Privacy Policy

1. The two roles, because they are different

Your information. For the account you hold with us (your name, email, phone, billing) we decide how it is used, so we are the controller and this policy governs it.

Your customers' information. The names, phone numbers and messages of the people enquiring about your services come to us because you connected your lead platform. We process that on your instructions, as your processor. You are the controller of it. We do not use it for our own purposes, do not sell it, and do not use it to build products for anyone else.

If one of your customers asks us to delete their information, we will point them to you, and help you act on it.

2. What we collect

When you sign up: your email, name, a hashed password (we never store the password itself), and, if you sign in with Google, the email and name on that Google account.

When you set Relay up: your business name, the services you offer, your hours, your business phone number, notes you write for the AI, and the text of your website if you ask us to read it.

From your lead platform: lead and conversation records: customer name, phone number where the platform provides it, the service requested, location, and the messages exchanged.

If you connect a calendar: access tokens, the address of the Google account, and the free/busy times and events needed to offer and book slots.

If you subscribe: a Stripe customer and subscription reference. Card details go straight to Stripe and never reach our servers.

Automatically: ordinary server logs, including IP address and timestamps, kept for security and debugging.

3. How the AI uses it

To draft a reply we send the conversation, plus the business details and notes you have configured, to our AI provider. We reach models through OpenRouter, which routes the request to the model provider that generates the reply and returns it to us. Depending on the model in use, that provider may be outside the United States.

We configure OpenRouter to exclude providers that train on the prompts they receive, so your conversations are used to answer them and nothing else. We do not use your customers' messages to train any model of our own.

Replies are generated automatically and can be wrong. Every conversation is visible in your dashboard, and you can take over or switch the AI off at any point.

4. Who else sees it

We share information only with the providers that make the service work:

We may also disclose information if the law requires it, or to protect the safety and rights of people using the service. If the business is ever sold or merged, information may transfer with it, and we would tell you first.

We do not sell personal information, and we do not share it for advertising.

5. Text messages

We text you about your leads only if you gave consent: by ticking the box during setup, next to wording that says so. We record when you agreed and the exact wording you saw.

Messages tell you what a customer said or what Relay replied, and let you answer by text. Frequency depends on your lead volume. Reply STOP at any time to stop them, or HELP for help. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your number goes to Twilio, our messaging carrier, for the sole purpose of delivering the messages you asked for, and nowhere else. Sharing with subcontractors who provide support services on our behalf is limited to exactly that purpose.

6. Where it is kept, and for how long

Data is stored on servers we operate in the United States. Our providers may process it elsewhere under their own terms.

We keep your account and lead data for as long as your account is open. When you close it, we delete the account and everything attached to it (leads, conversations, appointments, alerts) within 30 days, except where we must keep records longer (invoices, for instance, for tax purposes). Ask us and we will confirm when it is done.

Server logs are kept for up to 90 days. Password reset links expire after one hour.

7. How it is protected

Traffic is encrypted in transit. Passwords are stored as salted hashes, never in a form we can read. Access tokens for your connected accounts are encrypted before they are written to the database. Every incoming webhook is signature-verified before we act on it, and every part of the app that touches your data requires you to be signed in.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information we will tell you without undue delay.

8. Your choices

You can, at any time:

• See and edit your details in the app
• Disconnect your lead platform or calendar
• Turn off the AI, per customer or entirely
• Stop the texts by replying STOP
• Ask for a copy of your data, or for your account to be deleted

Depending on where you live, you may also have rights to correct, restrict or object to our use of your information, and to complain to a regulator. Email us and we will action it. We do not charge for this, and we will not treat you differently for asking.

9. Children

Relay is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

10. Changes

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always reflects the current version.

11. Contact

Click&Fix Tech LLC, Maryland, USA. [email protected]