Where your data lives, and what happens to it.

How data moves through RELOS

1. Capture — on your device. A photo, a voice note or typed text. These originals stay in local storage on your device and are not uploaded.

2. Processing. When you process a conversation, the capture content is sent to our AI providers to produce the structured result: a contact, key points, a next step, a follow-up draft. This processing takes place outside the European Economic Area, under Standard Contractual Clauses. We state it plainly because it is true, and because any data-protection review establishes it anyway.

3. Storage — in Germany. The structured result is stored, encrypted, on infrastructure operated by Hetzner Online GmbH, a German company, in ISO 27001-certified German data centres.

What is never done: RELOS does not record the people you meet. It does not enrich contacts from LinkedIn or any other source. It does not build profiles of the people in your notes. It does not sell data to anyone.

Sub-processors

We name our sub-processors rather than describing them generically, because a list you cannot verify is not a list. Both AI providers operate under a Data Processing Agreement with Standard Contractual Clauses, and under contractual terms that prohibit the use of API data for model training.

PostHog runs inside the application only. It records which screens are opened and event metadata; the content of your conversations is masked before it leaves the app, and it is not used on this website.

Payment providers will be added to this table when payments open. We give at least 30 days' notice before adding or replacing any sub-processor. The authoritative list is maintained in Annex 2 of the Data Processing Agreement.

If your organisation requires EU-only processing

RELOS is built with an alternative AI chain from Mistral, a French provider, wired for all three processing layers. Switching an account to it is a configuration change, not development work.

We are candid about the trade-off: in our own testing the default chain produces better structuring and transcription quality, particularly on longer voice notes and on multilingual conversations. If EU-only processing is a requirement for you rather than a preference, we would rather have that conversation than lose it in a questionnaire. Write to privacy@relos.eu.

Encryption

Data is encrypted in transit (TLS end-to-end) and at rest. Card details will never reach RELOS servers — when payments open, card data is handled by the payment provider through tokenisation, and RELOS stores only a token.

Your data, and getting it out

Export. Every account, on every plan including Solo, can export its data as CSV or XLS at any time — including after cancellation. There is no retention hold and no export fee.

Deletion. You can delete any entry at any time. To close an account, write to privacy@relos.eu; we delete or anonymise your data within 90 days, except records we must retain by law such as accounting records. Raw captures are governed by your own device and its settings.

Ownership on Team plans. On a Team plan the data belongs to the workspace, not the individual seat. When someone leaves, their conversations and contacts stay with the company. This is deliberate — it is why handover works, and it is the arrangement most companies expect.

Read-only rather than deletion. If a trial ends, a subscription lapses or a payment fails, the account becomes read-only. We do not delete data because a payment did not go through.

Data Processing Agreement (DPA / AVV)

RELOS publishes a standard Data Processing Agreement covering the processing carried out on your behalf, the sub-processors involved, the international transfer mechanism, and the technical and organisational measures applied. It is available in English and German, and it sets out the controller and processor roles: where you capture personal data of third parties through RELOS, you are the controller and Valler Ltd. is the processor.

Read the DPA · To have it signed for your organisation, write to privacy@relos.eu.

Contact and response times

For a data-protection question, a DPA signature, or a security questionnaire, write to privacy@relos.eu. We respond within two business days.