GDPR at inrelay

Last updated: · Draft for counsel review

Two roles, one sentence each

For your account data (your name, login, billing) we are the controller — the decisions about that data are ours. For the conversations in your workspace we are the processor — your team decides why that data exists; we handle it on your instructions under the data processing agreement.

Your rights

If GDPR applies to you, you can:

Access a copy of the personal data we hold about you.
Correct data that is wrong.
Delete your data ("right to be forgotten") — with the two documented limits described in the privacy policy: encrypted backups age out on their own schedule, and invoices are kept as legally required financial records.
Export it in a portable format — JSON per record type plus your original files, in a single archive.
Object to or restrict certain processing.
Complain to your local supervisory authority.

If you are a customer of a team that uses inrelay, your request usually goes to that team — they control the workspace — and we help them fulfil it.

How access, export and erasure actually work here

Because the two roles above are different, the same request means two different things depending on who is asking.

You are a teammate in someone’s workspace. Your account data is ours to act on. From Settings → Security — on the desktop app or in the mobile app — you can export your own personal data and delete your account. Your login and your personal details go. The replies you sent stay: those are your employer’s business records, they are the controller for them, and one employee leaving is not a lawful reason for us to erase a company’s support history. Your name is removed from them, so they read as “Former teammate”.

You are the workspace owner. You can export everything and delete the whole workspace, including the conversations and contacts of the customers you support. We act on that instruction as your processor. Deletion is not immediate: the workspace is frozen at once and destroyed after 30 days, and you can reverse it with one click at any point in that window. The full sequence, the backup window and the invoice exception are set out in the privacy policy.

You are an end customer of a team that uses inrelay. Send your request to that team. They are the controller for the conversation you had with them; we hold it on their instruction and will help them act on it.

We do not train AI models on customer data, so there is no separate training-data copy to chase down; the model providers we use are listed at /subprocessors and their API terms say the same.

Lawful bases, in plain English

Contract — we process your account and workspace data because that is what running your inbox is.
Legitimate interests — keeping the service secure, preventing abuse, and understanding basic usage.
Legal obligation — tax and accounting records we are required to keep.
Consent — anything optional, like a marketing email list, which you can withdraw at any time.

Where data goes

The vendors that touch your data, with purpose and location for each, are listed at /subprocessors. Where data leaves the EEA or UK, transfers rely on approved safeguards.

Making a request