Privacy Policy

1. Who we are

Controller: [Legal entity name], [Registered address]. Contact: [contact email].

2. What we collect

• Account: your name, email address and password. Supabase Auth stores the password in hashed form. We also record when you accepted the Terms of Service and which version you accepted.
• GitHub: your GitHub account login and identifiers, the installations and repositories you grant the RelayDev GitHub App, and pull request data such as numbers, titles and merge events.
• Customer Content: task titles and descriptions, test definitions, repository code cloned into sandboxes, agent prompts and output, run logs and diffs. This can contain personal data, depending on what you put in it.
• Usage and billing: token usage and cost per run and model, your plan and trial dates. Payment details are collected and stored by Stripe, not by us.
• Security and audit: the audit log (who did what and when), the names and creation or revocation dates of Agent API keys (only a hash of each key is stored), and request logs and IP addresses kept by our hosting provider.
• Errors and crashes: when the web app or the desktop app hits an error, a report with the error message, stack trace, app and browser or system version and the run or project involved goes to our error tracker. Request bodies, cookies, console output and run logs are left out.
• Support access: when a RelayDev administrator opens a support session, the reason, the times and the administrator are recorded. The session shows in the audit log.

3. Why we use it

• To provide RelayDev: create your account, connect GitHub, run agents and show their results. (Contract.)
• To keep the service secure, prevent abuse and keep an audit trail. (Legitimate interests.)
• To keep billing and accounting records. (Legal obligation.)
• To measure product adoption in aggregate, such as how many sign-ups connect GitHub, run an agent or pay. RelayDev administrators see these counts computed from account records. It is not a tracking tool. (Legitimate interests.)

We use no tracking, analytics or advertising cookies, so we do not rely on consent for cookies. See section 7.

4. Who receives it

We share personal data only with the companies listed at Subprocessors, and only to provide the service. We do not sell personal data. We disclose data to authorities only when the law requires it.

5. International transfers

Some subprocessors are based in the United States or process data there. Where personal data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses.

6. How long we keep it

• Account data is kept while your account is active.
• Customer Content is kept while the project it belongs to exists.
• You can delete your account yourself in Settings → Delete account. That deletes your projects and the data in them straight away, and uninstalls the RelayDev GitHub App from your GitHub account or organization. If you ask us by email instead, we delete your personal data within 30 days, except records we must keep by law, such as invoices.

7. Cookies

We use only strictly necessary cookies. We do not ask for consent for them, but visitors in the EU and EEA see a notice about them.

• Supabase Auth session cookies (names start with sb-) keep you signed in.
• rd_impersonation identifies an administrator's open support session. It exists only during that session.
• gh_install_state protects the GitHub App install flow. It expires after 15 minutes.
• rd_cookie_notice remembers that you dismissed the cookie notice. It lasts one year.

8. Security

• Provider API keys and GitHub credentials are encrypted at rest (AES-256-GCM).
• Agent API keys are stored only as SHA-256 hashes.
• Every database table has row-level security enabled. The web app reaches the database only from its server, and the desktop app only through policies limited to your own workspace.
• Cloud agent runs happen in a separate microVM for each run, with outbound network access limited to an allowlist. Git and LLM credentials are added at the network layer and never placed inside the VM. An agent cannot push to your default branch.
• Support access needs a stated reason, lasts one hour and is recorded in the audit log.

No system is perfectly secure. If we learn of a personal data breach, we will notify you as the law requires.

9. Your rights

Depending on where you live, you can ask us to access, correct, delete or restrict the use of your personal data, to receive a copy of it, or to object to our use of it. You can also complain to your data protection authority. To receive a copy of your account data, download it in Settings → Your data. To use the other rights, contact us at [contact email].

If the personal data is part of a project's Customer Content, ask the account owner first. They control that data, and we act on their instructions under the Data Processing Agreement.

10. Children

RelayDev is a business tool. It is not for anyone under 16, and we do not knowingly collect their data.

11. Changes

We will update this policy when our practices change. For material changes we will email the account owner at least 30 days before they take effect.