Relay Privacy Policy

Effective date: June 1, 2026
Last updated: June 28, 2026

Relay, LLC (“Relay”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy describes the information we collect when you use the Relay platform (the “Service”), how we use and share it, and the rights you have over it.

By using the Service, you consent to the practices described here. If you do not agree, do not use the Service.

1. Who this policy applies to

This Privacy Policy applies to all users of the Service, including:

• General Contractors (GCs) and Project Managers (PMs) who hold paid subscriptions.
• Subcontractors and Foremen (Subs) who access the Service through a free, one-time-passcode (OTP) sign-in tied to an invited email address.
• Visitors to the Relay website at relayconstruct.com.

2. Information We Collect

2.1 Information you provide directly

• Account information. When you sign up as a GC or PM, we collect your name, email address, password (stored only in hashed form), and any company or profile details you choose to add. If you upload a personal or organization logo for client-portal branding, we store that image.
• Sub/Foreman OTP records. When you access the Service as a Sub or Foreman, we record the email address you were invited under, the OTP codes sent to you, and the session cookie issued when you sign in. We do not store passwords for Sub or Foreman accounts.
• Project Content. Any project data, activity descriptions, dates, schedules, dependency links, change requests, completion confirmations, replies, notes, or files you submit through the Service.
• Punch List items. Punch list titles, descriptions, priority, due dates, status changes, sign-off requests and replies, and the assignee you associated with each item — whether that assignee is a project invitee, a Contact, or an external email address you added inline.
• Contacts (address book). If you add entries to the My Contacts page, we store the organization / business name, first and last name, email, phone, street, city, and state you provide. Contacts are private to your account. We also automatically upsert a contact when you send an invitation or a punch-by-email assignment so your address book grows without duplicate data entry.
• Organization / seat data. If you set up an Organization account, we store the organization name, admin roster, seat plan and quantity, invited operator emails, and the operator roster and their assigned seats.
• Client Portal shares. When you invite a client (for example an owner, adjuster, franchise operator, or the GC on the other end of a delegation) to view a project through the Client Portal, we store the email address and the read-only access grant. Clients who accept an invitation get a Relay client account (email + password) which we treat like any other authenticated identity.
• Collaboration drafts and reviews. If you or a collaborator submit proposed schedule edits through the drafts workflow, we store the draft’s contents, submission and decision timestamps, and the reviewer’s per-operation approvals, rejections, and reply notes.
• In-app feedback. When you use the “Send feedback” form in the account panel, we store your message, the category you chose, and contextual metadata (your role, plan, org, and the page you were on) so we can respond and improve the product.
• Communications. Email correspondence with our support team, invitations sent to your subs or PMs, weekly digest emails, punch and dependency notifications, and notification preferences.

2.2 Information collected automatically

• Usage data. We log events such as sign-ins, project actions, approvals, and feature interactions for the purpose of operating and improving the Service.
• Device and connection data. IP address, browser type, operating system, time zone, referring URL, and similar technical information.
• Cookies and similar technologies. We use a small number of essential cookies to keep you signed in and to remember your preferences. See Section 7 for details.

2.3 Information collected from third parties

• Payment information. Payments are processed by Stripe, Inc. We do not see, store, or process your full credit card number. We receive limited information from Stripe such as your customer ID, last four digits of your card, subscription status, and billing history.
• Email delivery data. Our email provider (Resend) reports delivery, open, and bounce events that help us diagnose deliverability issues.

2.4 Information we do not collect

We do not knowingly collect:

• Social Security numbers, driver’s license numbers, or government IDs.
• Health information, biometric information, or precise geolocation data.
• Information from children under the age of 18 (see Section 11).

3. How We Use Your Information

We use the information described above for the following purposes:

• Provide the Service. Create and maintain your account, display project schedules, send invitations, deliver notifications, process approvals, and operate the cascade engine.
• Process payments. Through Stripe, manage subscriptions, billing, receipts, and renewals.
• Communicate with you. Send transactional emails (OTP codes, invite notifications, account confirmations, billing receipts), respond to support requests, and notify you of material changes to the Service.
• Secure the Service. Detect and prevent fraud, abuse, unauthorized access, or violations of our Terms of Service.
• Improve the Service. Analyze usage trends, fix bugs, develop new features, and measure the effectiveness of the platform. Where we use aggregated or anonymized data for this purpose, it cannot be linked back to you.
• Comply with legal obligations. Respond to lawful requests, enforce our terms, and protect our rights and the rights of others.

We do not sell your personal information.
We do not use your project content to train artificial-intelligence models or to advertise to you.

4. How Information Is Shared Within the Service

Relay is designed around a chain of authority. By using the Service, you authorize the following sharing:

• GC → PM → Sub flow. A GC’s project content (activities, dates, notes) is visible to PMs and Subs invited to that project, scoped to what they have been assigned.
• PM → Foreman flow. When a PM creates sub-activities, the content of those sub-activities is visible to the foremen assigned and to the GC who owns the parent project.
• Sub/Foreman view. A Sub or Foreman sees only the specific activity they were invited to — no other project content.
• Suggestions and approvals. A schedule change suggestion is visible to the User who can approve it (a GC for top-level activities, a PM for sub-activities), along with any reply or note attached.
• Punch list assignments. A punch list item is visible to (a) the User who created it, (b) the project owner and any PM with a sub-activity on the project, and (c) the assignee. When you assign a punch item to an external email address (not a project invitee), that person receives an email with a link to their own dashboard and can update the item’s status; they do not gain access to the rest of the project.
• Contacts. Contacts on the My Contacts page are private to your account. We do not display your contacts to your subs, PMs, clients, or other Users, and we do not use them for any purpose other than autocompleting invite and punch flows for you.
• Organization oversight. If you belong to an Organization, the org’s admins can see a read-only overview of your active projects (top-level activities, dates, progress). Admins do not see sub-activities, punch item details, comments, or attachments. Admins can add and remove seats and invite / remove operators.
• Collaboration drafts. Drafted schedule edits are visible to the draft’s author and to the project owner reviewing them. Reviewer decisions and reply notes flow back to the author. Subs and Foremen do not see drafts until approved edits are published.
• Client Portal shares. A client you invited via the Client Portal sees a read-only high-level view of the project (top-level activities, dates, on-track / delayed status, projected finish, and your logo). Clients do not see sub identities, comments, punch items, drafts, or attachments.

