Privacy Policy
How we collect, use and protect information, including the conversations we process for our customers on WhatsApp and on their own websites.
IMRelay is a product of Fivebucks Ventures Pte Ltd. (“we”, “us”, “our”). This policy explains how we collect, use, disclose and safeguard information when you access or use imrelay.io and the related services (the “Services”). By using the Services you agree to this policy.
IMRelay currently answers on two channels: WhatsApp, and IMRelay Chat, a widget you can install on your own website. They are described separately throughout, because what happens to a message genuinely differs between them. Slack is not yet available; when it is, this policy will say so before it is.
Two kinds of data, two roles
This distinction runs through the whole policy, so it comes first.
- Your account data. Your name, email, workspace and billing details. We are the controller: we decide why and how it is processed.
- Your customers’ messages. Every conversation your business has through us — on WhatsApp, or in the IMRelay Chat widget on your own website — and the documentation you connect so they can be answered. We are a processor: we hold this only to provide the Services to you, on your instructions. You remain the controller of it, and you are responsible for having a lawful basis to process your own customers’ data. Our binding commitments as your processor are in the Data Processing Addendum, which applies automatically and needs no signature.
What we collect
You give us
- Name, email address and workspace name at sign-up
- Payment details, collected and stored by Stripe, never by us
- The API key for the AI provider you choose, stored encrypted
Meta gives us, when you connect a WhatsApp number
- The content of messages to and from that number, including media
- The phone number and WhatsApp profile name of the person messaging you
- Delivery and read receipts, and the number’s quality and messaging limits
We store this so you can read the conversation, so a reply can be generated, and so a colleague can take over. It is visible to people you invite to your workspace.
Your documentation tools give us
You can connect Notion, Google Drive or Box, and you can point us at a page on your own website. In every case we read only what you select in that provider’s own permission screen. We never write to your workspace, and we cannot see a document you did not grant.
We store the text of those documents and a numerical representation of it (an “embedding”) so answers can be found and cited. You can disconnect a provider at any time, which removes our access and deletes the stored text.
Your website visitors give us, through IMRelay Chat
If you install the chat widget, this is what reaches us when somebody opens it on your site:
- The messages they type, and our replies
- An email address, if they give one so a person from your team can reply after they close the tab
- A random identifier the widget stores in their own browser on your site, so a returning visitor sees their conversation. Clearing it makes them a new visitor to us, and there is no way to recognise them across devices
- The address of the page the chat was opened from, their IP address and their browser’s user agent
The IP address is used to rate-limit and to stop abuse of an endpoint that anyone on the internet can reach. We do not store it. What we store is a one-way HMAC of it — the database physically refuses a raw address — and those counters are deleted after two days.
Collected automatically
- IP address, browser type and version, device identifiers
- Pages visited, time of visit and referring URLs
How we use it
- To create and operate your workspace
- To generate answers from your own documentation, and to hand a conversation to a human when it cannot be answered
- To process payments and fulfil transactions
- To provide support and respond to your requests
- To monitor performance, reliability and abuse
- To comply with legal obligations
We never train models on your data
Your customers’ messages and your connected documentation are never used to create, develop, train or improve any machine-learning or AI model. Not by us, and not by anyone we send data to. This is both our own commitment and an obligation Meta places on every business using the WhatsApp Business Platform, and it covers more than most such statements do:
- Directly or indirectly. We do not train on it ourselves, and we do not route it to anyone who would.
- Including anonymised, aggregated and derived forms. Stripping names out does not make message content fair game. Neither does turning it into statistics or embeddings.
- Including models of our own. We do not train classifiers, routers, intent models or embedding models on your conversations. Calling a provider’s API to answer a live question is use; keeping the content to improve a model is not, and we do not do it.
- After you leave. This obligation survives the end of your account. Data retained during deletion windows or for legal reasons is still off-limits for training.
AI providers
IMRelay does not resell AI. Which AI processes a message depends on the channel it arrived on, and the difference is not cosmetic, so it is set out in full.
WhatsApp — Meta’s own agent answers
On a WhatsApp number, the reply is generated by Meta’s Business Agent, running on Meta’s own models. The message content goes to Meta under your WhatsApp Business agreement with them. We send Meta a copy of your connected documentation so its agent can answer from it.
Your own AI provider key is never used for WhatsApp message content. Meta’s terms forbid routing that content to a provider that trains on it, including indirectly, and your choosing that provider does not discharge it. This is enforced in our code before your key is even decrypted, not filtered afterwards.
IMRelay Chat — your own provider answers
In the website chat widget, the reply is generated by us, using the API key you supply (Anthropic Claude, OpenAI, Google Gemini or DeepSeek). That provider bills you directly. The visitor’s question and the relevant excerpts from your documentation go to it, under your agreement with them.
Which AI company processes that data is your choice, not ours, and you can change or remove the key at any time; removing it stops automated answering immediately.
Search, on our own account
Separately from either of the above, we use OpenAI on our account to turn text into embeddings, so an answer can be found and cited. This covers your connected documentation on every channel, and — in IMRelay Chat only — the visitor’s question, which has to be embedded to be searched against. It does not cover WhatsApp message content, which never reaches our answering pipeline at all.
