This policy explains how we process the personal data of visitors to www.relayalgo.com and of users of the service at app.relayalgo.com, under the General Data Protection Regulation (GDPR) and other applicable laws.
1. Data controller
The controller is [COMPANY LEGAL NAME — TO BE COMPLETED], registered office [REGISTERED ADDRESS — TO BE COMPLETED], VAT or tax number [VAT / TAX ID — TO BE COMPLETED].
For any privacy request write to support@relayalgo.com. Data Protection Officer (DPO): [DPO — TO BE APPOINTED OR CONFIRMED NOT REQUIRED].
2. What data we process
- Account: email, password (only as a non-reversible hash), two-factor authentication factors, IP address and browser of your sessions.
- Profile: name, country, language, time zone, preferred notification channel, Telegram identifier if you connect the bot, identity verification result if required.
- Consents: which document you accepted, its version, a fingerprint of the text, language, IP address, browser and date.
- Connected exchange account: exchange, account identifier (UID), label, encrypted API key with only the last 4 characters readable, detected permissions.
- Trading data: copy rules, orders, executions, positions, account value over time, results, deposits and withdrawals detected to calculate the reference peak (high water mark).
- Billing: invoices, amounts, payment status. Card data is processed by Stripe: we never see the full number. For USDT payments we process the address and the transaction.
- Communications: notifications sent, support requests and our replies.
- Security: a log of relevant actions (who, what, when, from which IP) and technical logs with secrets redacted.
- Website visits: your IP address, used by the hosting provider to deliver pages and by us to derive your country and pick the language. The country is not stored on our servers and the IP is not recorded for this purpose.
- Call booking: if you book a call from the website, your name, email, the language and time zone of the call, the topic, your optional note, the time of the call and the video link. The video call itself runs on the video provider (by default Jitsi Meet); we do not record calls.
We do not process special categories of data (health, political opinions and the like) and we do not sell data to anyone.
3. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, connecting your exchange account, executing copying, sending service notifications | Performance of the contract |
| Calculating fees and subscriptions, issuing invoices, keeping accounts | Contract and legal obligations |
| Keeping proof of consents | Legal obligation and legitimate interest in defending our rights |
| Protecting accounts and systems, preventing abuse and fraud, keeping the security log | Legitimate interest and legal obligations |
| Applying international sanctions, country blocking and any identity verification | Legal obligation |
| Marketing communications | Only with your consent, which you can withdraw at any time |
4. API keys
The API key is the most sensitive data you entrust to us, so:
- it is encrypted with AES-256-GCM, with a different key for each account, itself protected by a master key held in a key management service (KMS);
- it is decrypted only in memory, on the servers that send orders, and only for as long as needed;
- nobody on the team, not even the administrator, can see it in plain text;
- when you revoke it or close your account it is irreversibly destroyed.
5. How long we keep it
The periods below are a proposal under legal review.
| Data | Retention |
|---|---|
| Account and profile | For the life of the account; pseudonymised 30 days after closure |
| API key | Destroyed on revocation or closure |
| Technical key checks | 90 days |
| Orders, executions, positions, results, deposits and withdrawals, invoices | 10 years, for accounting and tax obligations |
| Account value minute by minute | 90 days, then a daily summary for 10 years |
| Proof of consents | 10 years from account closure |
| Notifications | 12 months |
| Technical incidents | 24 months |
| Security log | 5 years, with the author pseudonymised together with the account |
| Technical logs | 30 days |
| Call bookings (name, email, note) | 12 months after the call, then anonymised |
When you close your account, your email, name, Telegram identifier, UIDs and labels are replaced or deleted after 30 days. Financial data remains, linked to an internal identifier that no longer leads back to you, until the legal retention period ends.
6. Who we share it with
We use providers that process data on our behalf, under data processing agreements:
| Provider | Service | Where |
|---|---|---|
| Supabase | Database, authentication | Singapore |
| Vercel | Website and app hosting | Global network |
| Railway | Development servers | Singapore |
| Dedicated server provider (to be selected) | Servers that send orders | Singapore |
| Amazon Web Services (KMS) | Custody of the master encryption key | Singapore |
| Stripe | Card payments | EU and USA |
| Resend | Sending emails | USA |
| Telegram | Notifications, if you enable them | Global |
| Better Stack | Logs and monitoring | EU or USA |
| Cloudflare (Turnstile) | Anti-bot protection on sign-up and password recovery | Global |
In addition:
- Your exchange receives the orders we send with your key. The exchange processes your data as an independent controller, under its own privacy policy.
- Google Fonts: the website loads its typefaces from Google's servers, which see your IP address.
- Bybit and Binance: the website shows market prices by reading them directly from your browser from their public servers, which see your IP address. We send them no personal data.
- Public authorities, when the law requires it.
7. Transfers outside the European Union
App data is processed in Singapore, which does not have an adequacy decision from the European Commission: the transfer relies on the standard contractual clauses approved by the Commission and on a transfer impact assessment. For providers in the United States we rely on the Data Privacy Framework where the provider is certified, or otherwise on standard contractual clauses. You can ask us for a copy of the safeguards in place.
8. Your rights
You can ask us at any time to:
- access your data and receive a copy: in your profile, "Export my data" gives you a file with your profile, consents, accounts (without keys), rules, trades and invoices;
- correct it;
- erase it, by closing your account, subject to retention required by law;
- restrict or object to its processing, in particular processing based on legitimate interest;
- receive it in a structured format to take it elsewhere;
- withdraw consent to marketing communications, with no effect on the service.
We reply within 30 days. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one in the country where you live or work.
9. Cookies and browser storage
The website uses no advertising cookies and no analytics or profiling tools. It stores only three technical preferences in your browser's storage (localStorage), which are never sent to us:
relay_theme: light or dark theme;relay_lang: the language you chose;relay_geo: the country derived from your IP, for 24 hours, so the request is not repeated on every page.
The app uses browser storage to keep you signed in. These are strictly necessary or requested by you, so no consent is needed. You can clear them in your browser settings.
10. Security
We use encrypted connections, two-factor authentication, separate least-privilege access for each component, row-level access control on the database and an action log that cannot be altered. If a data breach puts you at risk, we notify the authority within 72 hours and inform you without delay. If API keys are involved, we always ask you to revoke them on your exchange.
11. Minors
Relay is not intended for people under 18 and we do not knowingly collect their data.
12. Automated decisions
Copying automatically executes the rules you set. Automatic refusal of sign-up for excluded countries is based on the country you declare. You can always ask for human review by writing to support@relayalgo.com.
13. Changes
If we change this policy we publish the new version with a number and date. If the changes are significant we tell you before they apply.