AutoBox Privacy Policy

Who is responsible

Relay Solutions operates AutoBox at studio.relaysolutions.net. This notice explains personal-data handling for AutoBox, a service for business research, prospect management and personalised email outreach. For privacy questions, access or deletion requests, contact info@relaysolutions.net.

Information we handle

Account information includes your name, email address, authentication records and support communications. We also handle service settings and the information you supply or authorise us to access.

Business profiles, offers, strategies and sender details; prospect names, business contact details, websites and public research sources; campaign settings and generated drafts; connected mailbox details, message contents and metadata, replies, delivery records, unsubscribe and suppression records; optional connected research and social-account sessions.

Operational records can include IP addresses, device and browser information, timestamps, errors and security events. First-party usage reporting records a browser identifier, session identifier, visited app routes, activity times and, when signed in, an account identifier.

Where information comes from

Information comes from you, your authorised workspace members, connected accounts and service providers. AutoBox also collects business information from company websites, public listings and other attributable public sources. Public research can include professional contact information and information inferred from those sources.

Why we use it and our legal bases

We use company information and public sources to research business relevance, prepare drafts and run the outreach you enable. Connected mailbox access supports sending, synchronisation, reply handling and delivery records. Recipients receive the messages you send. Public availability of a contact does not remove their privacy rights.

Where UK or European data-protection law applies, we rely on performance of our contract to provide requested account and service features; legitimate interests to protect the service, prevent misuse, troubleshoot and understand service operation; consent for processing that requires it, including optional account access or non-essential storage where applicable; and legal obligations where records or disclosures are required by law. Our interests are providing a secure and reliable service without overriding your rights. We assess public business-contact research and outreach against the applicable rules; it is not justified solely because information is public.

Required account or task information is necessary to provide the corresponding feature. If you do not supply it, that feature may be unavailable. Optional information is identified in the relevant flow.

Google and other connected accounts

Where a Google connection is enabled, basic sign-in may provide your account identifier, name, email address and profile picture. Additional access is limited to the permissions you grant for the feature you choose. Signing in does not by itself authorise access to your mailbox, files or YouTube channel. Access tokens and any refresh tokens support the connection. Some integrations instead use an authorised browser session, which can include cookies and session storage; this is separate from Google OAuth.

Data received through Google APIs is used for the user-facing features you authorise and handled under the Google API Services User Data Policy, including its Limited Use requirements. Google API data must not be sold, used for advertising or credit decisions, or used to train general-purpose AI models. Human access is limited to your specific permission, necessary security or legal purposes, or other uses permitted by that policy. Any processor access must be necessary for an authorised feature and comply with these restrictions.

You can revoke Google access through your Google Account connections and disconnect other services through their settings. Revocation stops future authorised access but does not automatically erase records already stored by Relay or copies previously sent or published. Contact us to request deletion.

AI, service providers and sharing

Research and writing may send selected business information, public prospect sources and message context to configured AI providers. Inferred tasks and time or labour-cost estimates are illustrative assumptions, not verified internal company information or measured financial losses.

Providers may include hosting, storage, email delivery, authentication, AI inference, media processing and the platforms you connect. Relevant provider configurations include Supabase authentication and storage, and configured model services such as NVIDIA or Groq. Only the information needed for a requested operation should be included. Provider availability and the enabled feature determine which provider receives it; contact us for the providers relevant to your account.

We may access information for requested support, security investigations and lawful obligations. We may disclose information when legally required or necessary to protect rights and investigate abuse. Service data is not offered for sale or disclosed to advertising brokers. Public posts and submitted applications or messages can be copied and retained by their recipients.

Storage, security and international processing

Service data is stored in our hosted databases, file storage and operational systems. Providers or connected platforms may process information in other countries. Where a transfer is subject to UK or European transfer restrictions, the applicable arrangement must provide an appropriate lawful safeguard, such as an adequacy decision or approved contractual safeguards. Contact us for the locations and safeguards relevant to your data.

Access controls, authentication and technical safeguards are used to protect information. The safeguards differ by integration and no system can guarantee absolute security. Do not share passwords or upload information that the service does not need.

How long we keep information

Account and workspace records are kept while needed to provide the service and maintain your saved work. Retention depends on account status, the purpose of the record, support or security investigations and legal obligations. Generated media and application or campaign history remain until removed or no longer needed for those purposes. Logs and backups can outlast removal from the active interface until they are rotated or replaced. We do not promise a fixed deletion deadline for every record type; contact us for the retention applicable to your account.

Minimal suppression or objection records may be retained to prevent further unwanted contact. Information held by employers, message recipients or social platforms is subject to their own retention policies.

Cookies and browser storage

Cookies and local or session storage support sign-in, security, saved settings, connected sessions and first-party usage reporting. External resources, including fonts and connected-platform pages, can receive browser and connection information. You can manage browser storage in your browser; disabling essential storage can prevent features from working. Optional non-essential tracking, where introduced, requires any choices or consent applicable to it.

Your choices and rights

Depending on your location and circumstances, you may request access, correction, deletion, restriction or portability of your personal information. You may withdraw consent without affecting earlier lawful processing. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. Use an email’s unsubscribe link or contact us to stop outreach. We may need proportionate identity verification to fulfil a request; requests are handled within applicable legal time limits.

Contact info@relaysolutions.net with the app name and account email. A workspace customer may control information it uploaded or obtained for its own purposes; we may need to coordinate your request with that customer. You can complain to your local data-protection authority, including the UK Information Commissioner’s Office.

Automation, children and updates

The service uses automated research, generation, matching or scheduling. AI outputs and inferred profiles can be wrong; you can review your inputs and settings and contact us about inaccurate information. Relay does not use these features to make employment or similarly significant legal decisions about you. The service is intended for adults and is not directed to children. If a child has supplied information, contact us.

We update this notice when our practices change. The date above identifies the current version; material changes affecting your information will be communicated through an appropriate service notice.