Privacy Policy

1.1RelayHand LLC, a Tennessee limited liability company, operates the RelayHand platform. In this policy “RelayHand,” “we” means that company.

1.2Contact us about privacy at privacy@relayhand.com or by post at RelayHand LLC, [REGISTERED BUSINESS ADDRESS — to be completed on formation].

2.1Businesses that use RelayHand — contractors and their team members. This policy describes what we collect from and about you, and why. We are the controller of that information.

2.2Customers of those businesses — homeowners and other clients whose details a contractor keeps in RelayHand. We hold that information for the contractor and act only on their instructions. We are a processor, not a controller. §3 and §8 explain what that means for you.

2.3Visitors to relayhand.com who are neither of the above.

3.1Account Data is information about the business using RelayHand and the people on its team. We decide what to collect and why, and this policy is our notice to you about it. Under the CCPA and comparable state laws we are the business for Account Data.

3.2Customer Data is information a contractor puts into, or generates through, their RelayHand workspace about the people they serve — names, addresses, phone numbers, email addresses, property photographs, quotes, contracts and signatures, message and call logs, call transcripts, payment records and job notes. The contractor decides what is collected, what it is used for and how long it is kept. We only store and process it on their documented instructions. Under the CCPA and comparable state laws we are a service provider for Customer Data, engaged under the Data Processing Addendum.

3.3What this means if you are a homeowner. We do not have a relationship with you, and in most cases we cannot identify which contractor holds your record without being told. The contractor who took your details is responsible for telling you what they collect and why, for having a lawful basis to contact you, and for honouring your requests. If you write to us, we will pass your request to the relevant contractor and support them in answering it; we will not act on their data on our own initiative except where a law requires it.

3.4We do not use Customer Data for our own purposes. We do not sell it, share it for advertising, combine it across contractors, use it to build our own marketing lists, or use it to train machine learning models. See §6 and §7.

4.1Information you give us. When you create an account and set up a workspace: your name, email address, password (stored only as a hash by our authentication provider), business name, business phone number and address, trade, sending email address, logo, and the tax or registration details required to register a messaging brand — which for 10DLC registration includes your EIN.

4.2Billing information. Plan, seat count, subscription status and payment history. Card details are collected and held by Stripe. We never see or store a full card number.

4.3Information collected automatically. IP address, browser and device information, pages and features used, timestamps, and error and performance diagnostics. We use this to operate and secure the Service, diagnose problems, and understand which features are used.

4.4Records of legal acceptance. When you accept these documents we record which document, which version, the date and time, your IP address and your browser's user-agent string. We keep these for as long as you have an account and for six years afterwards, because their only purpose is to evidence what was agreed if that is ever disputed.

4.5Support and correspondence. What you tell us when you contact us, and our replies.

4.6Third-party connections. If you connect Stripe, QuickBooks Online, Google or Telnyx, we store the identifiers and access tokens needed to operate the connection. We hold tokens, not your passwords for those services. Access tokens for accounting connections are additionally restricted at the database column level so that they are not readable through the ordinary application interface.

4.7Why we process Account Data. To provide and secure the Service; to bill you; to communicate about your account and about changes to these documents; to provide support; to detect, investigate and prevent fraud, abuse and security incidents; to comply with legal obligations; and to establish or defend legal claims. Where a law requires a legal basis, ours is performance of our contract with you, our legitimate interests in operating and securing the Service, and compliance with law.

5.1We process Customer Data only to provide the Service to the contractor: storing records, rendering and delivering documents, sending the messages they direct, processing the payments they initiate, generating the AI output they request, and producing the reports and logs they read.

5.2Some categories are worth naming explicitly because of what they are:

• Property photographs uploaded by a contractor or their field crew, stored in private buckets and served through expiring links.
• Message content and delivery status for every SMS and email sent or received through the Service, kept as the contractor's communication log.
• Call recordings and transcripts where a contractor enables the AI receptionist. Whether recording is lawful, and whether the caller was given the notice their state requires, is the contractor's responsibility, not ours.
• Signed contracts and amendments, retained as rendered at signature together with a cryptographic hash, so that what was signed can be shown not to have changed.
• Payment records and card mandates — the authorization to charge a stored card. The card itself is held by Stripe; we hold a reference to it.

5.3Retention is the contractor's decision. We keep Customer Data for as long as the contractor's account is active, plus the windows described in the Terms and the Data Processing Addendum. A contractor can delete records at any time. Signed-document archives and suppression-list entries are retained as described in §9.

5.4Isolation between contractors. Every record carries the organization it belongs to, and database row-level security enforces that boundary independently of the application. One contractor cannot read another's data.

6.1Certain features send content to third-party AI providers to produce a result you asked for: drafting a follow-up message, extracting lead details from a call transcript, and answering an MCP client's request.

6.2Neither we nor our AI providers use your content to train models. Our providers are engaged under terms that prohibit training on customer content. Content is transmitted to produce the requested output and is not retained by us beyond the record the feature creates in your workspace.

