Trust & security
What Relay does with your mail
Relay reads a business's customer-support mailbox, drafts replies, and — only when the business has switched it on for a category — sends them. This page says exactly what that involves. It is written to be checked, not to reassure: every line below was verified against the live system on the dates above. If something here is not true of your account, tell us and we will fix the system or the page.
What Relay accesses
The one mailbox you connect, and nothing else in your account.
- Google. The
gmail.modifyandgmail.sendpermissions for that mailbox: read messages, apply labels, write drafts, send. Relay never asks for Drive, Contacts, Calendar or Photos. - Microsoft 365.
Mail.ReadWrite,Mail.Send,offline_accessandUser.Read, granted on Microsoft's own consent screen.User.Readis used only to confirm which mailbox was connected. - IMAP. An app password you create for that mailbox. Connections use TLS.
During onboarding, at your instruction, Relay also reads that mailbox's sent history, to learn your policies and the way you write.
Shopify, if you connect your store. An app made for your store only, with the read_orders permission, which is read-only: it covers your orders of the last 60 days and the customer details on them. Relay uses it only to look up the orders of the customer who wrote, and changes nothing in your store. Uninstalling the app in your Shopify admin ends that access.
Revoking access. From your Google Account's third-party access page (access ends at once); from your Microsoft account's app permissions, or your administrator's Enterprise applications list (access ends when the current token expires, within about an hour); or by changing the IMAP app password (at once). We delete the stored credential on request as well.
What Relay stores
- Your knowledge base. Facts extracted from your website and your past replies, and short passages of those replies used as tone examples, in a database collection that exists only for your account.
- A log of every message handled: what Relay drafted, sent or held, and the reason. The log keeps the draft text. When a message fits no category, the "draft" is a note to your team that includes the customer's message.
- The learning loop. The customer's message, Relay's draft and the reply your team actually sent, paired per conversation, so Relay can learn from the difference.
- Bookkeeping. The IDs of messages already processed, so nothing is handled twice; a ledger of every send, so a retry can never send the same reply twice; and a cost line per message.
- Diagnostics. Records of automation runs are deleted automatically after 7 days.
All of this stays for as long as you are a client and is deleted at the end (see Deletion). Message content lives in Relay's own database and nowhere else: our internal operations spreadsheet receives timestamps, categories and outcomes only. One exception, so it is said: when a message needs a person's attention urgently, the alert e-mail to Relay's founder can include its subject line and an excerpt. The alert also reaches the founder's phone by Telegram; that message carries only the alert's title, which names your account but never a customer or what they wrote.
What Relay never does
- It never uses your emails, or your customers' emails, to train any model. Our model providers are used through their business APIs, whose terms exclude the data from training.
- It never sends anything you have not switched on. Automatic sending is off when you start and is enabled per category. Returns and refunds, cancellations and complaints are always held for a person, whatever the confidence.
- It never answers from something it cannot find in your own material. It holds the draft for a person instead.
- It never denies being automated. If a customer asks whether they are writing to a person, that reply is handed to a person.
- It never deletes a customer's message. In Microsoft 365 and IMAP mailboxes Relay moves nothing and deletes nothing. In Gmail, messages Relay classifies as spam are moved to Trash, where Gmail keeps them for 30 days.
Who processes your data
Relay runs on one server and uses the providers below, each only for the purpose stated. No other party receives your data. Terms for any of them on request.
| Provider | What it does for you | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts the Relay server: the automation platform, the database with your log and credentials, and the nightly backups. | Falkenstein, Germany |
| Backblaze, Inc. | Holds an off-site copy of the nightly backup bundle. The bundle is encrypted on the Relay server before it leaves; Backblaze never holds the key and cannot read it. Copies are deleted after 30 days. | Amsterdam, Netherlands |
| Anthropic, PBC | Reads each message to classify it, drafts the reply, checks the draft before anything sends, and extracts facts from your site and past replies. | United States |
| OpenAI, L.L.C. | Turns text into embeddings so the right fact can be found: the customer's question at reply time, and passages of your site and past replies during onboarding. Nothing else. | United States |
| Qdrant Solutions GmbH |
Stores your knowledge base: the embeddings and the text they were made from, in a collection isolated per client. | Sydney, Australia (Google Cloud, australia-southeast1) |
| Google LLC / Microsoft Corporation |
Your own mailbox, under your own consent. Google also relays notifications that new mail has arrived (message identifiers only) and hosts Relay's operations spreadsheet (timestamps, categories, outcomes — no message text). | Their infrastructure |
| Stripe, Inc. | Billing, once card payments are switched on (they are not yet). Relay never sees your card details. | United States |
| Netlify, Inc. | Hosts this website and the dashboards as static pages. Dashboard data is fetched from the Relay server and is not stored on Netlify. | United States |
| Shopify Inc. |
Looks up a customer's own order from the email address or order number in their message, to answer with its status and tracking. Read-only, orders of the last 60 days; an order placed under another email address is never described. | Canada / United States |
Transfers outside the European Economic Area are made under the European Commission's Standard Contractual Clauses in each provider's data-processing terms.
Deletion
Disconnect at any time, as described under access. On request we run the deletion procedure: your knowledge base and tone examples, the handling log, the learning-loop records, dry-run results and every stored credential are deleted within 7 days, and you receive a confirmation by email with an export of your knowledge base. What remains: one cost line per message with no content in it, the business record needed for invoicing, and the encrypted backups, which roll off after 14 days on the server and after 30 days in the off-site copy.
Security
- In transit. TLS on every connection: to your mailbox, to the providers above, to the dashboards, and for administrative access to the server.
- At rest. Mailbox credentials are encrypted in the database with a key that is not stored in the database. The automation platform's own credential store and the nightly backups use AES-256.
- One server, one administrator. Access is by SSH key only; password logins are disabled; a host firewall allows only web traffic and SSH; repeated failed logins are banned automatically.
- Isolation. Your knowledge base is its own collection. A query for one client cannot return another client's data.
- Send safety. Every send is idempotent: a ledger claims the message before sending, so a retry can never send the same reply twice. A kill switch pauses all automatic sending for your account; one email to us and it is off the same working day.
- Backups. Encrypted nightly, copied off-site the same night, and tested every week by an actual restore.
- What we do not have yet. Relay is run by one person. There is no SOC 2 report and no third-party penetration test.
Security or privacy incidents: sales@relaymailz.com. In the event of a breach affecting your data we investigate, revoke affected credentials, and notify you and the relevant supervisory authority without undue delay, and within 72 hours where the law requires it.
AI disclosure
Replies are drafted by an AI system and reviewed under rules the business sets. If a customer asks whether they are talking to a person, Relay does not deny it and hands the conversation to a person.
More
The legal version of this page is the Privacy Policy, which forms part of the Terms. Questions, or a copy of any provider's terms: sales@relaymailz.com.