Relay ERP Privacy Policy

1Our role and your organization's role

Relay ERP lets organizations manage customers, suppliers, inventory, purchasing, sales, invoices, payments, cash accounts, production, approvals, and related business records.

We determine how personal information is used to operate our own business relationship with you, administer accounts, protect the service, respond to enquiries and privacy requests, and operate website analytics and advertising measurement. For those activities, we act as a controller, or the equivalent responsible business under applicable law.

When an organization enters or generates personal information in its ERP workspace, it generally determines the purposes for that processing. The organization is the controller and we act as its processor, or equivalent service provider, to host and process that information on its behalf. This includes processing organization records through an AI feature that the organization authorizes. The organization's instructions and our applicable service and data-processing arrangements govern that processing.

If your employer, customer, supplier, or another organization has entered your information into Relay ERP, its own privacy notice also matters. Contact that organization about its use of your information. You can also contact us; where we act as a processor, we will assist the responsible organization with your request rather than independently decide how to use or delete its records. This does not limit any right you have to contact us or a regulator.

2Personal information we collect

The information involved depends on how you and your organization use the service.

We collect information directly from users, from organizations and their authorized members, automatically through service use, and through the providers described in this policy. An invitation can involve your email address before you have a Relay ERP account.

Providing credentials and essential account information is necessary to authenticate you and provide account access. Information required for a particular ERP operation is necessary to perform that operation. Optional analytics and advertising consent, camera access, and use of the chatbot are separate choices; declining them does not itself prevent use of the core ERP.

Sensitive information and camera access

Free-text fields, custom fields, uploaded material, and AI prompts can contain information we did not specifically request. Only enter information that you are authorized to process and that is needed for the business purpose. Do not enter passwords, authentication secrets, full payment-card details, or unnecessary sensitive personal information into business records or AI prompts. Organizations are responsible for identifying any additional legal conditions that apply to the information they submit.

Camera access is optional and used for barcode scanning. Barcode decoding takes place on your device; the scanner does not upload or retain camera recordings or collect audio. A decoded barcode can be sent to Relay ERP to find a product or complete your chosen operation. Camera access stops when the scanner closes or the page becomes hidden, and you can revoke the permission in your browser or device settings.

3How we use information

We use personal information for the following purposes:

• Provide the service: authenticate users, administer organizations and invitations, enforce permissions, process business operations, generate documents and exports, and provide the optional AI assistance you request.
• Communicate about the service: send invitations, password-reset messages, organization status messages, and other necessary operational communications; respond to enquiries and support requests. We do not currently send marketing emails.
• Protect people and the service: detect and prevent unauthorized access, fraud and abuse; enforce access restrictions; investigate incidents; maintain audit history; and diagnose errors and service failures.
• Understand usage and measure advertising: use Google Analytics to understand visits and interactions, and Meta Pixel for measurement and advertising-related processing, subject to your consent and opt-out choices.
• Meet legal and accountability duties: handle privacy requests, keep required compliance records, respond to valid legal demands, and establish, exercise, or defend legal claims.

For processing where we are a controller and a law requires a legal basis, we rely on:

We assess legitimate interests against individuals' rights and reasonable expectations. Where consent is the legal basis, you can withdraw it without affecting processing that was lawful before withdrawal. An organization is responsible for establishing the legal basis for its ERP records; a user clicking an AI or ERP control does not replace any legal basis required for processing information about other people.

4Google Analytics, Meta Pixel, and your tracking choices

Google Analytics and Meta Pixel are optional tracking services. Our consent controls block them until you agree to the relevant optional processing. Use those controls on Relay ERP to review or change your choice, including declining optional tracking. Simply visiting the site, creating an account, or accepting this policy does not constitute tracking consent.

Google and Meta receive the identifiers and event information needed for the enabled tracking activities. Meta may connect events to a Facebook or Instagram account or other information it holds. A provider can have its own responsibilities for processing that it determines; these activities are also explained in Google's Privacy Policy and Meta's Privacy Policy.

