Privacy Policy

The data controller is Zeta Technology Services Ltd, 493 Green Lanes, Ground Floor, Unit 2, London N13 4BS, United Kingdom. You can reach us at hello@electryo.co. For security matters use security@electryo.co; for abuse, abuse@electryo.co.

If we appoint an EU representative or a data protection officer, we will name them on this page.

It covers personal data processed through the website, iOS and Android apps, browser extension, APIs you call with your account, and optional connections to email or messaging platforms.

It does not cover third-party websites or apps we link to, or the privacy practices of Google, Apple, Microsoft, Meta, or other platforms you use to sign in or to connect an account. Those are governed by their own policies.

We collect only what we need to run the Service. Depending on how you use Electryo, that may include:

• Account data: email address, display name, optional phone number, preferred language, plan, and team role. We do not receive your Google or Apple password. If you sign in with email, we store a hashed one-time code, not a password.
• Profile photo, if you add one.
• Check data: the link, message, email, file, or QR content you submit or that a connected inbox flags; evidence gathered about it (headers, redirects, reputation hits, page signals collected from our infrastructure); the score, verdict, explanation, and follow-up chat.
• Connected inbox data: with the permission you grant, sender, subject, a short excerpt, links, and authentication results of messages we process, plus encrypted access tokens. We do not sell this data and we do not use it for advertising.
• Connected messaging data: only the messages you send or forward to Electryo, unless we describe a wider permission before you connect.
• Billing data: plan, seat count, and Stripe customer and subscription identifiers. Stripe processes card details; we never see the full card number.
• Device and security data: app version, approximate device type, push-notification token if you enable alerts, sign-in timestamps, IP address, and request logs used to operate the Service and stop abuse.
• Support data: messages you send to hello@electryo.co, security@electryo.co, or abuse@electryo.co.

Directly from you when you create an account, paste a check, chat, connect an app, or contact us. From the identity provider you choose (Google, Apple, or email). From connected platforms you authorise. Automatically from your browser or app (cookies, local storage, and security logs). From reputation providers when we look up a link or file you submitted.

We do not buy personal data from brokers. We do not scrape your social graph or contacts unless you paste them into a check.

Under GDPR we process personal data only when a legal basis applies:

• Contract (Article 6(1)(b)): to create and secure your account, run checks, watch connected apps you enable, send the alerts you asked for, apply plan limits, and provide billing and invoices.
• Legitimate interests (Article 6(1)(f)): to keep the Service secure, prevent abuse, improve detection (for example learning that a sender you keep receiving is legitimate), understand whether the Service is working, and establish or defend legal claims. You may object; see section 14.
• Consent (Article 6(1)(a)): optional notifications, optional connected apps, and optional cookies that are not strictly necessary. You can withdraw consent at any time without affecting processing already carried out.
• Legal obligation (Article 6(1)(c)): to keep tax and accounting records, and to respond to lawful requests from authorities.

If you connect Gmail, Electryo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Gmail data only to provide and improve inbox checking and related security features you enable. We do not use it to serve advertisements. We do not allow humans to read it unless you give us permission for a support case, it is necessary for security, or the law requires it. We do not transfer it to others except as needed to run those features (for example looking up a link from a flagged message with a reputation provider) or as you direct.

We do not sell personal data. We do not share it for cross-context advertising. We use processors who handle data on our instructions, under a contract, and only for the purposes below:

• Google Cloud and Firebase (European Union / Google): hosting, database, authentication, and push notifications.
• Stripe: paid plans, invoices, and the billing portal. Stripe is a separate controller for card data.
• Resend: transactional email such as sign-in codes, invoices, and team invites.
• Google Safe Browsing, VirusTotal, PhishTank, AlienVault OTX, and similar reputation lists: the URL, domain, or file hash of a check — not your mailbox as a whole.
• Google Gemini: the content of a check, so a model can write the explanation. That processing is subject to Google’s Gemini API terms. We do not use check content for advertising.
• Email and messaging platforms you connect (Google, Microsoft, Meta, Telegram, Discord, Slack, Twilio, and similar): only the data needed for the connection you authorised.

