This Data Processing Addendum ("DPA") is for business customers who use Relay to process personal data as a controller, for example a company whose staff use Relay for work mail. It adds to our Terms of Service and meets Article 28 of the GDPR and the UK GDPR, and the service provider requirements of US state privacy laws.
1. Parties and acceptance #
This DPA is between diferent LLC, 8 The Green, STE A, Dover, DE 19901, USA ("Processor", "we") and the business customer that uses Relay under the Terms ("Customer", "you"). It applies automatically to a business customer's use of Relay from when it accepts the Terms. If you need a signed copy, email marek@diferentlabs.com with the subject "DPA" and we will countersign this version. If this DPA conflicts with the Terms, this DPA wins for the processing of personal data; the Standard Contractual Clauses win over both.
2. Definitions #
"Data Protection Laws" means the laws on personal data that apply to the processing under this DPA, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws. "Personal data", "controller", "processor", "data subject", "processing", "personal data breach" and "supervisory authority" have the meanings in the GDPR. "Customer Personal Data" means personal data we process on your behalf when providing Relay, as described in Annex I. "Subprocessor" means a third party we engage to process Customer Personal Data.
3. Roles and instructions #
- You are the controller (or a processor acting for your controller) of Customer Personal Data, and we are your processor (or subprocessor). For the data we use to run Relay as our own service (accounts, billing, security, usage and product quality), we are an independent controller, as described in our Privacy Policy.
- We process Customer Personal Data only on your documented instructions. The Terms, this DPA and your use and configuration of Relay (for example, which mailboxes you connect, whether the assistant and read status are on) are your complete instructions. We will tell you if we believe an instruction breaks Data Protection Laws. We may process data without your instruction only where the law requires it, and then we tell you first unless the law forbids it.
- You are responsible for having a lawful basis and giving the notices and obtaining the consents needed for the processing, including, where you use read status or link tracking (both on by default in the apps), any notice to recipients and consent of recipients required by the ePrivacy rules and other laws in the recipient's country.
- For US state laws, we act as your service provider or contractor: we do not sell or share Customer Personal Data, do not retain, use or disclose it for any purpose other than providing Relay to you (or as the law permits), do not combine it with other data except as the law permits, and comply with the applicable requirements. We certify that we understand these restrictions.
4. Confidentiality #
We make sure that everyone authorised to process Customer Personal Data is bound by confidentiality, and that access is limited to those who need it to provide, secure or support Relay.
5. Security #
We implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, costs, and the nature, scope, context and purposes of the processing and the risks. The measures are in Annex II. We may update them, as long as the overall level of protection is not reduced.
6. Subprocessors #
- You give us general authorisation to engage subprocessors. Our current subprocessors are listed on our subprocessors page (Annex III).
- We impose data protection obligations on each subprocessor that are no less protective than this DPA, and remain responsible to you for their performance.
- Notice of changes: we update the subprocessors page at least 30 days before a new subprocessor processes Customer Personal Data, and email business customers who asked to receive these notices (write to us with the subject "Subprocessor notices").
- Objection: you may object to a new subprocessor on reasonable data protection grounds within those 30 days, by emailing us. We will then work with you in good faith on a solution, such as not using the new subprocessor for your data. If we cannot find one, you may end the affected part of the service and receive a refund of the prepaid fees for the remaining period.
7. Assistance #
- Data subject requests: taking into account the nature of the processing, we help you respond to requests from data subjects to exercise their rights. If we receive such a request directly for Customer Personal Data, we pass it to you without undue delay and do not answer it ourselves, except to say it was passed on, unless you ask us to.
- Impact assessments: we give you the information reasonably needed for data protection impact assessments and prior consultations with supervisory authorities.
8. Personal data breaches #
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We tell you what we know about its nature, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed, and update you as we learn more. We take reasonable steps to contain and remedy the breach. Our notice is not an admission of fault.
9. Return and deletion #
Each of your users can delete their Relay account themselves in the app's Settings ("Delete account"). This deletes the Customer Personal Data that account holds on Relay's server and on Relay on the web immediately, as described in section 8.1 of the Privacy Policy. On your request, we delete the Customer Personal Data of the accounts you name in the same way, without undue delay and within 30 days at the latest, unless the law requires us to keep it. Before deletion, you can ask for a copy of the data your accounts hold in a machine-readable format. Mail stays with your mail provider and is not affected. Deleted data can remain in our providers' rolling backups and logs until they age out (up to 30 days for the point-in-time history of Relay's database, up to 7 days for Cloudflare's request logs); it is not used in the meantime, and if a backup is ever restored to recover from a failure, the deletion is applied again.
