Privacy policy

1. Who we are

Royak (“Royak”, “we”, “us”) runs the Royak platform at royak.app and is based in Bulgaria. For personal data about the people who use Royak, such as account holders and visitors to this website, we are the controller under the EU General Data Protection Regulation (GDPR).

You can reach us about anything in this policy at support@royak.app.

2. Your data and your company’s data

This policy covers the website, your account and the Royak service. Inside Royak you create companies, AI employees, chats, tasks, tables, files and connections. When that content holds personal data about other people (for example a list of leads or a customer’s message), the company that put it there decides why it is processed, and we process it on that company’s behalf and on its instructions only. If your organisation needs a data processing agreement, write to support@royak.app.

3. What we collect

• Account details: your name, email address and how you sign in. Passwords are stored only as a hash by our authentication provider; if you sign in with Google we receive your name and email address from Google.
• Members: the email address and role of each person a company’s owner invites, and when each member was last active.
• Company content: what you and your AI employees create in Royak, such as companies, employees and their instructions, chats, goals, tasks, approvals, calendar entries, routines, tables, knowledge files and the deliverables employees keep.
• Keys and connections: model provider keys you add and the credentials of services you connect. They are encrypted before they are stored, used only for the call that needs them and never shown to AI models.
• Usage and records: what each piece of work cost, the audit trail of who approved what, your account’s plan and its monthly credits, and what Dodo Payments tells us of your payments (see below).
• Technical data: security and service logs, which can include your IP address, browser and the time of a request.
• Messages to us: what you send when you write to support or report a problem in Royak, including a screenshot if you attach one and technical details such as your browser, screen size and the page’s recent errors.

We do not buy personal data, and we do not collect special categories of data on purpose. Please do not put such data into Royak unless you have a lawful reason to.

4. How we use it and why we may

We do not sell your personal data, we do not show you advertising and we do not use your content to train AI models.

5. AI models and your content

When an AI employee works, the instructions, messages and data it needs are sent to the model provider chosen for that work (currently OpenAI, Anthropic, Google or xAI). Model calls paid from your plan’s monthly credits run on our own OpenAI account, as do search over your knowledge (embeddings) and any call we tell you runs on our key. On the Paid plan your company can add its own provider key, which Anthropic, Google and xAI models always use, and your agreement with that provider governs how it handles the data sent with that key. We use providers’ business APIs, which under their terms do not train on API data by default.

AI employees act only within the permissions, budgets and approvals your company sets. Anything that sends, posts, pays or deletes outside Royak waits for a person to approve that exact action.

6. Google user data

Royak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

You connect each Google service (Gmail, Calendar, Drive, Sheets, Docs, Slides, Contacts or Tasks) separately, and each connection asks Google only for that service’s permission. Your AI employees use the data only to do the work you or your company give them, within the permissions and approvals your company sets.

We do not use Google user data, raw or derived, to develop, improve or train generalised or foundational AI or machine learning models, and we do not sell it, use it for advertising or let people read it except with your permission, for security or to comply with the law. The data an AI employee needs for a task is sent only to the model provider chosen for that work, under the terms described above. You can disconnect a Google service in Royak or at myaccount.google.com/connections at any time.

7. Who we share it with

We share personal data only with the service providers that run Royak for us, under contracts that limit them to our instructions:

When you pay for the Paid plan, Dodo Payments sells it to you as the merchant of record: on its own pages it takes your card and billing details, charges you, issues your invoices and handles sales tax and VAT, as a controller under its own privacy policy. Your card number never reaches Royak. We keep your Dodo customer and subscription references, and read from Dodo your payments, invoices and your card’s brand, last four digits and expiry to show them in Billing.

When you connect another service (for example Linear or a CRM), the data your AI employees read or send there goes to that service under your own agreement with it. We may also disclose data when the law requires it, to protect people or our rights, or to a successor if Royak is reorganised or sold, in which case this policy continues to apply to your data.

8. International transfers

Our database and file storage are in the EU. Some providers above process data in the United States or other countries. Where data leaves the European Economic Area we rely on the European Commission’s adequacy decisions, including the EU–US Data Privacy Framework where a provider is certified, or on the Commission’s Standard Contractual Clauses.

9. How long we keep it

• Account details and company content: while your account is open. A company you delete in its settings, or your account if you ask us to delete it, is deleted within 30 days.
• Backups: deleted data leaves our backups as they are replaced, normally within 90 days.
• Service logs: a few days.
• Billing and accounting records: as long as Bulgarian and EU law requires, usually up to 10 years.

10. Your rights

In the EU, the EEA and the UK

You may ask to access, correct, delete, restrict or receive a copy of your personal data, object to processing based on our legitimate interests, and withdraw consent you gave. You may also complain to a data protection authority; ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg), or you can go to the authority where you live.

In the United States

Depending on your state (for example California under the CCPA), you may ask to know what personal information we hold and how we use it, and to correct or delete it. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not treat you differently for using these rights, and an authorised agent may ask on your behalf.

To use any of these rights, write to support@royak.app from your account’s email address. We answer within one month (45 days where US law allows) and may need to confirm it is you. For data a company holds in Royak about you, ask that company; we will help it answer.

11. Cookies and browser storage

Royak uses only cookies and browser storage it needs to work: cookies that keep you signed in (and one that completes Google sign-in, and one that keeps an invitation link you open before signing in), and cookies or local storage that remember choices you make, such as the theme, the layout and which table columns you hide. We use no analytics, advertising or tracking cookies, so there is nothing to consent to.

12. Security

Traffic is encrypted in transit, data is stored with providers that encrypt it at rest, and keys and credentials are additionally encrypted by us. Access is limited to each company’s members and checked on our servers for every request. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

13. Children

Royak is for people aged 18 or over. We do not knowingly collect data from anyone younger; if you believe we have, write to support@royak.app and we will delete it.

14. Changes to this policy

We will update the date at the top when this policy changes, and tell account holders by email or in Royak before a material change takes effect.

15. Contact

Questions or requests about your privacy: support@royak.app.