6.3AI features are off unless a contractor turns them on, and what an AI client may do in a workspace is controlled by that workspace's own settings. Actions taken by AI that create, send or charge are recorded in an append-only audit log the account owner can read.

7.1We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA and comparable state laws. We have not done so in the preceding twelve months. We do not serve third-party advertising and we do not run advertising trackers on the application.

7.2Subprocessors. We share information with the service providers needed to operate the platform — hosting, database, payments, messaging, email, AI and accounting integration. Each is engaged under terms restricting them to processing on our instructions. The current list, with what each one receives, is at relayhand.com/subprocessors.

7.3At your direction. Where you connect an integration or issue a credential to an AI client, information flows to that destination because you asked for it.

7.4Legal and safety. We may disclose information where we reasonably believe it is required by law, subpoena or other legal process, or necessary to protect the rights, property or safety of RelayHand, our customers, or the public. Where we are permitted to, we will tell the affected customer before disclosing their data so that they can object.

7.5Business transfer. If we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of it, subject to this policy or a policy no less protective. We will give notice before your information becomes subject to a different policy.

8.1If you are a business using RelayHand, you may ask us to give you a copy of your Account Data, correct it, delete it, or restrict or object to certain processing. Write to privacy@relayhand.com. We will verify your identity — ordinarily by confirming control of the account email — and respond within the time the applicable law allows, typically 45 days. We will not discriminate against you for exercising a right.

8.2If a contractor holds your details in RelayHand, direct your request to that contractor: they decide what is collected and kept. If you do not know who to ask, or they do not respond, write to us and we will do what we reasonably can to identify the account and pass your request on. We will not delete or alter a contractor's records on our own initiative except where a law requires it of us directly.

8.3Depending on where you live, you may have rights under the California Consumer Privacy Act as amended, the Tennessee Information Protection Act, or a comparable state law — including rights to know, access, correct, delete, obtain a portable copy, and opt out of sale, sharing or targeted advertising. Because we do not sell or share personal information or conduct targeted advertising, there is nothing to opt out of, but the other rights are available as described above. Some states allow an authorised agent to act for you; we will ask for proof of authority.

8.4Appeals. If we decline a request, you may appeal by replying to our decision with the word “appeal.” We will respond within 45 days with our reasoning. Tennessee and several other states also allow you to complain to your state Attorney General.

8.5Messages. You can stop text messages from a contractor by replying STOP to any of them. That opt-out is recorded against the phone number and honoured for that business regardless of whether you are in their customer list. Marketing emails carry an unsubscribe link. We may still send transactional messages about an account you hold with us.

9.1We keep Account Data for as long as your account is open and then as needed to close it out — typically up to 30 days for export, after which it is deleted or de-identified in the ordinary course.

9.2We keep some records longer because we have a legal or evidential need to:

• Billing and tax records — as required by tax law, typically seven years.
• Legal-acceptance records — six years after the account closes.
• Signed-document archives — retained on the contractor's instruction; a signed agreement is evidence and deleting it on request would destroy the record it exists to preserve.
• Suppression-list entries — indefinitely. An address or number recorded as “do not contact” has to outlive the account that recorded it, or the opt-out fails.
• Security and audit logs — up to two years.

9.3Backups follow their own expiry cycle and may briefly contain data already deleted from the live system.

10.1Data is encrypted in transit and at rest. Access is restricted to those who need it. Tenant isolation is enforced in the database itself through row-level security, not only in application code. Files are stored in private buckets and served through expiring links, and payment card data is handled entirely by Stripe so that it never reaches our systems.

10.2Financially sensitive credentials — such as accounting integration tokens — are additionally protected by column-level database grants, so that even a caller with legitimate access to the table cannot read them.

10.3No system is perfectly secure. If we become aware of a breach affecting your information we will notify you and, where required, the relevant regulator, without undue delay. Report a suspected vulnerability to security@relayhand.com; we will not pursue legal action for good-faith research that respects user data and gives us reasonable time to fix the issue.

11.1We use cookies and local storage that are necessary for the Service to work — keeping you signed in, remembering your workspace and theme preference, and protecting against cross-site request forgery. Your theme choice is stored locally so the page does not flash the wrong colour before loading.

11.2We do not use advertising cookies and we do not permit third-party advertising trackers. Where analytics are used, they are limited to understanding how the product is used and are not linked to advertising profiles.

11.3We do not respond to browser Do Not Track signals, as there is no accepted standard for them. We honour Global Privacy Control signals where a law requires it, though as we do not sell or share personal information there is no sale to opt out of.

12.1Children. The Service is for business use and not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, write to privacy@relayhand.com and we will delete it.

12.2Location of processing. We operate in the United States and our infrastructure providers process data there. If you access the Service from elsewhere, your information is transferred to and processed in the United States.

12.3Changes. We will post a new version with a new effective date, and for a material change we will give notice by email and in the Service and ask you to accept it.