You are responsible for choosing what information to enter and whom to invite. Once you invite someone, they will have access to the information described above within their scope.

5. Third-Party Service Providers

We rely on a small set of trusted vendors (“Service Providers”) to operate the Service. These providers process information only on our behalf and under contractual confidentiality and security obligations.

A change in our Service Providers will not, by itself, change the categories of information we collect. We will update this list as needed when a material change occurs.

6. Other Sharing of Information

We may share your information outside of the chain-of-authority sharing described in Section 4 only as follows:

• With your consent. When you direct us to share information with a third party.
• For legal reasons. When required by law, subpoena, court order, or other legal process; to enforce our terms; to investigate fraud or security incidents; or to protect the rights, property, or safety of Relay, our users, or the public.
• In a business transfer. If Relay is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

We do not rent, trade, or sell your personal information to third parties for their own marketing purposes.

7. Cookies and Similar Technologies

We use a minimal set of cookies that are strictly necessary to operate the Service:

• Authentication cookies — Keep you signed in as you move between pages of the application.
• Session cookies for Sub/Foreman OTP sign-in — Maintain a Sub or Foreman’s authenticated session after they enter their OTP code.
• Preference cookies — Remember small UI choices (e.g., expanded vs. collapsed panels).

We do not currently use cookies for advertising or third-party tracking. If we add analytics or marketing cookies in the future, we will update this policy and provide a cookie banner where required by law.

You can disable cookies in your browser settings, but doing so may make parts of the Service unusable (for example, you may not be able to stay signed in).

8. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. After account deletion:

• Account and project content is deleted within a reasonable wind-down period (typically 30 to 90 days), except where retention is required by law (for example, financial records for tax purposes) or for the establishment, exercise, or defense of legal claims.
• Billing records managed by Stripe are retained according to Stripe’s policies and applicable financial-reporting laws.
• Aggregated or anonymized data that cannot be linked back to you may be retained indefinitely for analytics purposes.

You may export your project data (CSV and PDF) at any time before deleting your account.

9. Security

We take the security of your information seriously and use industry-standard safeguards, including:

• Row-level security (RLS). Every database table that stores user data is protected by RLS policies that prevent users from accessing rows they are not authorized to see, even at the database level.
• Encryption in transit. All connections to relayconstruct.com use TLS (HTTPS).
• Encryption at rest. Data is stored on infrastructure that encrypts storage at rest by default (Supabase / Postgres).
• Authentication. Passwords are hashed using industry-standard algorithms; Sub and Foreman accounts use OTP-only sign-in (no passwords stored).
• Limited access. Only authorized personnel can access production systems, and access is logged.
• SOC 2-aligned infrastructure. Our hosting providers (Supabase and Vercel) operate SOC 2-compliant data centers.

No system is perfectly secure. While we work hard to protect your information, we cannot guarantee its absolute security. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

10. Your Rights and Choices

10.1 Account controls

You can:

• Access and update your account information at any time through your account settings.
• Export your data in CSV or PDF format from any project.
• Cancel your subscription through the Stripe customer portal.
• Delete your account by contacting support@relayconstruct.com.

10.2 California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the sources of that information, the purposes for which it is collected, and the categories of third parties with whom it is shared (this Privacy Policy provides that disclosure).
• Request a copy of your personal information.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of any “sale” or “sharing” of personal information for targeted advertising — we do not sell or share personal information for targeted advertising.
• Be free from discrimination for exercising your privacy rights.

To exercise these rights, email support@relayconstruct.com from the address associated with your account. We may need to verify your identity before responding.

10.3 European Economic Area / United Kingdom (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, you have the following rights with respect to your personal data:

• Right of access, rectification, erasure, restriction, portability, and objection to processing.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with your local data-protection authority.

Our legal bases for processing are: (a) performance of a contract (to provide the Service); (b) legitimate interests (to operate, secure, and improve the Service); (c) consent (where you have provided it); and (d) legal obligation (where applicable).

To exercise these rights, contact support@relayconstruct.com.

10.4 International transfers

Relay is based in the United States, and our Service Providers may store or process your data in the United States or other countries. By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data-protection laws from your own.

11. Children’s Privacy

The Service is not directed to children under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us at support@relayconstruct.com and we will take steps to delete it.

12. Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. There is no consistent industry standard for how to respond to DNT signals, and we do not currently respond to them. We treat your privacy consistently regardless of any DNT setting.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email to your account address or by a prominent notice in the Service) before the changes take effect. The “Last updated” date at the top of this policy indicates when it was last revised. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

Relay, LLC
Email: support@relayconstruct.com
Website: relayconstruct.com

This Privacy Policy is incorporated into, and forms part of, the Relay Terms of Service.