Secy Get early access

Rethink AI Labs Private Limited

Privacy Policy

Last revised: September 30, 2026

On this page

Secy is a product of Rethink AI Labs Private Limited (CIN U58200HR2026PTC151277), Gurugram, Haryana, India.

Rethink AI Labs Private Limited (“Rethink AI Labs”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, retain, and otherwise process personal data when you use Secy, our Personal AI Assistant, including our website at https://heysecy.ai, associated subdomains, integrations, messaging channels, any applications we may offer in future, and related services (collectively, the “Services”).

Because Secy is designed to understand your instructions, access information from services you connect to it, and perform actions on your behalf, this Privacy Policy provides specific information about how we handle AI interactions, connected accounts, Google Workspace data, authentication information, actions Secy takes for you, and information relating to other people that may appear in your communications and documents.

Secy is in early access. Some features described in this policy are planned and not yet available. We mark them When available. For those features, this policy describes how we will handle personal data once we offer them. We will update this policy if our plans change.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires consent for a particular processing activity, we will obtain that consent separately.

1. Who We Are

The Services are provided by Rethink AI Labs Private Limited, a company incorporated in India.

Rethink AI Labs Private Limited
Privacy and grievances: privacy@heysecy.ai
Website: https://heysecy.ai

For questions, requests, or complaints concerning privacy or personal data, including grievances under Indian law, contact us at the email address above. See Section 19 for how we handle grievances.

2. Information We Collect

The information we collect depends on how you use the Services and the permissions you provide.

2.1 Website and Early Access

If you join the Secy early-access list on our website, we collect:

We use these details only to contact you about access to Secy, by a message to your mobile number or by email. They are stored with our cloud infrastructure provider in the Asia-Pacific region, and a copy of each submission is sent by email to our team so we can follow up.

To protect the form from bots and abuse, we use a bot-protection service, which processes your IP address and technical signals from your browser and device to check that a person is submitting the form. We also use your IP address to limit repeated submissions. We do not store your IP address with your early-access details.

Our website sets no cookies of its own and uses no advertising or analytics tools.

2.2 Account and Profile Information

When you use Secy or create or maintain an account, we may collect:

We seek to collect only information that is reasonably necessary for the relevant feature or purpose.

2.3 Payment and Billing Information When available

If we offer paid Services and you purchase them, we may process:

Payment credentials may be processed directly by third-party payment providers. Where this occurs, the payment provider’s own privacy policy will govern its processing of your payment information.

2.4 Communications and Content You Provide

We may collect information you provide when you:

This may include the content of your communications with Secy and information contained in materials you provide. Voice notes are converted to text so Secy can understand them, and the audio file is then deleted.

2.5 Information Processed Through Secy

Depending on the permissions you grant and the tasks you ask Secy to perform, Secy may process information contained in:

Secy accesses connected services only to the extent reasonably necessary to provide the functionality you request or authorise.

2.6 Information Relating to Other People

Information processed through Secy may relate to people other than you.

For example, your emails, calendar events, documents, contacts, or messages may contain personal information relating to colleagues, customers, friends, family members, vendors, or other individuals.

We may process such information as necessary to provide the Services, perform actions requested or authorised by you, maintain security, prevent abuse, or comply with applicable law.

You should only connect accounts and provide information that you are authorised to provide.

2.7 Sensitive Personal Data

Depending on the information you provide or the services you connect, Secy may process information that is considered sensitive or specially protected under applicable law.

This may include:

We do not intentionally seek sensitive information unless it is necessary for a feature or workflow you choose to use. Where applicable law requires your consent before we collect such information, we will ask for it.

2.8 Authentication Information and Credentials Vault

Certain Secy workflows require Secy to sign in to other services for you.

For Google, Secy uses OAuth, so it never needs your Google password. Where other services offer OAuth, API tokens, or delegated permissions, we will prefer those methods.

For services that do not support OAuth or API-based authentication, and where the workflow requires it, Secy may securely store encrypted login credentials in its credentials vault. Credentials, authentication tokens, browser sessions, and other authentication secrets are used only to maintain authorised connections and perform workflows requested or authorised by you.

Stored passwords are entered directly into the relevant sign-in page. The AI model that plans Secy’s actions never sees the password itself.

Secy operates a web browser on your behalf. That browser keeps signed-in sessions (cookies) for the websites you use through it, so Secy does not have to sign in each time.

When a website sends you a one-time code (OTP) and you share it with Secy, Secy uses it only to complete the step it was requested for.

