Skip to content
Rigyx

Privacy Policy

Last updated: 2026-10-27

Rigyx is a product operated by Fpa Solutions LTD, a company registered in the Republic of Bulgaria under UIC (ЕИК) 207794750 (“Rigyx”, “we”, “us”). This Privacy Policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have. It applies to our website, the Rigyx dashboard and desktop app, and the agents and services we run on your behalf.

For data you bring into the product about your own contacts, customers and leads, you are the data controller and Rigyx acts as your processor under our Data Processing Agreement. For data about you as our customer (your account, billing and usage) and about visitors of our website, Rigyx is the controller.

1. Data we collect

  • Account data — name, e-mail, password hash, business name, country, language and the settings you choose.
  • Business content — leads, contacts, campaigns, documents, knowledge-base files and everything else you upload or the agents produce for you.
  • Communications — e-mails, calls, voicemails and messages the agents send on your behalf, with their delivery, open, click, reply, bounce and unsubscribe events.
  • Mail from your mailbox — when you connect a mailbox, the messages it receives (see section 4).
  • Calls — numbers called, call scripts, transcripts and outcomes (see section 4).
  • Calendar data — when you connect a calendar, its events and free/busy times (see section 4).
  • Browser helper tasks — when you use the desktop browser helper, what the task asks and what it did (see section 4).
  • Financial documents — statements, ledgers, payroll registers and other files you upload (see section 4).
  • Voice data — if you choose to, voice samples used to make a sending voice. Only with your explicit consent; deleted on request.
  • Payment data — billing is handled by Stripe. We store your subscription status and a Stripe customer reference; we never store card numbers.
  • Usage and device data — log data, IP address, browser type and product interactions, used for security and to operate the service.
  • Website visitors — what you enter in our free tools (a website address, an e-mail address), and your IP address for rate limits and the human check.

2. How we use data

  • To provide and operate the service and its AI agents, and to improve it.
  • To send the communications you instruct us to send, and to report on them.
  • To bill you, prevent fraud and enforce our terms.
  • To secure the platform, find and fix errors, and meet legal obligations.
  • To tell you about your account, security and material product changes.

We do not sell your personal data, and we do not use the content you upload to train AI models.

3. Legal bases (GDPR)

  • Contract — to deliver the service you signed up for.
  • Legitimate interest — to secure and operate the platform and to answer website visitors who use our free tools (balanced against your rights).
  • Consent — for voice cloning and any optional feature that asks for it. You may withdraw consent at any time.
  • Legal obligation — to keep financial records and respond to lawful requests.

4. Data from what you connect

Some features work on data that lives in your own accounts. For each one: what we read, why, on what basis and how long we keep it. The full retention table is in our Data Retention Policy.

Mail read from your mailbox (IMAP)

When you connect a mailbox with its server details, Rigyx reads the messages it receives — sender, subject and body — to show you replies, sort them and draft answers for your approval. It never marks, moves or deletes anything in your mailbox, and you can switch the reading off for each mailbox (Settings → Permissions). Your mailbox password is stored encrypted. Basis: contract with you; for the people who write to you, we process their mail on your behalf (DPA). Kept: while the business exists, or until you delete the business.

Calls, recordings and transcripts

When you use calling, the agents place calls and voicemails through our telephony and voice providers (Twilio, ElevenLabs). Rigyx stores the number called, the script, the transcript, the outcome and a link to the recording, which stays with the voice or telephony provider. Basis: contract with you; for the people called, we act on your behalf (DPA) and you need a lawful basis to call them (Acceptable Use). Kept: while the business exists.

Calendar data (Google Calendar, Outlook)

When you connect a calendar, Rigyx reads your free/busy times and events to propose meeting times, and creates, updates and removes the events it books for you. Basis: contract. Kept: the events Rigyx booked stay in Rigyx while the business exists; the calendar’s access is stored encrypted and lasts until you disconnect it on the Calendar page (which erases it), remove Rigyx’s access in your Google or Microsoft account, or delete your account.

Pages the browser helper reads

The browser helper runs on your computer, in the desktop app, and only does tasks you give it. While doing one, it reads the pages the task needs; an outline of each page (headings, links, buttons and text) and, when needed, a screenshot are sent to the AI model provider to choose the next step. We store the task, its result and the names of its steps — not the pages. Basis: contract. Kept: the task and its result while the business exists; the step-by-step activity feed for 30 days.

Uploaded financial documents

Trial balances, bank statements, payroll registers, loan contracts and similar files you upload are stored on our servers outside any public folder and read by our code — a scanned page or a picture by an AI model. Nothing reaches your books until you accept each item. Basis: contract. Kept: until you discard the document (one whose figures are already in your books stays as their source) or delete the business.

5. Data from Google accounts (Limited Use)

When you connect a Google account, Rigyx asks only for the access the feature needs:

  • Google Ads — to read your campaigns, budgets and results, and to change a budget or pause a campaign: after your approval, or by itself within the limits you set if you switch automatic management on. The free ad-waste scan on our website reads your campaigns once and keeps no access.
  • Google Analytics — to read your site’s reports and, only after your approval, to mark key events or set their values.
  • Google Search Console — to read how your site appears in Google Search (read only).
  • Google Calendar — to read free/busy times and events and to create, update and remove the events Rigyx books for you.
  • Your Google name and e-mail — to show which Google account is connected.

Rigyx’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the features you see in Rigyx; we transfer it only to provide those features (for example to the AI model provider that carries out the task you asked for), to comply with the law, or with your consent; we do not use it for advertising; we do not use it to train AI models; and no person reads it unless you ask us to, it is needed for security or to comply with the law.

6. Sharing and sub-processors

We share data with sub-processors only to run the service — for example AI model providers, e-mail delivery, telephony and payments. Each one, with what it receives, is on the sub-processor list. We will notify customers at least 30 days before adding or replacing a sub-processor. We may also disclose data where the law requires it or to protect our rights and users.

7. International transfers

Fpa Solutions LTD is established in the European Union (Bulgaria). Some of our sub-processors process data in the United States and elsewhere — their locations are on the sub-processor list. Where personal data is transferred out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, as set out in our DPA.

8. Retention

We keep data only as long as needed for the purposes above and as the law requires. Every period — exports, deletion, the audit log, free tools (a free prospect run nobody signs up with is deleted after 30 days) — is in our Data Retention Policy.

9. Your GDPR rights

  • Access (Art. 15) — a copy of the data we hold about you.
  • Rectification (Art. 16) — correct inaccurate data.
  • Erasure (Art. 17) — request deletion, subject to legal retention.
  • Portability (Art. 20) — export your data as a ZIP from the dashboard.
  • Restriction (Art. 18) and Objection (Art. 21) in certain circumstances.

Exercise these in the dashboard (Settings → Privacy for your own account, Dashboard → Compliance for a business) or by writing to [email protected]. We answer within one month. You may also complain to your local data-protection authority, or to ours: the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, www.cpdp.bg).

10. California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of that information, to correct inaccurate information, and not to be discriminated against for exercising these rights.

We do not sell your personal information and do not share it for cross-context behavioral advertising as those terms are defined under the CPRA. The categories of personal information we collect and our purposes are in sections 1–5 above; we keep it as described in section 8.

To exercise your California rights, write to [email protected]. We will verify your request and respond within the time the law requires. You may use an authorized agent to submit a request on your behalf.

11. Cookies and browser storage

Rigyx uses only strictly necessary browser storage — to keep you signed in, remember your language and a few choices you make. We run no analytics and no advertising cookies. The full list of keys is on our cookies page. E-mails the agents send on your behalf may contain open and click tracking; recipients can opt out with the unsubscribe link in campaign e-mails.

12. Children

Rigyx is a business tool not directed to children. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the product or by e-mail. The “Last updated” date above shows the current version.

14. Contact

The data controller for account data is Fpa Solutions LTD, a company registered in the Republic of Bulgaria under UIC (ЕИК) 207794750. Write to us about privacy at [email protected], and about anything else at [email protected].