We do not sell personal information for money. However, disclosure of identifiers or events to an advertising provider can be considered sharing for cross-context behavioral advertising, targeted advertising, or a sale under some privacy laws even when no money changes hands. Our no-sale statement does not remove any opt-out right that applies to such processing. You can decline the relevant tracking through our consent controls or contact us to exercise an applicable opt-out right.

Withdrawing consent stops the relevant future optional tracking. It does not automatically erase information already received by a provider; you can request deletion where applicable. See the Cookie Policy for identifiers, storage periods, and further controls.

5Optional Gemini chatbot and ERP analysis

Relay ERP uses Google's Gemini API to provide an optional chatbot and analysis of ERP records. When you request AI assistance, the prompt, relevant conversation context, and ERP information included in the request are sent to Google so it can generate a response. The response can itself contain personal information from that context.

Only request an analysis that you and your organization are authorized to perform. Include only the information needed for that request. Choosing an AI feature is separate from consenting to analytics or advertising and does not authorize unrelated use of your organization's information.

Google also processes information to operate and protect its API. Its published abuse-monitoring policy provides for 55-day retention of prompts, context, and outputs for safety and policy enforcement, with authorized human review of flagged content. This provider retention is separate from our 30-day application-log schedule. Google's Gemini API terms describe its other processing conditions.

AI output is assistance for people to review. We do not use this chatbot to make solely automated decisions about an individual that produce legal or similarly significant effects. If an output contains inaccurate personal information, contact us or the responsible organization to request correction or appropriate restriction of its use.

6Who receives personal information

We disclose information for the purposes in this policy to:

• Your organization and its authorized users. Information is available according to the organization's membership, role, permission, assignment, and approval settings. Authorized users may create exports or download documents. The organization controls its subsequent use and disclosure of those copies.
• Service providers. Providers of hosting and network delivery, databases and caches, storage and backups, transactional email, background processing, monitoring, and support process information needed to perform their services. Where they act as our processors, they must follow the applicable instructions, confidentiality, security, and data-protection requirements.
• Google and Meta. Google provides the analytics and Gemini services described above; Meta provides Meta Pixel. Their roles depend on the activity and applicable terms. Their own privacy notices cover processing they undertake as controllers.
• Password-security services. When the breached-password check is enabled, Have I Been Pwned receives a short prefix of a password hash through our server. The check does not send the password, its complete hash, or your email address. See its Pwned Passwords documentation.
• Authorized personnel and professional advisers. Access is limited to what is needed for service operation, support, security, legal advice, or handling a request.
• Authorities or other recipients when legally justified. We may disclose the minimum information necessary to comply with a binding legal obligation, protect rights or safety, or establish, exercise, or defend legal claims. We assess the legal basis for the disclosure.
• A successor in a business transaction. If a merger, acquisition, restructuring, or transfer of the service occurs, relevant information may transfer with it, subject to applicable law, confidentiality safeguards, and any required notice.

Relay ERP does not currently operate online payment processing or collect payment-card details for service subscriptions. Payment and cashbook records entered into the ERP are business records, which are distinct from us processing an online payment.

7International processing

We operate from Bangladesh and serve users internationally. Information may be accessed or processed in Bangladesh and in other countries where our providers operate, including the United States. A provider's global operations do not constitute a promise of storage in a particular country or a customer-selected data-residency location.

Where applicable law restricts a transfer, we must establish an authorized transfer mechanism and any required additional safeguards before making it. Depending on the circumstances, these can include an applicable adequacy decision, approved contractual safeguards such as the European Commission's standard contractual clauses and relevant UK transfer arrangements, or another specifically permitted legal route. We do not treat acceptance of this policy as blanket consent to international transfers.

Contact us for information about the recipients, locations, and transfer safeguards relevant to your information, or to request an available copy of applicable safeguards with necessary confidential information removed.

8How long we keep information

We retain personal information for the purpose for which it is needed, using the following schedule. A specific legal obligation or a necessary legal hold can require a limited exception, as explained below.

Disabling an account or membership, leaving an organization, archiving a record, or signing out does not itself delete the underlying business or audit records. An organization may need those records to operate, account for transactions, or meet its own legal duties. An individual's request does not authorize deletion of another person's information or an entire organization's records.