You may revoke Secy’s access at any time through the relevant service, for example through your Google Account settings, or by asking us to delete your stored credentials and sessions.

2.9 Automatically Collected Information

We may automatically collect:

We use this information to operate, secure, troubleshoot, analyse, and improve the Services.

3. How We Use Personal Data

We use personal data for the following purposes.

3.1 Providing Secy

We process information to:

3.2 Executing Actions on Your Behalf

Secy is designed to act on your behalf based on instructions and permissions you provide.

Depending on the workflow, Secy may:

Secy is designed to ask for your approval before completing a payment. Where a payment requires an OTP, approval, confirmation, or other human authentication, you must provide or complete that authorisation.

3.3 User Confirmation

Secy is designed to ask for your confirmation before it:

Other steps needed to complete a task you have asked for, such as searching, comparing options, selecting a time, or filling in a form, may happen without a separate confirmation. Where you have given standing permission for a workflow, Secy may perform the permitted steps without asking each time When available.

3.4 Security and Abuse Prevention

We process information to:

3.5 Product Improvement

We may use anonymised or de-identified information to analyse usage, measure performance, understand product behaviour, improve reliability, and develop our Services.

Where we use personal data for model training or fine-tuning, we do so only as described in Section 4.

4. Artificial Intelligence and Model Training

Secy uses artificial intelligence and machine-learning technologies to provide its functionality.

4.1 AI Processing

Information you provide to Secy, and information Secy reads while completing your tasks, may be processed by AI systems to:

This AI processing is performed by third-party AI technology providers acting on our behalf (see Section 4.4).

4.2 Customer-Controlled Model Training When available

Your personal data and private content are not used to train or fine-tune AI models. If we later offer an option to help improve Secy’s models, we will only use your data for that purpose if you explicitly opt in, in accordance with the settings and disclosures presented to you at the time.

You will be able to withdraw your permission for future use at any time. Withdrawal does not necessarily reverse processing that occurred before withdrawal.

Data received from Google APIs is never used for model training, whether or not you opt in.

4.3 Anonymised and De-identified Data

We may use anonymised or appropriately de-identified information for purposes including:

Where information has been anonymised so that it can no longer reasonably be associated with an identifiable individual, it is no longer treated as personal data to the extent permitted by applicable law.

4.4 Third-Party AI Providers

Our AI technology providers may be located outside India, including in the United States. They process information only as necessary to provide the requested functionality.

We use providers whose commercial terms do not allow them to use your information to train their models. Providers may keep information for a limited period under their terms, for example to monitor for abuse, before deleting it.

4.5 Google Workspace Data and AI

Google Workspace data may be provided to an external AI provider only when necessary to provide a specific feature or action that you have requested or authorised.

Google Workspace data is not used to develop, improve, or train generalised or non-personalised AI or machine-learning models.

5. Google Workspace Data

If you connect your Google account, Secy currently requests access to:

In future, and only with your separate permission, Secy may request access to Google Drive, Docs, Sheets, Slides, or Tasks When available. We will update this section before we do.

5.1 Why We Access Google Workspace Data

We use Google Workspace data only to provide the functionality you request or authorise.

This may include:

5.2 Storage

Secy does not keep a separate copy of your mailbox or calendar. When Secy reads an email or event to complete a task, the parts it needs become part of your conversation with Secy and are kept with that conversation (see Section 13). Secy may also remember specific facts you ask it to, or that it needs for your tasks.

5.3 Google Workspace Data and AI Providers

Google Workspace data may be transferred to an external AI provider only where necessary to provide a specific feature or action requested or authorised by you.

Such providers are not permitted to use Google Workspace data for their own model training or unrelated purposes.

5.4 No Advertising or Retargeting

We do not use Google Workspace data for:

5.5 Human Access to Google Workspace Data

No person at Rethink AI Labs reads your Google Workspace data unless:

5.6 Revocation and Deletion

You may revoke Secy’s access to your Google account at any time through your Google Account settings.

Once Google Workspace access is disconnected or revoked, Secy will stop retrieving new information from the connected Google account. Imported or cached Google Workspace data associated with that connection will be deleted from active systems when the connection is disconnected, subject to limited technical processing required to complete the deletion.

5.7 Google API Services User Data Policy

Secy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Messaging Channels and Other Connected Services

You talk to Secy through messaging apps. Messages you exchange with Secy, your mobile number and message metadata pass through a third-party messaging platform, which may process them outside India. It handles them to deliver our service (see Section 9.1), and its own terms and privacy policy also apply.

