These are the companies that process personal data for Relay, what each one does, what it receives and where. Each works under a contract that requires it to protect the data and use it only to provide its service to us. This list is part of our Privacy Policy and our Data Processing Addendum.
1. Subprocessors #
| Company | What it does for Relay | Data it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. (USA) | Relay's server (Cloudflare Workers), its database (D1), large-file storage (R2), the emails that carry sign-in codes (Email Service), and the network, TLS and DDoS protection in front of relay.diferentlabs.com. | Everything Relay's server keeps: account, devices, synced data (encrypted), assistant cards (encrypted), usage records, read-status data, large files; AI requests in transit; email addresses and codes for sign-in emails; request metadata such as IP addresses. | Database and file storage in the United States (Eastern North America). Requests are handled in the Cloudflare data center closest to the visitor, worldwide. |
| Fly.io, Inc. (USA) | Hosts Relay on the web (relay.diferentlabs.com/app): each person's process and its disk. | For people using Relay on the web: cached mail, attachments and drafts, the app's database, files added to the composer, encrypted mailbox passwords and tokens, session hashes, request metadata. | Amsterdam, the Netherlands. |
| Anthropic, PBC (USA) | The Claude AI models behind the assistant, drafts, summaries, sorting and AI search, and web search when you ask for it. | The parts of emails, attachments, notes and instructions a request needs. Not used to train models under Anthropic's commercial terms; deleted after a limited period. | United States. |
| Wispr Flow (USA) | Speech to text for dictation, only while Relay offers dictation through Wispr Flow. | Your voice, your name and email address, names of people in the conversation, the recent messages of the conversation (shortened) and the text you have written. Sent from your device directly. | United States. |
| Resend, Inc. (USA) | Backup for sign-in code emails, used only if Cloudflare cannot send one and only while it is configured. | The email address a code is sent to, and the code. | United States. |
2. Merchant of record #
| Company | Role | Data | Location |
|---|---|---|---|
| Stripe, through Link (the Stripe company named in Link's terms at link.com/terms) | Sells Pro as merchant of record through Stripe Managed Payments ("Sold through Link"): checkout, payments, tax, receipts and invoices sent from Link, payment and subscription support, refunds, disputes, the customer portal and link.com. Stripe acts as an independent controller for this, under its own privacy policy. | Name, email address, billing address, payment details, tax details, purchase history. Relay receives the plan, status, dates, country and amounts, never full card numbers. | United States, and other countries where Stripe operates. |
3. Services Relay connects to on your instruction #
These are not our subprocessors: they are services you choose, or that Relay contacts directly from your device. We list them so you know where data goes.
| Service | When | What it receives |
|---|---|---|
| Your mail provider (for example Google, Apple, Microsoft, Fastmail, or any IMAP and SMTP server) | Whenever Relay reads, sends or organises your mail. | Your credentials or tokens, and the mail you send and manage. Your mail lives there, under the provider's terms. |
| Google LLC (sign-in and Gmail) | When you sign in with Google or connect Gmail. Relay's server renews Gmail tokens through Google, without storing them. | The Google sign-in and OAuth requests; Gmail over IMAP and SMTP. |
| Gravatar (Automattic Inc.) and Google's favicon service | To show sender photos, if "Sender photos" is on (default). Can be turned off in Settings. | Gravatar: a SHA-256 hash of the sender's address. Google: the sender's domain name, for business domains only. Both also see the IP address of the device (or, on the web, of our server). |
| GitHub, Inc. | When the Mac app checks for and downloads updates, and when our server reads the latest release. | The IP address of your Mac and standard download requests. |
| Apple | iPhone dictation without Wispr Flow (on-device speech recognition); TestFlight and the App Store. | As described in Apple's terms. |
4. Not used for your data #
Moonshot AI (Kimi models) is used only by our own team, from staff accounts, to compare AI models in internal evaluations. Customers' requests are never sent to it, and the apps cannot call it.
5. Changes to this list #
Before we add or replace a subprocessor that processes customer personal data, we update this page at least 30 days in advance, with the new "last updated" date, and notify business customers who have accepted our Data Processing Addendum and asked to be notified, by email. To ask for these notices, write to marek@diferentlabs.com with the subject "Subprocessor notices". You can object to a change as described in the Data Processing Addendum. In an emergency (for example, to keep Relay secure or available), we may make a change with shorter notice and tell you as soon as possible.