Privacy Policy

This policy covers the people who use Fractiks (“users”) — for example, a business owner or their team who connect a mailbox to run outreach — and the data we process on their behalf. Where you use Fractiks to contact your own prospects, you are responsible for having a lawful basis to process those contacts’ personal data; we act as a processor of that data on your instruction.

We collect the following categories of information:

• Account information. Your name, email address, and basic profile information, used to create and secure your account.
• Google account data. When you connect a Google mailbox, we access your Google profile (name, email address) and, through the Gmail API, the messages needed to operate outreach — see the Google user data section below for exactly which scopes and why.
• Content you create. Campaign settings, email drafts, contact/lead lists, and notes you add in the Service.
• Usage and device data. Log data such as IP address, browser type, and actions taken in the Service, used to operate, secure, and improve it.

When you connect a Google mailbox, you grant Fractiks access to the following OAuth scopes. We request the narrowest set of scopes needed to provide the features you turn on:

• Send email on your behalf (gmail.send) — to deliver the outreach messages you schedule from your connected mailbox.
• Read your email (gmail.readonly) — to detect when a recipient replies to an outreach thread so we can automatically stop further messages to that person. We read message metadata and the content of replies to outreach we sent; we do not use this access to read your wider mailbox for any other purpose.
• Basic profile (openid, userinfo.email, userinfo.profile) — to identify the connected account and show you which mailbox is linked.

We use Google user data solely to provide and improve these user-facing features. We do not use it for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the Service (see “How we share information”) or as required by law.

• To provide, maintain, and secure the Service and your account.
• To send outreach messages you schedule, and to detect replies so we can pause outreach automatically.
• To provide support and respond to your requests.
• To detect, prevent, and address abuse, security incidents, and technical issues.
• To comply with legal obligations.

Data is encrypted in transit (TLS) and at rest. OAuth refresh and access tokens for connected mailboxes are encrypted at the application layer using AES-256-GCM before they are stored, and are decrypted only at the moment they are needed to call the Google APIs on your behalf. Access to production systems is restricted to authorised personnel. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard measures.

We do not sell your personal data. We share it only with:

• Service providers (sub-processors) who host and power the Service under contract, including our cloud database and authentication provider (Supabase), application hosting (Vercel and Render), and email/communications providers we use to deliver messages. These providers process data only on our instructions.
• Legal and safety. Where required by law, regulation, legal process, or to protect the rights, property, or safety of Fractiks, our users, or others.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not transfer Google user data to third parties except as necessary to provide or improve the Service, for security purposes, to comply with applicable law, or as part of a merger or acquisition — and in each case consistent with the Google API Services User Data Policy.

We keep information for as long as your account is active or as needed to provide the Service. You can disconnect a connected mailbox at any time from the Fractiks company settings; disconnecting stops all future access and we delete the stored OAuth tokens for that mailbox. You can also revoke Fractiks’s access directly from your Google Account at myaccount.google.com/permissions.

To request deletion of your account and associated personal data, email us at david.sal@mindlace.co.uk. We will delete or anonymise your data within a reasonable period, except where we must retain it to comply with legal obligations or resolve disputes.

Depending on where you live (including under UK and EU data protection law), you may have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at david.sal@mindlace.co.uk. You also have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this policy or our data practices, contact Mindlace Industries Ltd at david.sal@mindlace.co.uk.