One responsibility is genuinely yours here. Because you choose the provider and hold the key, you must use a plan that does not train on API data. The major providers do not train on API traffic on paid plans. Some free tiers do, and Google states that content from unpaid Gemini services is used to improve its products and may be reviewed by humans. Use a billing-enabled key.
Sub-processors
Who we pass data to, what for, and — the column that usually goes unstated — whether they may train models on it.
| Who | Trains on it | What for |
|---|---|---|
| Meta Platforms | Per Meta's terms | Carries WhatsApp messages, and its agent generates replies on that channel |
| Supabase | No | Database and encrypted secret storage |
| Vercel | No | Application hosting |
| Stripe | No | Payments. Card details never reach us |
| OpenAI | No — API traffic, paid plan | Embeddings of your documentation, and of questions asked in IMRelay Chat, so they can be searched |
| Postmark | No | Transactional email, including a reply to a chat visitor who closed the tab |
| Notion · Google Drive · Box | No | Only those you connect, and only the documents you grant. We read; we never write |
| The AI provider you choose | Your plan with them decides | Generates answers in IMRelay Chat. Never for WhatsApp |
One row is not ours to promise. You choose your AI provider and hold the key, so whether it trains on what you send is set by your plan with them, not by any agreement of ours. That is why these Terms require a billing-enabled key: the major providers do not train on API traffic on paid plans, and some free tiers do.
How we protect it
- Every workspace is isolated at the database level, so one customer’s data cannot be read by another.
- Your AI provider key and documentation tokens are held in encrypted storage, never in plain text, and are never shown again after entry.
- Traffic is encrypted in transit.
- Identifiers we use to recognise a returning contact, and to rate-limit the website chat, are stored as one-way hashes. A visitor’s raw IP address is not merely avoided — the database rejects it.
- Our staff cannot read your conversations by default. Access requires your grant, is time-limited, and every use is recorded in an audit log you can review.
- The chat widget runs in an isolated frame on our own domain, so it cannot read the page it sits on, and that page cannot read it. It answers only on the website address you have given us.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your data we will tell you.
Sharing
- The sub-processors above, to run the Services
- Legal authorities, where required by law
- An acquirer, in a merger or sale of assets
- Anyone else you explicitly ask us to
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
Retention and transfers
We keep account data while your workspace exists, and conversation and documentation data until you delete it or close your workspace. Deleting a knowledge source removes its stored text and embeddings. On closure we delete your data within 30 days, except where records must be kept for legal, accounting or tax purposes.
Two things are deleted much sooner, because they exist only to stop abuse and are useless afterwards. The hashed identifiers behind our rate limits are deleted after two days, and the per-site daily question counts after 30. Neither is ever used for billing.
We are based in Singapore and our providers operate globally, so your information may be transferred to and stored in other countries, including the United States and the European Union.
Where personal data protected by UK or EU law leaves that area, the transfer is made under the European Commission’s Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies), or another lawful mechanism such as an adequacy decision. We assess each recipient before relying on it. We do not rely on your consent as the basis for these transfers — consent can be withdrawn at any moment, and a service that stops working when it is withdrawn is not a service.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, and to request a copy of your data. Under GDPR we process personal data on the basis of consent, performance of our contract, legitimate interests, or legal obligation. As a Singapore company we also handle personal data in line with the Personal Data Protection Act (PDPA). Under the CCPA/CPRA, California residents may request access, deletion and correction; we do not sell or share personal information, and we will not discriminate against you for exercising a right.
If you are one of our customer’s customers — you messaged a business on WhatsApp, or you used the chat widget on its website — then that business is the controller of that conversation and we are only its processor. Contact them first: they can read, correct and delete it directly, and they can do it faster than we can. If you cannot reach them, or you do not know which business it was, email us with roughly when and where the conversation happened and we will identify it, pass your request on, and tell you when it has been actioned. We will not act on it ourselves without their instruction, because it is not our data to decide about.
To exercise any right, email privacy@imrelay.io.
Children, cookies, changes
- An IMRelay account is not for anyone under 18, and we do not knowingly create one for them.
- The chat widget is different, and we will not pretend otherwise: it sits on our customer’s public website, and we cannot know who opens it. Whether the site is appropriate for children, and what notice its visitors are given, is the customer’s responsibility as the controller of that conversation. If you believe a child has sent us information through a customer’s widget, contact us and we will delete it.
- We use cookies that are strictly necessary to keep you signed in. You can block them, but the Services will not work without the session cookie.
- The chat widget sets no cookies at all. It stores one random identifier in the visitor’s own browser, on the website they are visiting, so a returning visitor sees their conversation. Clearing site data removes it and makes them a new visitor to us.
- We may update this policy. Changes are posted here with a revised date, and continued use constitutes acceptance.
Contact
privacy@imrelay.io
Fivebucks Ventures Pte Ltd.
20 Cecil Street, #05-03, Singapore 129955
See also our Terms of Service.