Data Processing Addendum

This Addendum applies when you use Relay for a business & data-protection law, such as the GDPR, the UK GDPR or US state privacy laws, treats us as processing personal information on your behalf. In that case you are the controller (or a processor for your own client) & Relay Agents is your processor (or sub-processor).

Relay is built so that very little of your data reaches us. Channel content, scripts, chats, files, recordings & keys stay in the desktop app on your computers, & content you send to AI providers or tools goes directly from your computer to them, under your own agreements with those providers. That data is outside this Addendum because we never receive it.

For our own account, billing & security records we act as an independent controller, as described in the Privacy Policy.

We process personal data only on your documented instructions. Your instructions are these Terms, this Addendum & the settings & actions you choose in the Service. If the law requires us to process data otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data-protection law.

You are responsible for having a lawful basis, & any notices or consents needed, for the data you give us.

Only people who need access to run, support or secure the Service can access personal data, & they are bound by confidentiality obligations.

We keep technical & organizational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) & at rest by our hosting & database providers.
• Sign-in & device tokens stored only as one-way hashes.
• Short-lived sign-in links & sessions, & device sign-out that revokes access.
• Access limited to the people who need it, with strong authentication on our provider accounts.
• Card data handled only by our payment provider, which is PCI DSS certified.
• A design that keeps customer content on customer devices instead of our servers.

You authorize us to use subprocessors in the following categories:

• Hosting & infrastructure, for running the website & storing account & sign-in records.
• Payments, for processing payments, invoices & subscription management.

Contact our team for the current list of subprocessors & where they process data.

We impose data-protection terms on each subprocessor that are at least as protective as this Addendum, & we remain responsible for their work. We will give you at least 30 days’ notice by email before adding or replacing one. If you object on reasonable data-protection grounds, we will try to resolve it; if we cannot, you may cancel the affected Service & receive a pro-rated refund of prepaid fees for it.

Personal data may be processed in the United States. Where a transfer of personal data from the EEA, Switzerland or the UK needs a safeguard, the European Commission’s Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) apply & are incorporated by reference, together with the UK Addendum for UK transfers. Clause 7 does not apply, Clause 9 option 2 applies with the notice period above, Clause 11’s optional wording does not apply, & Clauses 17 & 18 select Irish law & the courts of Ireland. The details in Details Of The Processing & Security Measures complete their annexes.

Taking into account the nature of the processing, we will help you answer requests from data subjects, carry out impact assessments & consult regulators where required. If we receive a request directly from one of your users, we will pass it to you & not answer it ourselves unless you ask us to or the law requires it.

We will notify you without undue delay, & in any event within 72 hours, after becoming aware of a personal data breach affecting your personal data. We will share what we know about its nature, likely effects & the steps we are taking, & update you as we learn more.

When your account is closed, we delete the personal data we process for you within 30 days, unless the law requires us to keep it. Before then you can ask us for a copy. Backups are overwritten on their normal cycle. Data on your own computers is under your control & is not affected.

We will make available the information reasonably needed to show we comply with this Addendum. If that is not enough, or a regulator requires it, you may audit our compliance once a year with 30 days’ written notice, at your cost, during business hours & under confidentiality terms. We may answer first with our providers’ current security certifications & reports.

This Addendum is part of the Terms of Service & takes effect automatically when you accept them. The liability limits in the Terms apply to it, unless the law does not allow it. If this Addendum conflicts with the Terms, this Addendum wins for the processing of personal data; the Standard Contractual Clauses win over both.

Need a signed copy for your records? Contact our team & we will send one countersigned.