemini, OpenAI or Anthropic), so the content is sent to that provider under the business’s own agreement with it. A deliberately narrow slice of context is sent: at most the eight most recent messages in that conversation, the fields the task requires, up to twenty selected FAQs, up to twenty price items, and the applicable response policy. Unrelated customers, exports, credentials and unnecessary records are never included.
The built-in demo mode uses synthetic data only. No archive of raw AI prompts is created. AI output cannot alter consent, opt-out state, workspace boundaries or sending controls, and low-confidence or malformed output is routed to a person rather than acted upon.
Storage and security
Records are segregated per workspace and enforced at the database layer, so one workspace cannot read another’s data. Media and generated exports are held in private storage that is not publicly addressable. Provider tokens and customer-supplied AI keys are encrypted at rest with AES-256-GCM, with the encryption keys held separately from the database. Access by our own staff is limited to what is necessary to operate and support the Service.
Who else processes data
The Service relies on subprocessors for database and file storage (Supabase), application hosting (Vercel), background jobs (Inngest), email delivery (Resend), bot protection (Cloudflare Turnstile), payments (Paddle), the messaging channels a business connects (Meta), and the AI provider a business configures. What each one receives and where it processes data is listed at app.rellooma.com/subprocessors.
International transfers
The primary database and file storage are in South Korea (Seoul). Application hosting runs in the United States (Washington, D.C.), as do background jobs and email delivery. Meta, Paddle, Cloudflare and AI providers process data on their own global infrastructure. Where data leaves your country, we rely on the transfer safeguards required by applicable law; the specific mechanism is to be confirmed.
Retention
Generated exports expire after a short period; expired downloads are refused and the underlying file is removed. Each workspace can configure a retention period for its own records. Channel credentials and AI keys are removed immediately when a connection or key is deleted. Audit events are kept on a defined schedule because they are the evidence that access was correctly controlled, and a record may be retained where audit evidence still references it. Billing records are kept for the period tax and accounting law requires.
Your rights
Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal data, and to object to processing. If you are a customer of a business using the Service, please contact that business first, since it controls the record. Workspace users can download their account data and request account deletion in Settings → Legal. Otherwise contact privacy@rellooma.com. Deletion is described in detail at app.rellooma.com/data-deletion.
You may also lodge a complaint with a data protection supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ICO), or the authority in the country where you live, such as the Turkish Personal Data Protection Authority (KVKK).
Changes
We will update this policy when our processing changes and publish it as a new version with a new date. Material changes will be notified to workspace owners at their registered email address.