Privacy Policy

1. Who we are

Rellova (“Rellova”, “we”, “us”) provides an online service for building forms, approvals and automations through our website and app (the “Service”). This policy explains how we handle personal information, in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Questions or requests about privacy: RellovaSupport@gmail.com.

2. Our role: your account, and your customers’ data

For your account (the people who sign up and use Rellova), we decide how personal information is used, and this policy applies directly.

For information collected through our customers’ forms (for example a new employee filling in an onboarding form), the business that created the form decides what is collected and why. We store and process it on their behalf and only as they instruct. If you filled in a form, please contact the business that sent it to you about your information; we will help them respond.

3. What we collect

• Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google or Microsoft, we receive your name, email address and an account identifier from them; we never see your Google or Microsoft password.
• Workspace content: the forms, automations, approvals, branding and logos you create, and who in your team did what (an audit log).
• Form answers and automation data: answers people submit through your forms, data sent to your automations’ webhooks, and the emails and approvals your automations create.
• Security and technical information: sign-in sessions, two-factor settings (encrypted), and IP addresses used briefly to stop abuse (rate limiting). Rate-limit records are stored in a scrambled (hashed) form and deleted within a day.
• Messages you send us, for example through our contact form, and our replies (see “AI features” for how Rellova AI helps our help desk).
• Text you type into Rellova AI (see “AI features” below).

4. How we use it

• to provide the Service: sign you in, store and run your forms and automations, and send the emails they ask for;
• to keep the Service and your data secure, prevent abuse and investigate problems;
• to send you account emails, such as password resets and security notices;
• to answer your questions and support requests;
• to meet our legal obligations.

We do not sell personal information, and we do not use it for advertising.

5. Where your data is stored, and who processes it

Your workspace data, including form answers, is stored in a database in Sydney, Australia. Automations run on servers in Australia. We use these service providers, who process information only so we can run the Service:

• Hosting and database providers: run the website, the app and the database. Your data is stored in Australia; requests may pass through the provider’s global network on the way.
• An AI provider: powers Rellova AI, including when it helps our help desk answer you. Processing happens outside Australia (see “AI features”).
• An email provider: delivers the emails the Service sends, such as account emails and the emails your automations send. Processing may happen outside Australia.
• Google and Microsoft: only if you choose to sign in with them.
• Apps you connect: when your workspace connects an app such as Slack, Google Sheets or Google Docs, the information your automations send goes to that app, under your account with it.

6. AI features

When you ask Rellova AI to draft or change a form or automation, we send what you typed and the structure of the form (its field names and settings) to our AI provider. We never send people’s form answers. We use a paid service under which the provider does not use this information to improve its products. We keep a record that a request was made (for usage limits), but not what you typed or what came back.

Please don’t type personal details into Rellova AI.

When you contact our help desk, our team may use Rellova AI to help draft a reply. To do that we send our AI provider your name and the messages on your request, with email addresses, long numbers (such as phone or card numbers) and anything that looks like a password or key removed first, plus a few facts about your account that help answer it (for example whether two-factor sign-in is on and when you last signed in). We never send your workspace content or form answers. The same paid terms apply: the provider does not use this information to improve its products. A person on our team reads every reply before it is sent, and Rellova AI can’t change your account by itself: any action it suggests, such as sending a password reset email, happens only when a team member approves it, and is noted on your request.

7. Sending information overseas

Most information stays in Australia. Some is handled overseas: Rellova AI requests, including help desk drafts, are processed in the United States, emails may be delivered through systems outside Australia, and if you sign in with Google or Microsoft, that happens on their systems. Our hosting network may route traffic through other countries. We choose providers with strong security and privacy commitments.

8. Cookies

We use only the cookies the Service needs: to keep you signed in, protect sign-in, and remember a trusted device for two-factor sign-in. Your light or dark theme choice is kept in your browser. We do not use advertising or analytics trackers.

9. How we protect it

• Encryption in transit (HTTPS) everywhere, and encrypted two-factor secrets.
• Each workspace is kept apart by the database itself, so one customer can never see another’s data.
• The app connects to the database with a restricted login that can’t change its structure.
• Two-factor sign-in for accounts, and an audit log of important actions.
• Regular backups, with tested restores.

10. How long we keep it

We keep account and workspace information while your account is open. You can ask us to delete it at any time. Form answers are kept until the workspace that collected them deletes them or closes. Deleted information may remain in backups for a limited time until those backups expire. Rate-limit records are deleted within a day.

11. Your choices and rights

You can ask to see the personal information we hold about you, to correct it, or to delete it, by emailing RellovaSupport@gmail.com. We will respond within 30 days. Your sign-in methods and security settings are in Account settings.

If you are unhappy with how we handled a privacy concern, please tell us first. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12. Changes to this policy

We will update this page when our practices change, and tell account owners by email about important changes before they take effect. See also our Terms of Service.