Privacy notice
Operator: Nadir Ebrahim, operating as Relayfolio
Privacy contact: nadir.ebrahim@gmail.com
Effective: September 20, 2026
Information processed
Google sign-in supplies identity information such as name, email, and account identifier. Workspace users provide company and respondent details, reporting requests, answers, uploaded evidence, and review history. Relay records access relationships, delivery events, authorization grants, and operational events needed to run the service.
Purposes and access
Information is used to authenticate users, coordinate reporting, provide authorized reports and comparisons, send invitations/reminders, and operate and secure the service. Firm members see their authorized workspace; company users see assigned company work subject to their role. Support/operations access is restricted to the operator and service providers needed to supply the service.
Providers and transfers
Current providers include Supabase (authentication, database, and evidence storage), Cloudflare (hosting and DNS), Google (sign-in), Resend (email), and OpenAI (when AI assistance is requested). The Supabase project is in Canada Central; this does not mean all processing by all providers remains in Canada. Provider processing locations and contractual terms must be evaluated for each client's requirements.
AI and MCP
When a user requests AI drafting or analysis, relevant notes, files, questions, or report results are sent to OpenAI. An authorized MCP connection lets an external AI app query scoped report data. Those external apps have their own policies. Revoking a connection stops future queries, not prior copies held by that provider.
Retention and choices
Contact the operator to request access, correction, export, deletion, or account closure. Identity and authority will be verified. Active client data will be deleted within 30 days of an approved deletion request or the end of the pilot, except for documented legal retention requirements. Backup copies expire under their documented retention schedules and are not used for ordinary operations. Any restoration must reapply prior deletion requests. The operator must document the actual backup expiry schedule before onboarding.
Security and incidents
Controls include authenticated access, server-side workspace/role checks, private evidence storage, encrypted transport, and revocable connections. No service can guarantee perfect security. Contact the privacy address for questions, concerns, or suspected incidents.
Cookies
Authentication cookies keep users signed in and select their authorized workspace. This notice does not authorize optional advertising/tracking technologies. Changes in processing require an updated notice and any applicable consent.