Privacy policy
What we collect, why we collect it, who else sees it, and how to make us stop. Written to be read rather than to be defensible.
1. Who we are
RelayPlus (“RelayPlus”, “we”, “us”, or “our”) is a product operated by LETSGATHER APP SOLUTIONS LIMITED. The company builds software that businesses use to talk to their customers on WhatsApp, Instagram and Messenger. Our registered office is 2202-823 Carnarvon Street, New Westminster, British Columbia V3M 0N5, Canada.
Four different relationships are covered by this policy, and it matters which one you are in. If you signed up for RelayPlus, we are the data controller for your account. If you are a customer who messaged a business that uses RelayPlus, that business is the controller of your conversation and we are its processor: we handle your data on their instructions, and they decide how long to keep it. If you visit our marketing website, we are the controller for the website-visit data section 2 describes. If you book a demo with us, we are the controller for your booking details.
2. What we collect
We collect five categories of data and nothing outside them.
- Account data
- Name, work email, phone number, password hash, workspace name, role, timezone and language. Provided by you at signup or by whoever invited you.
- Conversation data
- Messages, attachments, phone numbers, WhatsApp display names, profile photos, delivery and read receipts, and the tags, notes and assignment history your team adds. Received from Meta through the WhatsApp Business Platform.
- Usage and billing data
- Log-in times, IP address, browser and device type, feature usage, conversation counts by country and category, wallet top-ups and invoices.
- Visiting our website
- Pages viewed, including the campaign tags in the link that brought you here, device and browser type, approximate location from your IP address, and the steps you take toward booking a demo, including whether you booked one. The site never sends your name, email, phone number or company. Collected by Google Analytics only as your cookie choice allows, to measure visits.
- Demo booking data
- If you book a demo on relayplus.app: your name, email, company, mobile number and time zone, the time you chose, the page you first landed on and the site that referred you, any reason you give if you cancel, and, when the link that brought you carried them, the campaign tags and Google or Meta click identifiers. Campaign details are kept in your browser for the visit and sent to us only if you book.
3. What we never do
We do not sell personal data for money. We never share data held in RelayPlus (your workspace, contacts or conversations) with advertisers or data brokers. Visits to our marketing website are measured by Google Analytics as §2 and §6 describe. We do not use your conversations to train AI models. RelayPlus does not currently send your messages to any AI model provider; before we add one, we will name it on our subprocessors page and update this policy. We do not read your conversations except when you ask support for help with a specific thread and grant temporary access, which is logged and expires after 72 hours.
4. Why we process it
Under GDPR terms, our lawful bases are:
- Steps at your request before a contract: arranging and running a demo you booked, and emailing you about it.
- Contract: running the service you subscribed to (delivering messages, storing conversation history, billing you).
- Legitimate interest: keeping the service secure, preventing abuse and fraud, producing aggregate product analytics that never identify an individual, learning which campaign or page led to a demo booking, and keeping a record of demos we have held.
- Consent: optional product emails and, separately, the marketing messages a business sends to its own customers. Consent for those is collected and evidenced by the business, not by us.
- Legal obligation: retaining invoices and tax records, and responding to lawful requests from authorities.
- Website measurement: consent in the EEA, UK and Switzerland, and legitimate interest with an opt-out elsewhere.
5. Who we share it with
We use three subprocessors, each under a data processing agreement. The full list, with what each one receives, is at relayplus.app/subprocessors, and we give 30 days notice before adding one.
- Meta Platforms: message delivery through the WhatsApp Business Platform, Instagram messaging and Messenger. Unavoidable; it is the channel.
- Our cloud infrastructure provider: hosting, managed databases and attachment storage.
- Google (Google Workspace): transactional email (sign-in links, invitations, account notices and demo booking emails) and, for a demo you book, the calendar event and Google Meet link. The event holds your name, email, company, mobile number and time zone, and, visible only to us, the campaign details from section 2.
7. Where your data lives
Your data is held in a single region on our hosting provider’s infrastructure. We do not currently offer a choice of data region, and we will tell you here before that changes. Transfers out of the EEA and the UK rely on the European Commission’s Standard Contractual Clauses.
Website-visit data collected by Google Analytics is held by Google on its own infrastructure, including in the United States; Google relies on the EU–US Data Privacy Framework (with its UK and Swiss extensions) and standard contractual clauses for these transfers.
8. How long we keep it
These are the retention periods for workspace data. Demo bookings follow a fixed period of our own:
- Conversations
- Deleted 24 months after the last message, permanently and not recoverable.
- Attachments
- Attachment files are removed on request; write to [email protected].
- Deleted contacts
- Contacts are deleted on request by email, within 30 days.
- Audit and consent logs
- 7 years, append-only. Required to prove a customer opted in.
- Invoices
- 7 years, as tax law requires.
- Closed accounts
- Contacts, conversations and messages are erased after the 30-day grace period. Everything else in the workspace (channels, templates, flows, broadcast history, attachment files and export archives) is erased on request to [email protected], except the audit and consent logs and billing records, which we keep for 7 years. Export yourself first. After that we cannot get it back.
- Demo bookings
- The booking record and its calendar event are deleted 24 months after the demo; cancelling does not shorten this. Copies of the emails about your booking stay in our Google Workspace mailbox until we delete them. Ask us at [email protected] and we will delete the booking, the event and those emails sooner.
9. Your rights
Wherever you live, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing based on legitimate interest, and withdraw consent. Californian residents additionally have the CCPA rights to know, delete, correct, and to opt out of sale or sharing. We do not sell personal data for money. Our website uses Google Analytics to measure visits; Google may also use this data under its own policies (https://policies.google.com/technologies/partner-sites). You can opt out with Cookie settings on any page.
Account holders can do most of this without asking: Settings → Data controls has one-click export (JSON of contacts, conversations and messages; CSV of contacts and messages) and a delete-workspace button. For anything else, or if you are an end customer rather than an account holder, use the data deletion page or write to [email protected]. We answer within 30 days, usually within 2 business days, and we do not charge for it.
10. Security
TLS 1.3 in transit, AES-256 at rest. Two-factor authentication available on every plan and enforceable workspace-wide. Role-based access control, with every permission change written to an audit log you can read. If a breach affects your data we will tell you within 72 hours of becoming aware, with what happened and what we are doing about it. No waiting for the legal team to soften it.
11. Children
RelayPlus is a business tool and is not directed at anyone under 16. We do not knowingly collect their data. If a business using RelayPlus has messaged a child and you tell us, we will delete the record and notify the business of their obligation.
12. Changes and contact
We will email every workspace owner at least 30 days before a material change to this policy, and keep previous versions and send them to you on request at [email protected]. Continued use after the effective date means acceptance.
Data protection contact: [email protected]. You can complain to your local supervisory authority at any time, but we would rather you gave us a chance to fix it first.