Privacy policy
In short: we don’t keep an archive of your conversations, we encrypt anything sensitive with a separate key for every business, our servers are in Germany, and we don’t sell data or use it for advertising or to train AI.
1. Who we are
Relay · app.relaygoo.com · relaygoo91@gmail.com. The provider’s full details (legal name, VAT number, address) will be published here before any charge.
2. Our two roles
- For your account data (name, email, sign-ins) we are the controller.
- For your customers’ messages and details, the controller is the business that uses Relay. We process them on its behalf, as processor, as set out in the Terms of service.
3. What data we process
Your account
- Name, email, business name and language.
- Your password, only in a form that can’t be reversed (a hash).
- When you accepted the terms, and which version.
- The secret for two-step sign-in, encrypted.
Sign-ins and security
- For each sign-in to the app: IP address and browser.
- A security log, such as sign-up, password resets, and changes to two-step sign-in and to AI keys, with the time and IP address.
Your channels
- The tokens, passwords and keys of your channels and alert destinations, and the keys of the linked WhatsApp device. All encrypted.
- Your own AI key, if you add one, encrypted. The app shows only its last four characters.
Your customers
- Contacts: name, phone number, username or email, country and language where known, your tags and notes, and when they wrote or you answered.
- Messages: the text passes through Relay so that you can see it, your automations can run and the assistant can answer. We don’t keep an archive of the conversations. We keep, encrypted, only:
- up to the 50 most recent messages of each conversation, for up to 48 hours;
- the assistant’s suggested replies, for 24 hours;
- the messages you schedule, until they are sent;
- if the assistant’s style learning is on, up to 12 short “customer question, your answer” pairs, for up to 60 days.
- To answer, the assistant may also read older messages of the conversation, up to 6 months back, directly from the channel where it allows this. We don’t store them.
- For each message we keep details without its text (time, channel, direction, type) for statistics, and the history of the automations that ran.
The assistant and your settings
- What you write for the assistant (prices, opening hours, policies), your automations and your settings.
- Daily AI usage counters, without text.
- The emails we send you about your account, such as confirmation, approval and password reset.
4. Why, and on what legal basis
- To provide the service you asked for: performance of a contract (GDPR Article 6(1)(b)).
- For security, preventing abuse and fixing problems (security log, IP addresses, limits): legitimate interests (Article 6(1)(f)).
- For account and service emails: performance of a contract. We don’t send marketing emails without your consent.
- Once charging starts, for invoicing and accounting: legal obligation (Article 6(1)(c)).
- We process your customers’ data on your behalf. You, as controller, decide the legal basis.
5. Where it is and who receives it
| Who | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Our servers, database and backups. | Germany (EU) |
| Anthropic | Relay’s AI (Claude). It receives what is needed each time the AI is used (replies, suggestions, summaries, automations with AI): the conversation’s messages, the contact’s name, and the assistant’s knowledge and instructions. | USA |
| Google (Gmail) | Sends our emails. | USA and EU |
| Cloudflare | Only our domain’s DNS. Traffic doesn’t pass through it. | USA and EU |
- If you connect your own AI account, the same data goes to the provider you chose (Anthropic, OpenAI or Google) instead of Relay’s AI, under your own agreement with them. On Gemini’s free tier, Google may use the content to improve its products; for customer messages, use a paid account.
- The channels you connect (WhatsApp/Meta, Telegram, Viber, your email provider, Slack, Discord) and the webhook addresses you set receive what Relay sends through them, by your choice and under their own terms.
- Where data is transferred outside the EU, the transfer uses the GDPR’s safeguards: an adequacy decision, such as the EU–US Data Privacy Framework, or standard contractual clauses.
- We don’t sell data. We give data to authorities only when the law requires it.
6. How long we keep it
| Data | Kept for |
|---|---|
| Recent messages (encrypted) | Up to 48 hours, up to 50 per conversation |
| Suggested replies | 24 hours |
| Scheduled messages | The text until sent; the record is deleted 30 days later |
| The assistant’s style examples | Up to 60 days, up to 12 pairs |
| Message details without text | 90 days |
| Automation history | 30 days |
| Security log | 12 months |
| Sign-ins (IP, browser) | Until the sign-in expires, at most 30 days |
| Server logs | Small fixed size; older entries are deleted automatically |
| Account, contacts, knowledge, settings | While the account exists, and up to 30 days after it closes |
| Backups | 14 days |
7. Security
- All traffic to the app goes over HTTPS.
- Messages, passwords, tokens and keys are encrypted with a separate key for every business. Those keys are protected by a master key that isn’t kept in the database.
- Every business is isolated inside the database, so it can only reach its own data.
- Passwords only as hashes, two-step sign-in and limits on sign-in attempts.
- Only Relay’s administrator has access to the servers.
8. Cookies
- The app (app.relaygoo.com) uses a single cookie, needed to keep you signed in, for up to 30 days.
- We don’t use advertising or analytics cookies, or any tracking tools.
- The relaygoo.com website uses no cookies and keeps no visitor logs.
9. Your rights
- You have the right of access, rectification, erasure, restriction, portability and objection. You can change most of your details yourself in the app.
- For anything else, write to us at relaygoo91@gmail.com. We answer within one month.
- If you are a customer of a business that uses Relay, please contact that business first. If you write to us, we will pass your request on to it.
- You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority where you live.
10. Minors
Relay is for businesses and isn’t meant for anyone under 18.
11. Changes
Every new version of this policy is published on this page. For material changes we will let you know by email.
This English text is a translation; if the two differ, the Greek text prevails.