Secy completes many tasks by operating a web browser for you, the way a person would. The websites Secy visits for you receive the information needed to complete your request, such as your search, your booking details, or the details you ask Secy to enter.

Secy may also connect to and interact with third-party services, including:

The information available to Secy depends on the permissions and capabilities of each connected service.

When you ask Secy to interact with a third-party service, information reasonably necessary to complete the requested action may be transmitted to that service.

The third party’s own terms and privacy policy govern its processing of information after it receives that information.

7. Actions on Your Behalf and Human Control

Secy is designed to work as your Personal AI Assistant. Once you give it a task, it takes the steps needed to complete it without asking you about each step, except for the actions listed in Section 3.3.

In future, where you have provided standing permission, Secy may proactively perform certain actions without a new instruction When available. Examples may include:

Payments and financial transactions require your authorisation, including where an OTP, approval, confirmation, or similar authentication mechanism is required.

Secy does not have independent authority to override a user’s authentication or payment approval requirements.

8. User Confirmation and Action History

Secy asks for your confirmation before the actions listed in Section 3.3.

Secy tells you in the conversation what it is doing and what it has done. A separate activity or action history, so you can review actions performed through the Services, is planned When available.

9. Information Sharing

We do not sell or share your personal data for advertising, and we do not sell, rent, or trade it to data brokers.

We disclose personal data only in the following circumstances.

9.1 Service Providers

We use trusted service providers to run Secy, such as providers of cloud hosting, data storage, AI processing, messaging, email delivery, and security. These providers process personal data on our behalf and only to provide their services to us.

They are bound by contracts that restrict how they may use your information, and they may not use it for their own purposes, such as advertising or training their own models.

9.2 Third-Party Services You Authorise

When you instruct Secy to interact with a third-party service, we may share information necessary to complete the requested action.

For example, if you ask Secy to make a booking, send a communication, submit information, or interact with another platform, relevant information may be transmitted to that platform.

9.3 Legal and Regulatory Requirements

We may disclose personal data where reasonably necessary to:

9.4 Corporate Transactions

If Rethink AI Labs is involved in a merger, acquisition, financing, restructuring, sale of assets, insolvency, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable law and contractual obligations.

10. Human Access to Your Data

Rethink AI Labs employees do not have access to your private Secy content for routine customer support, product improvement, or general operational purposes. We have designed our systems and processes to minimise human access to customer content. Where access is strictly required for legal compliance or a specific security investigation, access will be limited to what is reasonably necessary and subject to appropriate safeguards and access controls.

11. Cookies and Similar Technologies

Our website sets no cookies of its own and does not use advertising or analytics tools. The bot-protection service that protects our early-access form may use cookies or similar technologies to tell people from bots.

If we introduce sign-in, applications, or product analytics in future, we may use cookies, local storage, software development kits, and similar technologies to keep you signed in, remember preferences, understand how the Services are used, diagnose problems, and protect against fraud. We will update this section before we do.

We do not use your private Secy content for targeted advertising.

You may control cookies through your browser or applicable device settings.

12. Marketing Communications

We may send service-related communications, including:

We may also send promotional communications where permitted by applicable law.

You may unsubscribe from promotional communications at any time using the unsubscribe mechanism included in the communication, or by writing to privacy@heysecy.ai.

You cannot generally opt out of essential transactional, account, security, or legal communications.

13. Data Retention

We retain personal data only for as long as reasonably necessary to provide the Services, fulfil the purposes described in this Privacy Policy, comply with applicable law, resolve disputes, enforce agreements, maintain security, and protect our legitimate business interests.

The following retention principles apply:

Early-Access Details

Kept while the early-access programme runs so we can contact you, or until you ask us to delete them.

Account Information

Account information is retained while your account remains active and for a limited period after account deletion where necessary for legal, security, fraud-prevention, or accounting purposes.

Conversations and Memory

Your conversations with Secy, including content Secy read while completing your tasks, and the facts Secy remembers for you are retained while you use Secy, unless you ask us to delete them earlier.

Google Workspace Data

Google Workspace data is kept only as part of your conversations and memory, as described in Section 5.2. Imported or cached Google Workspace data is deleted from active systems when the Google connection is disconnected or revoked.

