relaynix

Data Processing Addendum

Last updated: 2026-05-21 · Version 1.0

This Data Processing Addendum ("DPA") forms part of the Relaynix Terms of Service and applies when Relaynix processes Personal Data on behalf of a Customer (you, the workspace owner) subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection.

1. Roles and scope

Customer is the Data Controller; Relaynix is the Data Processor. Processing is limited to operating the Service: storing accounts, running the AI content pipeline, publishing to channels the Customer has connected via OAuth, and emitting metrics back to the Customer dashboard.

2. Categories of data + data subjects

• Customer staff: email, full name, password hash, 2FA secret if enabled, locale, last-login IP. Used only for account access + audit.
• End-user comments: public comments on Customer- owned social posts, including author handle, text, and timestamps. Stored to enable the reply workflow. Never enriched, never sold.
• Aggregated metrics: view counts, like counts, country breakdowns surfaced by the platform APIs. No personally-identifying data beyond what the platform already makes public.
• QR scan events (optional feature): per scan of a Customer's tracked QR — timestamp, approximate country, device/OS family, referrer host, and a salted daily-rotated keyed hash of the IP (never the raw IP). Hard-deleted 90 days after the scan.

3. Sub-processors

Relaynix uses the following sub-processors to deliver the Service. You can object to any of them in writing — we will work with you on an alternative or, if none exists, you may terminate.

• Anthropic, PBC (US) — Claude model inference for Script-Writer, Comment-Replier, classifier agents. Data transferred: prompts (no personal data unless Customer puts it in a prompt template) + comment text for classification.
• OpenAI, OpenAI Ireland (US / IE) — fallback model inference for select agents. Same data scope as Anthropic.
• ElevenLabs, Inc. (US) — voice synthesis from generated scripts. Data: script text only.
• fal.ai (US) — Veo video model inference. Data: prompt text + generated mp4 returned.
• Kling AI (Singapore) — backup video generation. Same scope as fal.ai.
• Resend (US) — transactional email delivery (sign-up, password reset, invites, weekly digest). Data: email address + email body.
• Stripe (IE) — payment processing. Data: name, email, billing address, card token (Stripe-tokenised; we never see card number).
• Hostinger (LT) — primary VPS hosting in Vilnius, Lithuania (EU). All databases, generated assets, and application servers live here.
• Cloudflare, Inc. (US) — edge CDN + DNS for relaynix.tech. No customer database access.
• Tailscale, Inc. (CA) — admin VPN access only. No production data path.

Adding a new sub-processor requires 30-day prior notice via in-app banner + email.

4. Security measures

• Transport encryption: TLS 1.3 (Cloudflare + Tailscale edges).
• Per-tenant credentials are encrypted at rest with AES-256-GCM using a per-tenant Data Encryption Key (DEK) wrapped by a master KEK held outside the database.
• Database access restricted to the application VM via private Docker network; no direct DB Internet exposure.
• Backups: nightly logical dump, 7-day retention, encrypted at rest, restored in a separate VPC for restore drills.
• Audit log on every owner-level action (member add/remove, OAuth re-connect, plan change) — surfaced at /admin/activity for the Customer's own staff.

5. Data subject rights

Customer's end users (their viewers, commenters, team members) may exercise GDPR rights — access, rectification, erasure, portability — either directly with the Customer (who is the Controller) or by emailing dpo@relaynix.tech; Relaynix will execute within 14 days and notify the Customer.

Customer can export their own data at any time from /settings/account → "Export my data". The export is a ZIP containing all rows tied to your account in JSON form. We comply with deletion requests within 30 days from receipt; backups age out within 7 days.

6. International transfers

Primary data lives in Vilnius, Lithuania (EU). Where sub-processors (Anthropic, OpenAI, ElevenLabs, fal.ai, Stripe, Resend, Cloudflare, Tailscale) are based outside the EEA, transfers rely on the EU-US Data Privacy Framework adequacy decision where the importer is certified, and otherwise on the EU Standard Contractual Clauses (June 2021, module 2 or 3 as applicable) with supplementary measures. Copies available on request.

7. Breach notification

Relaynix will notify Customer of a confirmed Personal Data Breach without undue delay and in any case within 72 hours of becoming aware, via email to the workspace owner's address on file. Notification will describe scope, impacted data, mitigation actions, and recommended Customer steps.

8. Audits

Customer may, no more than once per 12 months, request a SOC 2 / ISO 27001 report (once available — Relaynix is preparing SOC 2 Type I for 2026 H2). Until then, Customer may request a security-questionnaire fill via dpo@relaynix.tech.

9. Term

This DPA is effective for as long as Relaynix processes Personal Data on Customer's behalf — i.e. as long as the Customer's workspace exists. Upon termination + 30-day grace, all Customer Personal Data is deleted from production and ages out of backups within 7 days.

10. Contact

Data-protection contact: dpo@relaynix.tech
Processor: Relaynix — an online service operated by its founder, established in Spain.