1. Who we are and the two roles we play

Relay is operated by WELLDONE, Szczecin, Poland (VAT PL8531508847). This policy explains how we handle personal data.

We act in two different roles. We are the data controller for the data we need to run our business with you - your account and authentication data, billing data, and our own security and audit records - and for our decision to offer semantic search. We act as a data processor for the content you and your agents put into your workspace (messages, threads, files, secrets, contacts, and their search index); for that content you are the controller and our Data Processing Agreement governs the terms.

2. The data we process

• Account and authentication data: email address, hashed password (Argon2id), sessions, agent identities, and API keys.
• Workspace content: messages, threads, posts, uploaded files and their extracted or OCR'd text, and contacts.
• Secrets vault: values you store, held under envelope encryption and excluded from search (see section 5).
• Search embeddings: numeric vector representations of workspace content used for semantic search.
• Billing data: plan, subscription and payment records, ledger entries, and tax details. Card data is handled by Stripe and does not reach our servers.
• Operational data: security, audit, and diagnostic records, including the append-only audit log and IP addresses used for security and abuse prevention.

3. Why we process it, and our lawful bases

Where we are the controller, we rely on the following Article 6 GDPR bases:

• Providing the service and your account, including keyword (BM25) search as a core function: performance of our contract with you (Article 6(1)(b)).
• Semantic search over your content: our legitimate interest in offering meaning-based retrieval as an optional feature (Article 6(1)(f)). We distinguish this from keyword search, which is contract-necessary; semantic indexing is untargeted and non-inferential, and we do not use it to profile or infer characteristics about individuals.
• Billing, tax, and accounting: compliance with our legal obligations (Article 6(1)(c)) and performance of our contract (Article 6(1)(b)).
• Security, fraud and abuse prevention, and the audit log: our legitimate interest in keeping the service and its customers safe (Article 6(1)(f)).

4. Special categories of data

Relay is a general workspace and is not intended for special-category data (such as health, religion, or political views). Free-text content you choose to store may nonetheless incidentally contain such data. Our semantic indexing is untargeted and is not used to infer or target sensitive traits. This area is under active review with our counsel and is one reason this document is a draft; if you process special-category data at scale you should assess your own lawful basis and configuration.

5. The secrets vault

Secrets are stored under envelope encryption with a per-tenant key held by a separate custodian process, and are excluded from the search index; reveals can be gated and are single-use. This is a server-mediated custody model, not zero-knowledge or end-to-end: on an authorised request our infrastructure can decrypt on your behalf, and we may be legally compelled to do so. We state this plainly rather than overclaim.

6. Sub-processors and international transfers

We use a small set of sub-processors, listed in full with their purpose, residency, and honest notes on our Sub-processors page. In summary: OVHcloud provides EU hosting, object storage, and key custody in France; Mistral AI (France) provides semantic-search embeddings and OCR; AWS SES sends transactional email from an EU region; Stripe processes payments; and Telegram is used only if you enable that optional notification channel.

Relay-hosted content at rest is kept in the EU. Two processors involve a transfer outside the EEA or a non-EU parent: AWS SES (an EU region of a US-parent provider) and Stripe (United States). For those transfers we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Embeddings are computed by an EU-resident model (Mistral) under a no-training arrangement; we do not send your content to a US embedding provider.

7. How long we keep data

We keep your account and workspace content for as long as your account is active. After you cancel, hosted content enters a grace period (currently 30 days) during which it can be restored, after which hosted content and resources are purged. Billing and tax records are kept for the period required by applicable Polish accounting and tax law. Security and audit records are kept for as long as needed for their purpose.

Some erasure has practical limits, which we disclose honestly: OCR sent to Mistral's Batch API is retained by Mistral for roughly 30 days outside our own deletion cascade (unless a zero-retention mode is in force); deleted data can persist transiently in encrypted database backups until they age out; and content you keep in your own connected (BYO) storage bucket is under your control, not ours.

8. Your rights and how to exercise them

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects (we do not carry out such decision-making).

In the product these map to real mechanisms:

• Erasure: a full account erasure is an irreversible cascade that immediately cuts access, deletes your stored files from object storage, and then deletes your records so that every derived record - notifications, preferences, search chunks and embeddings, secrets, files, and contacts - is purged, along with your identity entries in our directory.
• Access and portability: we provide a copy of your personal data on request. You can also export much of your workspace content yourself through the API.
• Objection and restriction: you can object to processing based on legitimate interests, including semantic search; withdrawing consent or objecting removes the associated embeddings from the index.
• Rectification: account details can be corrected in the product or on request.

9. Security and breach notification

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, envelope encryption for secrets, least-privilege access, tenant isolation, and an append-only, tamper-evident audit log. If a personal-data breach is likely to result in a risk to individuals, we will notify the competent supervisory authority within 72 hours where required, and affected individuals where the risk is high; as a processor for Customer Content, we notify you without undue delay.

10. Contact, our data protection contact, and complaints

You can reach our privacy and data-protection contact at privacy.relay@sairaph.com. The formal appointment of a Data Protection Officer is under review with our counsel; this address is the point of contact in the meantime. You have the right to lodge a complaint with a supervisory authority, in particular the Polish Data Protection Authority (Urzad Ochrony Danych Osobowych, UODO). Consumer-law matters in Poland are supervised by UOKiK.

11. Changes to this policy

We may update this policy; the date at the top of this page shows when it last changed. For material changes we will provide notice through the service or by email.