Relay privacy notice
Who operates Relay
Relay is a product of Corsift, a trading name of ASG INFOTECH LIMITED, registered in England and Wales, company number 13873222. Registered office and correspondence address: Sterling House Maple Court, Maple Road, Tankersley, United Kingdom, S75 3DP. Contact: hello@corsift.com.
This notice covers Relay accounts and service data. For optional analytics on the marketing website, see the website privacy notice. We act as controller for account administration, billing, security and our business contacts. The business receiving a caller’s enquiry normally acts as controller for that enquiry; we process it on their instructions.
Information processed
Account data includes names, email addresses, organisation details, access identifiers and billing references. Service data can include caller numbers, names, enquiry details, messages, call timing, callback requests, approved knowledge and technical events. Callback numbers are encrypted in storage and can be revealed by authorised workspace users; matching hashes are also retained. Payment card details are handled by Stripe.
Live voice is sent to speech providers for transcription and synthesis. Live call recording is off by default in the current deployment. Uploaded recordings retain their original audio until deleted or expired. Where transcripts are stored, pattern-based redaction is applied, but it can miss personal data. You should avoid supplying unnecessary sensitive information.
Purposes and lawful bases
We use account and payment information to perform our contract with business customers, meet legal obligations and maintain accounts. We rely on legitimate interests to secure the service, investigate faults and respond to business enquiries, balancing these interests against individual rights. Customer-directed processing follows the customer’s lawful instructions and their own privacy notice. We do not use customer call content to train our own general-purpose models.
Providers and locations
Application databases, object storage and backups are hosted with Civo in London. Some inference runs on office hardware connected through Tailscale. External providers also process data: Twilio for telephone connectivity; Deepgram for speech recognition; ElevenLabs for generated speech; Clerk for authentication; Stripe for billing; and Cloudflare for the public website and network delivery. Their functions, relevant data and transfer considerations are listed in the data processing agreement.
A UK hosting location does not mean all processing stays in the UK. Provider processing and support may involve other countries. Where a restricted transfer occurs, the responsible contracting party must establish the applicable adequacy decision or contractual safeguards, including the UK Addendum or IDTA as appropriate. Contact us for the arrangement applicable to your deployment. We do not claim that Relay is certified by the ICO or that a UK region label proves legal compliance.
How long data remains
The workspace retention setting controls expiry of call recordings and transcripts, callback personal details and messages. A daily sweep removes or anonymises expired data in active storage. Approved knowledge remains until removed; do not approve personal caller details as reusable knowledge. Operational and billing records can remain after personal details are removed where needed for accounting, security or legal obligations. Statutory accounting records are normally retained for six years.
Database backup copies rotate over a further 30 days. Erased information can remain in protected backups until expiry and is not used for normal service. If a backup is restored, deletion and expiry instructions must be reapplied before service resumes. External providers may have separate retention under their contracts; contact us for deployment-specific information.
Your rights and contact
You may request access, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. Send requests to hello@corsift.com. We may need to verify identity. Callers should first contact the business they called; we help that business handle requests. You may complain to the Information Commissioner’s Office. Relay does not make decisions with legal or similarly significant effects on callers solely by automation.