Deletion is handled through our privacy-request process, including manual administrative work; self-service deletion of an entire organization is not currently available. We verify the requester's identity and authority and coordinate with the responsible organization where necessary. A legal restriction on erasure must be specific to the information and purpose; historical or audit status alone is not an automatic exemption from privacy rights.

Where information must be retained for a legal obligation, an investigation, or a legal claim, we retain only what is necessary, restrict its use to that purpose, and delete it when the exception ends. We explain a refusal or partial refusal to delete unless the law prevents us from doing so. Genuinely anonymous information may be retained because it no longer identifies an individual.

9Security

We use technical and organizational measures designed to protect personal information, including encrypted connections, protected password storage, access controls, organization isolation, session protections, and controls over file access and diagnostic information. Operational access is limited according to responsibility and need. We use backups and incident-response procedures to support recovery and investigation.

No service can guarantee absolute security. If a personal-data breach occurs, we assess it, take appropriate containment and remediation steps, and notify affected organizations, individuals, or authorities when applicable law requires it. If you suspect unauthorized access, contact contact@relayerp.app.

10Your rights and how to exercise them

Depending on the law that applies, you may have rights to:

• Obtain information about processing and access a copy of your personal information.
• Correct inaccurate information or complete incomplete information.
• Request deletion, restriction, or another legally available limit on processing.
• Receive information in a portable format or have it transferred where the right applies.
• Object to processing based on legitimate interests, including any objection rights that apply to direct marketing.
• Withdraw consent for processing that relies on it.
• Opt out of legally defined sale, sharing, or targeted advertising, and exercise any right to limit certain uses of sensitive information.
• Obtain the protections applicable to significant automated decision-making.
• Complain to a competent privacy or data-protection authority, and appeal a denied request where applicable law provides an appeal right.

Send a request to contact@relayerp.app. Describe the right you want to exercise and provide enough information to locate the relevant account or records. Do not send your password, authentication tokens, or unnecessary identity documents. We may ask for proportionate information to verify identity or an authorized agent's authority. Where a request concerns organization-controlled records, identifying the organization helps us route and resolve it.

We respond within 30 days of receiving a request, or any shorter deadline required by applicable law. Any legally permitted extension, verification requirement, or exception will be explained within the applicable initial response period. We do not restart a statutory deadline merely because our internal verification is incomplete. Eligible deletion is completed within 30 days after verification and confirmation of any required authority, subject to any earlier legal deadline and the limited exceptions in section 8.

Requests are normally free. We impose a fee or decline a request only where the applicable law permits it, and explain the reason. We do not retaliate or unlawfully discriminate against you for exercising a privacy right. Some information is necessary to provide the service, so deleting it or restricting its processing can affect the corresponding feature.

If you disagree with our response, reply to the privacy contact and request a review. You may also complain directly to the competent authority without first contacting us. Where relevant, see the EEA authority directory or the UK Information Commissioner's Office. Rights under applicable Bangladeshi privacy law are also available through the processes above.

11Organization-authorized minors

Relay ERP is a business-management service. We do not impose a single worldwide minimum age for the core ERP, but a minor may use it only through an authorizing organization where that use is lawful. The organization must establish that it has authority to provide the account and process the minor's information, including obtaining and verifying parent or guardian authorization where required. An organization's invitation alone does not replace that authorization.

AI features are also subject to Google's separate Gemini API eligibility requirements. Its current terms limit use to adults and supported regions, and restrict integrations likely to be accessed by people under 18. Parent, guardian, or organization approval cannot override those restrictions. Permission to use the core ERP does not establish eligibility to use Gemini.

If you believe a minor's information has been collected or used without the necessary authority or protections, contact us. We will assess the situation, coordinate with the responsible organization where appropriate, and restrict processing or delete information as required. We do not treat a minor's ordinary service use as consent to optional tracking or as authorization for advertising-related processing that applicable law prohibits.

12Changes and contact

We update this policy when our practices or applicable requirements change. The date at the top identifies the latest version. We provide an appropriate additional notice for material changes and obtain fresh consent before a new use that requires it. A policy update does not retroactively supply consent or override a right that already applies.

For privacy requests, complaints, questions about provider arrangements, or an accessible explanation of this policy, contact: