Privacy Policy

Who is responsible

an individual based in Egypt is the controller of your account information. For the information you enter about your borrowers, you are the controller and we act as your processor, under our Data Processing Agreement. Your borrowers should contact you about their data, and we'll help you respond.

Information we collect

• Account information. You can sign in with Google, or with a one-time link and 6-digit code sent to your email address. Signing in with Google gives us your name, email address, and profile image; signing in by email gives us only the address you sign in with. A one-time sign-in code is stored only as a one-way hash, together with an encrypted copy of its sign-in link, and is deleted as soon as it's used or expires.
• Invited-access list. We keep a short list of email addresses that may use Rakolto without a subscription - brokers invited to our test programme, and our own staff and contractors. It holds the address, which of those two categories it is, and an optional internal note. We add an address only after inviting the person, and we remove it when their access ends.
• Drive authorization tokens. When you connect Google Drive and/or OneDrive - separately from how you sign in - we store an authorization token, encrypted with a key held separately from our database, so we can save documents there on your behalf. You can connect more than one drive and disconnect any of them at any time.
• Borrower details. The borrower name and email you enter so we can send the upload link and reminders.
• Upload link codes. Each borrower upload link has a short code and a 6-character password that we generate. We keep a one-way hash of each to recognise the link, and an encrypted copy so your reminder emails can include it. We count wrong password attempts on a link, only to lock it for a short time after repeated misses. Both codes are deleted when you mark the loan complete or archive it; bringing the loan back issues new ones.
• Optional notes. Any optional details you add to a loan for your own reference - such as a phone number, city, or a private note. These are stored solely on your behalf, only ever shown back to you, never included in anything we send to your borrower, and never used for any other purpose. You can edit or delete them at any time. Private notes on a contact are encrypted before they are stored.
• Document metadata. File names, checklist status, and timestamps. We do not store the document files themselves - they are uploaded directly into whichever drive you connected for that loan.
• Workspace data. Everything above belongs to your Personal workspace. It is visible only when you are signed in to that workspace, and our database enforces that separation for every request.
• Waitlist. If you join a waitlist, we keep your email and country only to tell you once when Rakolto opens in your region, then delete them. You can ask us to remove you at any time.

How we use your connected drive

For Google Drive, Rakolto requests the drive.file scope, which grants access only to the files and folders Rakolto itself creates. For OneDrive, Microsoft offers no per-file equivalent, so Rakolto requests the Files.ReadWrite scope. We use it for exactly the same three things and nothing else: creating your client-documents folder, creating a per-loan subfolder inside it, and placing borrower uploads there. We never read, list, or touch anything else in your OneDrive, and we never store your borrowers' files ourselves.

Rakolto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it. The same commitments apply to data we receive from Microsoft through OneDrive.

How we use information

We use the information above to operate the service: to authenticate you, send document requests and reminders to borrowers on your behalf, save uploads to your connected drive, display your dashboard, provide support, and keep the service secure.

We also compute aggregated usage figures (for example, how many documents arrive each week, or how long requests take to be answered) to run and improve Rakolto. These figures are built from counts and timestamps linked to an internal workspace identifier, never from the contents of your documents, and never from your borrowers' names or email addresses.

Legal bases

Where the law where you are (for example, Egypt's Personal Data Protection Law) requires your explicit consent for a particular processing, we ask for it separately.

Sharing and service providers

We don't sell your data. We share it only with the providers that run Rakolto: Google, Microsoft, Brevo, Resend, Neon, Vercel and Paddle (payments through Paddle, our Merchant of Record, if you subscribe). Each processes data only to provide their part of the service. The full list, with what each receives and where, is on our sub-processors page.

International transfers

We're based in Egypt. Our database and application servers run in the European Union (Frankfurt), and some providers process data in the United States. Where the law requires it, transfers use approved safeguards, such as the EU Standard Contractual Clauses.

Retention and your choices

We keep account and loan metadata while your account is active. You can disconnect a connected drive at any time from Settings → Drives, and revoke Rakolto's access at the source from your Google account permissions or your Microsoft account permissions. You can permanently delete your account from Settings → Danger Zone (or by contacting us). This deletes your Personal workspace and all of its Rakolto data immediately. Our database provider keeps encrypted point-in-time backups for up to 7 days for disaster recovery, after which deleted data is gone from them too. Documents already saved to a connected drive are never deleted - they remain yours and under your control.

Cookies and analytics

We use only cookies needed to keep you signed in and to remember your display preferences, and privacy-friendly, cookieless analytics (Vercel Web Analytics) that count page views without identifying you. See our Cookie notice.

Children

Rakolto isn't for anyone under 18, and we don't knowingly collect their data.

Security

Connections to Rakolto are encrypted in transit. Our database is encrypted at rest, and on top of that we encrypt drive tokens and your private notes ourselves, and store sign-in codes and link passwords only as one-way hashes. Each workspace's data is isolated at the database level, and our application runs with the least access it needs. Because uploads go straight to your connected Google Drive or OneDrive, we never store your clients' documents on our own infrastructure.

Security incidents

If a breach affects your personal data, we'll notify you and the relevant authorities within the time the law requires (for example, 72 hours to the Egyptian Personal Data Protection Center and to EU authorities).

Your rights

Wherever you are, you can ask for access to your data, correction, deletion, a portable copy (export), objection or restriction, withdrawal of consent, and you can complain to your data-protection authority (for example the Egyptian Personal Data Protection Center, your EU or UK supervisory authority, or your US state attorney general). You can do most of this in the app: export your loan and document data from Reports, correct it where it is shown, and delete it from Settings → Danger Zone. For anything else, email privacy@rakolto.com and we will respond within 30 days. We don't discriminate against you for using a right.

US state privacy notice

We do not sell or share your personal information, as those terms are defined under US state privacy laws, and we don't use it for targeted advertising. This is what we collect:

Changes and contact

We may update this policy from time to time; material changes will be reflected by the date above. Questions? Email us at support@rakolto.com, or for privacy matters privacy@rakolto.com.