Privacy policy.

Who is responsible for your data

This policy covers both this website and the RelayWarden platform at app.relaywarden.com. Both are operated by an independent software professional based in Spain, who acts as the data controller for the personal data described in this policy, with one exception: for personal data contained in the events our customers relay through the platform, the customer is the controller and we act only as a processor on their instructions.

You can exercise any of your rights, or ask anything about this policy, by writing to hello@relaywarden.com.

What we collect, and why

We collect very little, and never for advertising. We do not profile you, and we do not sell or share your data for marketing.

• Waitlist: the email address you enter in the waitlist form. We use it only to send your invitation and essential updates about your place. Legal basis: your consent, which you can withdraw at any time.
• Contact: the contact page shows our email address, and writing to us happens in your own email client, so nothing reaches us until you choose to send it. We use what you send only to reply to you. Legal basis: our legitimate interest in answering enquiries.
• Platform account: the name and email address you sign in with at app.relaywarden.com, plus the settings and alert destinations you configure. Sign-in is handled by Clerk, which manages authentication only and has no access to anything inside the platform. We use them to operate and secure your account and to send the service notices you asked for, such as delivery failure alerts. Legal basis: performance of the contract with you.
• Technical logs: the infrastructure serving the website and the platform records basic technical data such as IP address, requested page, and browser type. We use it only for security and to keep the service available. Legal basis: our legitimate interest in operating a secure service.
• Usage analytics: we use PostHog, hosted in the EU, to understand how the site is used, such as which pages are visited, which buttons are clicked, and errors the browser reports. We use this only to improve the site, never for advertising, and we do not sell or share it. If you decline the cookie banner, analytics continues only in cookieless mode: visits are counted anonymously and nothing is stored in your browser. Legal basis: your consent for cookie-based analytics, revocable at any time on the cookies page, and our legitimate interest in anonymous cookieless counting.

Event data relayed through the platform

The webhooks and API records our customers relay through RelayWarden can contain personal data of their own users, such as an email address inside a payment event. That data belongs to the customer: we store it exactly as it arrived, use it only to deliver it and to show the customer its delivery history, and never use it for advertising, profiling, or training of any kind.

Event payloads are stored on EU infrastructure, encrypted in transit and at rest with per-tenant envelope encryption, and search runs over encrypted data indexed per tenant. Each event is deleted at the end of the plan’s retention window, and dispatch mode events are purged within one hour.

If your data reached us inside another company’s events, the service you interacted with is the controller: send your request to them, and we will help them honour it.

Cookies and browser storage

This site sets no advertising cookies. PostHog, our analytics tool, stores a small identifier to tell returning visits apart only if you accept it in the cookie banner; if you decline, it counts visits anonymously in cookieless mode and stores nothing in your browser. The rest is strictly necessary storage: cookies the Clerk waitlist form needs to work, and a sessionStorage flag that keeps the language suggestion banner dismissed. The full detail lives in the cookie policy, where you can also change your choice at any time.

Who processes data on our behalf

Four providers help us run the website and the platform:

• Clerk (Clerk, Inc., United States): provides the waitlist form and the platform’s sign-in, and stores only the emails and credentials needed to authenticate you. Clerk manages authentication and nothing more: it has no access to your account details or to anything inside the platform. Transfers outside the EU are covered by the safeguards in Clerk’s data processing terms, including EU standard contractual clauses.
• Stripe (Stripe Payments Europe, Ltd., Ireland): acts as our payment gateway and processes subscription payments, storing the billing details that requires. Your full card details go only to Stripe and never reach our servers.
• Amazon Web Services: hosts this website and runs the platform’s infrastructure. Event data is stored in EU regions, and the website is served through AWS’s content delivery network.
• PostHog (PostHog, Inc., United States): provides the usage analytics described above. We use PostHog’s EU cloud, so analytics data is stored on servers in the EU.

How long we keep it

Waitlist emails are kept until you receive access, ask to be removed, or the waitlist closes, whichever comes first. Emails you send us are kept for as long as the conversation needs. Technical logs rotate automatically on short schedules.

Platform account data is kept while your account exists and deleted when it closes. Event data follows the retention window of your plan, as described above.

Your rights

Under the GDPR you can ask for access to your data, have it corrected or deleted, restrict or object to its processing, request portability, and withdraw consent at any time without affecting processing that already happened. Write to hello@relaywarden.com and we will respond within the deadlines the law sets.

If you believe we have not handled your data properly, you can complain to the Spanish supervisory authority (Agencia Española de Protección de Datos, aepd.es) or to the authority of the EU country where you live.

Changes to this policy

If what we collect or the tools we rely on change, for example when the service launches commercially, this policy will be updated before the change takes effect and the date above will reflect it.