Privacy Policy

This Privacy Policy explains how Relayys, Inc. (“Relayys”, “we”, “us”) handles personal data. Because of what Relayys does — ad-fraud prevention and revenue attribution — we handle data in two distinct legal roles, and your rights differ depending on which one applies to you:

• As a controller — for data about visitors to relayys.com, people who join our waitlist or buy early access, demo bookers, and our customers and their team members. This policy governs that data directly.
• As a processor / service provider — for data about visitors to our customers'websites (“End Users”), collected via the Relayys pixel our customers install. We process this data on our customers' documented instructions. The customer whose site you visited is the controller, and their privacy notice governs.

If you are an End User — you landed on a website that uses Relayys — please direct privacy requests to the operator of that website. We support them in fulfilling your rights, and Section 6 explains what the pixel collects.

• Waitlist and early access: name, email address, phone number (optional), and role/company type, when you submit the form on our book-demo page.
• Payment data: when you buy early access or a subscription, payment is handled by our merchant of record, Dodo Payments. We receive your name, email, payment status, and a payment reference — never your full card number.
• Account data: name, email, organization details, and authentication data managed via our sign-in provider when you create an account.
• Usage and device data: log data, IP address, browser type, and pages viewed on relayys.com, used for security and to improve the site.
• Communications: emails and messages you exchange with us, including onboarding-call scheduling and reminders.

• Provide the Services — accounts, dashboard, support, onboarding. Legal basis: performance of a contract.
• Process payments and prevent fraud on our own checkout. Legal basis: contract and legitimate interests.
• Waitlist and launch communications — emailing you when your spot opens, booking your demo, sending reminders you asked for. Legal basis: contract / consent.
• Product improvement and security — debugging, abuse prevention, aggregate analytics. Legal basis: legitimate interests.
• Legal compliance — tax, accounting, responding to lawful requests. Legal basis: legal obligation.

We do not sell personal data collected as a controller, and we do not use it for third-party advertising.

We share personal data only with service providers that help us run Relayys, under contracts restricting their use of the data:

• Convex — database and backend hosting (waitlist, account, and application data).
• Clerk — authentication and account management.
• Dodo Payments — merchant of record; processes payments, taxes, invoices, and refunds under its own privacy policy.
• Cloud hosting and email providers — to serve the website and send transactional email.

We may also disclose data to comply with law, enforce our terms, or in connection with a merger or acquisition (with notice where required). We will update this list as our subprocessors change; customers with a DPA can subscribe to change notifications by emailing sales@relayys.com.

We are a US-based company and process data in the United States and other countries where our subprocessors operate. Where we transfer personal data from the EU/UK/Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. You can request a copy of the relevant safeguards at sales@relayys.com.

When installed on a customer's site, the Relayys pixel collects, on that customer's behalf:

• advertising click identifiers (e.g. gclid, fbclid) and landing-page URL parameters;
• IP address, user-agent, device and browser characteristics;
• behavioral telemetry used for bot detection — scroll depth, mouse-movement entropy, typing velocity, form-fill timing, honeypot interactions;
• conversion events and, where the customer connects billing data (e.g. Stripe), associated revenue values;
• a first-party identifier (cookie or similar) used to connect a click to a later conversion.

We use End User Data onlyto provide the Services to the customer: scoring traffic, filtering invalid clicks, matching revenue to clicks, and — at the customer's direction — sending verified conversion events to advertising platforms such as Google Ads and Meta. Under US state privacy laws (including the CCPA/CPRA), routing conversion signals to ad platforms may qualify as “sharing” — the customer, as the business, is responsible for offering End Users the required opt-outs, and we honor opt-out signals the customer passes to us.

We act as a “service provider”/“processor” for this data: we do not sell it, use it to profile individuals across unrelated customers, or use it for our own advertising. We may derive aggregated, de-identified fraud statistics that identify no individual.

• Waitlist and marketing data: until you ask us to delete it or 24 months of inactivity, whichever is first.
• Account and billing records: for the life of the account plus the period required by tax and accounting law (typically 7 years for financial records).
• End User Data processed via the pixel: for the customer's subscription term, per their instructions, and deleted or returned within 30 days of a verified request or contract end unless law requires longer.
• Server logs and security data: typically 12 months or less.

We use encryption in transit (TLS), access controls, least-privilege infrastructure, and vetted subprocessors to protect personal data. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and regulators as required by law.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; to withdraw consent; to opt out of “sale” or “sharing” of personal data; and to not be discriminated against for exercising these rights.

To exercise a right, email sales@relayys.com. We will verify your identity and respond within the time required by law (30 days under GDPR, 45 days under CCPA, extendable once). You may use an authorized agent where the law allows. If we hold your data as a processor for one of our customers, we will refer your request to that customer and assist them in fulfilling it.

EU/UK residents may lodge a complaint with their supervisory authority. California residents: we do not sell personal data we control, and we do not knowingly collect data of consumers under 16.

The Services are business tools and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact sales@relayys.com and we will delete it.

See our Cookie Policy for details on cookies and similar technologies used on relayys.com and by the Relayys pixel.

We may update this policy from time to time. Material changes will be announced by email or in-product notice before they take effect, and the “Last updated” date above always reflects the current version.

Privacy questions and rights requests: sales@relayys.com. General legal: sales@relayys.com.