Credentials and Signed-In Sessions

Stored passwords, access tokens, and browser sessions are retained while necessary to perform tasks for you and are deleted when you revoke access, ask us to delete them, or delete your account, subject to applicable technical and legal requirements.

Technical and Security Logs

Technical and security logs are generally retained for up to 30 days. We may retain specific information for longer where reasonably necessary to investigate a security incident, fraud, abuse, comply with applicable law, or protect the security and integrity of the Services.

Backups

Deleted information may remain temporarily in secure backup systems and is generally deleted or rendered inaccessible within 30 days as part of the backup lifecycle.

14. Account and Data Deletion

You may request deletion of your early-access details, your Secy account, or your associated personal data by:

Following a completed deletion request, personal data is deleted from active production systems. Connected integrations are disconnected where applicable, authentication tokens and applicable credentials are revoked or deleted, and applicable cached data is deleted. Residual copies may remain temporarily in secure backup systems and are generally deleted or rendered inaccessible within 30 days as part of the backup lifecycle. Information required to be retained by law, or reasonably necessary for legal, security, fraud-prevention, or dispute-resolution purposes, may be retained for the applicable period.

15. Security

We maintain technical, organisational, and physical safeguards designed to protect personal data against unauthorised access, disclosure, alteration, destruction, or loss.

Our security measures include or may include:

No system or method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Security Incidents

If we become aware of a security incident involving personal data, we will assess and respond to the incident in accordance with our incident-response procedures and applicable law.

Where notification is required by applicable law, we will notify affected individuals and the relevant authorities, including India’s Data Protection Board and CERT-In where applicable, within the required timeframe.

17. International Data Transfers

Rethink AI Labs is based in India.

To provide the Services, personal data may be processed or stored in India, the United States, and other countries where our service providers operate, including the Asia-Pacific region.

Where personal data is transferred internationally, we apply appropriate contractual, technical, and organisational safeguards as required by applicable law.

18. Your Privacy Rights

Depending on where you live and the laws that apply to your personal data, you may have rights including:

You may submit requests by writing to privacy@heysecy.ai, or by asking Secy in your conversation When available.

We may need to verify your identity before completing certain requests.

19. India-Specific Privacy Rights and Grievances

For individuals whose personal data is governed by India’s applicable data-protection laws, we process personal data in accordance with the obligations applicable to us.

Depending on the applicable law and its effective provisions, you may have rights relating to:

Grievances. Send any grievance about how we handle your personal data to privacy@heysecy.ai. We will acknowledge it and aim to resolve it within one month. If you are not satisfied with our response, you may complain to the Data Protection Board of India once the relevant provisions are in force.

The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 establish India’s current statutory framework for digital personal data protection, with the Rules providing for phased commencement of their provisions.

20. European Economic Area and United Kingdom

If you are located in the European Economic Area or United Kingdom and applicable data-protection laws apply to our processing of your personal data, you may have additional rights.

Depending on the circumstances, our legal basis for processing personal data may include:

Where we rely on consent, you may withdraw that consent.

Depending on applicable law, you may also have rights to:

21. California and Other U.S. State Privacy Rights

Depending on your state of residence and applicable law, you may have additional privacy rights, including rights to:

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We do not use private Secy content for targeted advertising.

Requests may be submitted to privacy@heysecy.ai.

22. Automated Decision-Making

Secy uses automated systems, including AI systems, to interpret instructions, generate content, organise information, determine workflow steps, and perform authorised actions.

AI systems may produce incorrect, incomplete, or unexpected outputs.

Secy should not be relied upon as a substitute for professional legal, medical, financial, or other regulated advice.

Where applicable law provides specific rights or safeguards concerning solely automated decision-making or profiling, we will comply with those requirements.

23. Children’s Privacy

Secy is intended for individuals who are 18 years of age or older. If you are under 18, please do not use Secy or join the early-access list.

We do not knowingly permit individuals under 18 to create accounts or use Secy.

If we become aware that we have collected personal data from an individual under 18 in circumstances where such collection is not permitted, we will take reasonable steps to delete the information.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

When we make material changes, we will take reasonable steps to notify users, including through the Services or by email where appropriate.

The “Last revised” date at the beginning of this Privacy Policy indicates when the policy was most recently updated.

25. Contact Us

For questions, privacy requests, grievances, or requests concerning your personal data, contact:

Rethink AI Labs Private Limited
Email: privacy@heysecy.ai
Website: https://heysecy.ai

We may request information necessary to verify a request and protect against unauthorised access to personal data.