10. Information and audits #
We make available to you the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires and our subprocessors' available certifications and reports. If that is not enough, you may audit our compliance once a year, with at least 30 days' written notice, during business hours, at your cost, in a way that does not disrupt Relay or compromise other customers' data, and under confidentiality. We do not currently hold independent security certifications ourselves.
11. International transfers #
We may transfer Customer Personal Data to the United States and to the other countries listed in Annex III. Where Data Protection Laws require a transfer mechanism for a transfer from the EU, EEA, UK or Switzerland, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914) are incorporated into this DPA by reference, as follows:
- Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor; you are the data exporter and we are the data importer.
- Clause 7 (docking clause) applies. In Clause 9, option 2 (general written authorisation) applies, with the notice period in section 6 of this DPA. The optional language in Clause 11 does not apply.
- In Clause 13, the supervisory authority is the one competent for the data exporter. In Clauses 17 and 18, the governing law and courts are those of Ireland.
- Annexes I, II and III of the Clauses are completed by Annexes I, II and III of this DPA.
- UK: for transfers from the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies, with the tables completed by this DPA; either party may end it as allowed by its section 19.
- Switzerland: for transfers from Switzerland, the Clauses apply with the Federal Data Protection and Information Commissioner as the competent authority, Swiss law where required, and references to the GDPR read as references to the Swiss FADP.
We put equivalent transfer safeguards in place with our subprocessors.
12. Liability and term #
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. This DPA lasts as long as we process Customer Personal Data for you.
Annex I: Description of the processing #
| Data exporter | The Customer, as identified by its Relay account. Activities: use of an email app by its staff. |
|---|---|
| Data importer | diferent LLC, 8 The Green, STE A, Dover, DE 19901, USA, marek@diferentlabs.com. Activities: providing Relay. Role: processor. |
| Data subjects | The Customer's users; the people they correspond with (senders and recipients of mail, people named in mail); recipients of tracked mail; recipients of large-file links. |
| Categories of data | Email addresses, names and other contact details; the content of emails and attachments, including any personal data in them; mailbox metadata; contact photos set by users; notes and writing style the assistant learned; read-status events (time, approximate city and country, device type, reading time, links clicked, hashed IP address); large files. |
| Special categories | None intended. Emails may contain special category data sent by or to users; it is processed only as part of the service, with the measures in Annex II. |
| Frequency | Continuous, while the Customer uses Relay. |
| Nature and purpose | Hosting, syncing, caching (Relay on the web), AI processing to summarise, sort and draft, read-status measurement, file delivery, and support, to provide Relay to the Customer under the Terms. |
| Retention | As set out in section 8 of the Privacy Policy, and section 9 of this DPA. |
| Subprocessors | As in Annex III, for the purposes listed there. |
Annex II: Technical and organisational measures #
- Encryption in transit: HTTPS with TLS for the website, the API and Relay on the web; mail connections over TLS by default.
- Encryption at rest: storage encrypted by our providers (Cloudflare D1 and R2, Fly.io volumes). In addition, secrets and personal content kept on Relay's server (synced data, cards, contact photos, descriptions of tracked messages, feedback notes, configuration) are encrypted with AES-256-GCM, with keys derived from a master key held as a secret outside the database. Mailbox passwords and tokens on Relay on the web are encrypted with AES-256-GCM under a key derived per person.
- Minimisation: on Mac and iPhone, mail and mailbox credentials stay on the device (Keychain). IP addresses of readers and users are stored only as salted, truncated SHA-256 hashes. The content of AI requests is not stored by Relay's server. Refresh tokens and session identifiers are stored only as hashes.
- Isolation: on Relay on the web, each person's mail is handled by a separate operating system process with access only to that person's folder (Node's permission model), memory limits and no access to the gateway's secrets; every call is validated.
- Application security: strict content security policies with no inline scripts; email shown in sandboxed frames that cannot run scripts; attachments and large files served as downloads with a sandboxing policy; protection against requests to internal networks; rate limits on sign-in and APIs; limited, unguessable large-file links.
- Access control: production access limited to named administrators, with sign-in through Google and an audit log of administrative actions; sessions can be revoked per device or for a whole account at once.
- Retention and deletion: automatic deletion of expired files, codes, cards and AI call records on the schedules in the Privacy Policy; account deletion, by the user in the app's Settings or by us on request, removes the account's data from Relay's server and Relay on the web at once.
- Resilience: hosting on providers with redundant infrastructure and DDoS protection; monitoring of errors and health checks.
- Vendors: subprocessors chosen for their security practices and bound by data protection terms.
- Incidents: a process to investigate, contain and notify personal data breaches (section 8).
Annex III: Subprocessors #
The subprocessors listed on our subprocessors page, as updated under section 6.