We host primary application data on Google Cloud in Europe. Some processors (including Stripe and some reputation or model APIs) may process data in the United States or other countries.

Where GDPR requires a safeguard for a transfer outside the EEA, we rely on an adequacy decision where one exists, or on Standard Contractual Clauses and the processor’s additional measures. You can ask us at hello@electryo.co for more detail about a specific transfer.

We keep personal data only as long as needed for the purposes above, unless a longer period is required by law:

• Full content of a submission: 30 days, then replaced by a short preview. The verdict and explanation stay in your history until you delete the chat or the account.
• Connected-inbox access tokens: encrypted at rest; deleted when you disconnect.
• Guardian / incident evidence (if that feature is enabled for you): evidence payload about 30 days; incident metadata about 90 days, then reduced to non-identifying form.
• Sign-in codes: expire after 15 minutes.
• Security and request logs: up to 90 days, unless needed longer to investigate abuse.
• Billing and invoice records: as required by tax and accounting law, typically several years.
• Account data: until you delete the account, then removed or anonymised except where we must retain a record (for example a ban, an unpaid invoice, or a legal hold).

We use encryption in transit (HTTPS), encrypted tokens for connected inboxes, access control, and least-privilege production access. No method of transmission or storage is perfectly secure. You can help by protecting your sign-in and by disconnecting inboxes you no longer want watched.

Face ID, Touch ID, or other device biometrics used to unlock the app are checked on your device. We do not receive biometric templates.

The website uses a small number of cookies and similar storage that are needed for the Service to work: a language preference, a local session if you are not using Firebase, and Firebase Authentication cookies when you sign in with Google or Apple. The apps use on-device storage for the same kinds of preference and session data, scoped to your account where possible.

We do not use advertising cookies or third-party ad networks. You can block cookies in your browser; sign-in and language persistence may then fail.

Checks produce a score and a verdict from weighted findings, then a model writes an explanation that is discarded if it disagrees with the evidence. This is automated processing for a security assessment you asked for. It is not solely automated decision-making that produces legal effects about you in the GDPR sense (for example a bank refusing an account). You can ignore a verdict, ask a follow-up, or delete the check.

Electryo is not directed at children under 16. We do not knowingly collect personal data from them. If you believe we have, write to hello@electryo.co and we will delete it.

If UK GDPR or EU GDPR applies, you have the right to access, rectify, erase, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority of your member state.

You can already do much of this in the product: disconnect linked apps, rename or delete chats, turn off notifications, and delete your account from Settings. Deleting the account removes chats, checks, linked apps, and the sign-in record.

For a copy of your data, a correction we cannot make in the app, or another request, email hello@electryo.co from the address on your account. We will respond within one month, or tell you if we need more time as the law allows. We may need to verify that the request comes from you.

If you are in a US state with a consumer privacy law (for example California), you may have rights to know, delete, and correct personal data, and to opt out of “sale” or “sharing” for cross-context advertising. We do not sell personal data and we do not share it for cross-context advertising. To exercise a state privacy right, email hello@electryo.co. We will not discriminate against you for exercising those rights.

We send service messages that are needed to run your account (sign-in codes, security alerts you enabled, billing receipts, team invites). You can turn off push notifications in your device settings or by signing out; that deletes the device token.

We do not send marketing emails unless you ask for them. Transactional mail is sent from hello@electryo.co or another electryo.co address.

We will update this page when our practices change and change the “Last updated” date. If a change is material, we will tell you in the app or by email before it takes effect, unless we must act sooner to meet the law or to protect the Service.

Controller: Zeta Technology Services Ltd, 493 Green Lanes, Ground Floor, Unit 2, London N13 4BS, United Kingdom. Product: Electryo. Website: https://electryo.co. Privacy questions: hello@electryo.co. Security: security@electryo.co. Abuse: abuse@electryo.co.