Last updated: 14 October 2026

This Privacy Policy explains how KKKonsulting, Sharjah Media City (SHAMS), Sharjah, United Arab Emirates ("RYNR", "we", "us") processes personal data when you visit rynr.io, sign up for the RYNR platform, or communicate with us. Contact for all privacy matters: privacy@rynr.io.

1. Two roles: controller and processor

For data of website visitors, trial users and our direct customers (account data, billing data, communication) we act as controller. For personal data our customers store and process inside their RYNR account (their contacts, leads, conversations), we act as processor on the customer's behalf. That processing is governed by our Data Processing Agreement (DPA), which forms part of our Terms & Conditions and is available at rynr.io/dpa. If you are a contact of one of our customers, please direct requests to that company; we support them in answering it.

2. What we collect

Account and contact data (name, company, e-mail, phone), billing data (plan, invoices; card data is processed by Stripe, we never store card numbers), usage data (log-ins, feature usage, device and browser information, IP address), communication (support tickets, e-mails, chat and WhatsApp messages you exchange with us), and website data (cookies and similar technologies, see section 8).

2a. Business contacts we reach out to

We contact people in their professional role at freight forwarders and logistics companies to introduce RYNR. For this we process: name, business e-mail address, job title, company, country, public professional profile (for example LinkedIn) and our correspondence with you.

Where the data comes from: delegate lists of trade conferences we attended (for example WCA Singapore 2026), publicly available business profiles, and the B2B data provider Apollo.io, which we use to verify business e-mail addresses and job titles.

Why and on what basis: to offer RYNR to businesses for which it is relevant. Where the GDPR or UK GDPR applies, the legal basis is our legitimate interest in business-to-business direct marketing (Art. 6(1)(f) GDPR, Recital 47). We limit this to role-related business data, a small number of messages and an easy way out in every message.

Your choice: you can object at any time, without giving a reason, by replying "no" or by writing to privacy@rynr.io. We then stop all contact and keep only the minimum needed to respect your objection on our suppression list.

Retention: if you do not reply, we delete your data no later than 12 months after our last message. If you reply, we keep the correspondence as long as the business conversation continues and as required by law.

Recipients: Apollo.io (USA, B2B data and e-mail sending), Microsoft (Microsoft 365 mailboxes), a LinkedIn outreach tool provider, our CRM platform infrastructure and AI assistants for drafting (see section 6). Transfers outside the EU/UK rely on the safeguards in section 5.

3. Purposes and legal bases (GDPR)

Providing and operating the platform (Art. 6(1)(b), contract), billing and accounting (Art. 6(1)(b) and (c)), product communication and onboarding (Art. 6(1)(b)), marketing e-mails to prospects and customers (Art. 6(1)(a) consent, or Art. 6(1)(f) legitimate interest for existing customers, opt-out in every message), business-to-business outreach to contacts in their professional role (Art. 6(1)(f), see section 2a), security, abuse prevention and service improvement (Art. 6(1)(f)), legal obligations (Art. 6(1)(c)).

4. AI features

RYNR includes AI features: chat and messaging assistants, voice agents, content generation and review replies. Where you or our customers deploy these, the persons interacting with them are informed that they are communicating with an AI system, in line with applicable transparency requirements (including Art. 50 EU AI Act). AI-processed content is handled by the subprocessors listed in section 6. We do not use customer content to train our own models. No decision producing legal or similarly significant effects on a person is taken solely by automated means (Art. 22 GDPR).

5. International transfers

Our platform infrastructure is hosted in the United States. Transfers of personal data from the EU/EEA, UK and Switzerland are protected by the EU-U.S. Data Privacy Framework certification of the relevant providers and/or the EU Standard Contractual Clauses (SCCs), supplemented where required. As our corporate seat is in the United Arab Emirates, we apply the same safeguards to transfers to us. A copy of the relevant safeguards can be requested via privacy@rynr.io.

6. Subprocessors and recipients

We use the following service providers, bound by data processing terms:

(a) For the RYNR platform and customer data (as processor): platform and hosting infrastructure (USA), Stripe (payments), Twilio (SMS/voice), Mailgun (e-mail delivery), Meta/WhatsApp Business (messaging) and OpenAI (AI processing). The current detailed list with country, purpose and transfer mechanism is maintained at rynr.io/subprocessors. We inform customers of subprocessor changes as described in the DPA.

(b) For our own website, marketing and sales (as controller): Google (Google Analytics 4, website statistics, only after consent), Microsoft (Clarity, website usage analysis, only after consent; Microsoft 365, e-mail), LinkedIn (Insight Tag, conversion measurement and advertising, only after consent), Meta (Pixel, conversion measurement and advertising, only after consent), Search Atlas (search engine optimisation of our website), Apollo.io (B2B contact data and outreach e-mail), a LinkedIn outreach tool provider, Fathom (meeting recording and notes, only when announced at the start of a call), Anthropic (AI assistance for drafts and data preparation), Notion and ClickUp (internal lists and tasks) and Stripe (payments). Country and transfer mechanism are listed at rynr.io/subprocessors.

6a. SMS and text messaging

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. Retention

Account data: for the duration of the contract and up to 12 months after termination, unless a longer statutory retention applies. Billing records: per statutory commercial retention periods. Customer content in the platform: deleted or returned within 60 days after contract end, per the DPA. Log data: up to 12 months. Marketing data: until consent is withdrawn or objection is raised. Business outreach data: see section 2a.

8. Cookies

We use cookies and similar technologies. Essential cookies run without consent. Statistics and marketing cookies are set only after you click "Accept all" in the consent banner; "Accept essential" sets essential cookies only. To change your choice later, delete the cookies for rynr.io in your browser and the banner appears again.

Category	Provider	Purpose	Cookies	Storage period
Essential	RYNR platform and content delivery network	Site operation, bot protection, storing your consent choice	msgsndr_id, cookie-config, __cf_bm	12 months, 6 months, 30 minutes
Statistics	Google Analytics 4	Usage statistics	_ga, _ga_*	up to 13 months; analytics data is kept for 14 months
Statistics	Microsoft Clarity	Usage analysis and heatmaps	_clck, _clsk, CLID, MUID	1 day to 13 months
Marketing	LinkedIn Insight Tag	Conversion measurement and advertising	li_sugr, bcookie, bscookie, lidc, UserMatchHistory, AnalyticsSyncHistory	1 day to 12 months
Marketing	Meta Pixel	Conversion measurement and advertising	_fbp	3 months

The list reflects the cookies observed on rynr.io on 14 October 2026. Providers may change names and storage periods; we update this list when we notice changes.

9. Your rights

Under the GDPR and comparable laws you have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time. Contact: privacy@rynr.io. You also have the right to lodge a complaint with a data protection supervisory authority, in the EU for example the authority of your member state.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, logging and vendor due diligence. Details are described in Annex 2 of the DPA.

11. Changes

We will update this policy when our practices change and indicate the date above. For material changes affecting customers we give notice via e-mail or in-app at least 15 days in advance.

Terms & Conditions · Data Processing Agreement · Subprocessors · Legal Notice

Agency Agreement Checklist Before the First Shipment