Privacy Policy

• Account and contact information: such as your name, email address, login information, organization, role, and workspace membership.
• Workspace and Customer Content: projects, tasks, files, messages, requests, reviews, activity, and other information you submit when using Relay.
• Usage, log, and device information: interactions with the service, pages and features used, timestamps, IP address, browser, device, operating system, diagnostic information, and security events.
• Support and communications: messages, feedback, and information you provide when you contact us.
• If you ask us to email you a link to the app, we store your email address, the campaign that brought you, and a one-way hash of your IP address to prevent abuse, and delete them within 90 days.
• Billing and subscription information: plan, billing cadence, paid-seat quantity, subscription status, transaction identifiers, and limited payment metadata. Stripe processes payment-card details; Relay does not receive or store full card numbers.
• Website attribution and storage data: referral URL, landing path, and campaign parameters stored in a 30-day first-party cookie and forwarded when you choose to sign up. The current marketing site does not use an analytics or advertising SDK.

We collect information directly from you, from activity in your browser or device, from a workspace owner or administrator who invites you, and from service providers that support account access, hosting, communications, and billing. We may also receive referral and campaign information from the link or site that brought you to Relay.

We use personal information to:

• provide, operate, maintain, and improve Relay;
• create accounts, authenticate users, and manage workspaces and permissions;
• process subscriptions, paid seats, payments, and related records;
• respond to support requests and service communications;
• protect accounts, investigate abuse, prevent fraud, and secure the service;
• understand signup sources and the performance of our own marketing; and
• comply with law, enforce our terms, and resolve disputes.

We may use information that has been aggregated or de-identified so it cannot reasonably identify you, including to understand and improve the service.

We may disclose information:

• to vendors that provide cloud hosting, database, authentication, storage, email, support, security, and similar infrastructure;
• to Stripe for payment processing and subscription administration; Stripe handles full payment-card numbers under its own privacy policy;
• to other members of a workspace as directed by workspace settings and activity;
• when required by law or reasonably necessary to protect rights, safety, security, and the integrity of Relay; or
• in connection with a financing, merger, acquisition, reorganization, or sale of all or part of the service, subject to appropriate protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and the current Relay marketing site does not use advertising pixels or an advertising network.

Relay may use cookies or similar browser storage that are necessary for account sessions, security, preferences, and operation of the app. The marketing site uses a 30-day first-party cookie to record which campaign or site brought you and pass that information to signup, with session storage as a fallback.

We do not currently run a third-party analytics SDK on the marketing site. Relay may add service analytics in the future; if our practices materially change, we will update this Policy and provide any choices required by law.

The marketing site loads Instrument Sans from Google Fonts. When your browser requests font files, Google may receive technical information such as your IP address and browser details under its own privacy practices.

We retain personal information for as long as reasonably needed to provide Relay, maintain an active account or workspace, complete transactions, meet legal and accounting obligations, resolve disputes, enforce agreements, and protect the service. Retention varies by data type and purpose. Backup copies may remain for a limited period until overwritten. We may retain security logs, transaction records, and information required by law after an account closes. When information is no longer needed, we delete, aggregate, or de-identify it where practical.

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls and service security measures appropriate to the nature of the information. No system or transmission is completely secure, so we cannot guarantee absolute security. Keep your credentials confidential and contact us if you believe your account has been compromised.

You may be able to review or update account information within Relay. Workspace owners and administrators may manage membership and workspace content. To request access, correction, deletion, or another privacy action, email hello@rela-y.com. We may need to verify your identity and authority before acting. If your account is managed by an organization, we may direct your request to that organization.

Account deletion may remove access promptly while some information remains temporarily in backups or is retained for security, billing, legal, or dispute-resolution purposes. Some workspace information may remain available to other authorized workspace members where it forms part of the organization’s records.

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, where that law applies to Relay. Depending on the circumstances, these may include rights to know, access, correct, or delete personal information; receive a portable copy; and opt out of sale or sharing. Relay does not sell personal information or share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of. We will not discriminate against you for exercising an applicable right.

Browsers may send “Do Not Track” signals. Because there is no consistent industry standard for responding to them, Relay does not currently respond to DNT signals. Global Privacy Control is designed to communicate opt-out preferences for sale or sharing. Because Relay does not sell or share personal information for cross-context behavioral advertising, GPC does not change the current marketing-site experience. If our practices change, we will honor legally required signals.

California’s “Shine the Light” law permits certain requests about disclosure for third parties’ own direct marketing. Relay does not disclose personal information to third parties for their own direct-marketing purposes.

Relay is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Relay, contact us so we can review and delete it as appropriate.

Relay and its service providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws than your country. Where required, we use appropriate safeguards for international transfers. By using Relay, you understand that information may be processed outside your place of residence, subject to applicable law.

We may update this Policy as Relay and applicable requirements change. We will post the revised Policy here and update the date above. If changes are material, we will provide additional notice when required.

For privacy questions or requests, email hello@rela-y.com.