Last updated: October 14, 2026
ClientRelay is operated by ClientRelay Technologies, based in Norway. We are committed to protecting your privacy and handling your data transparently.
ClientRelay Technologies
Molde, Norway
Email: contact@clientrelay.tech
| Data Type | Source | Purpose |
|---|---|---|
| Email address | Google OAuth | Authentication, account identification, hub membership |
| Display name | Google OAuth | UI personalization |
| Profile photo URL | Google OAuth | Avatar display in dashboard |
| Knowledge base content | User uploads | Providing context for AI chatbot responses |
| Chat logs | End-user conversations | Analytics, quality monitoring, lead capture |
| Lead form submissions | End-user chat interactions | Business lead generation for hub owners |
| IP address hash | Automatic (rate limiting) | Security - rate limit enforcement uses an IP address hash. Separate infrastructure request logs may contain the original IP address. |
| Landing page visit data (anonymous) | Automatic (landing page script) | Anonymous visitor counting - page path, referrer domain, browser language, device type (mobile/desktop). No IP addresses, no cookies, no user identifiers. |
We record daily totals of successful chatbot configuration requests to help diagnose how often each assistant is loaded. These totals identify the assistant and group customer-site and ClientRelay-hosted traffic separately. This counter stores no visitor identifiers, IP addresses, visited-page URLs, message content or exact load times, and adds no cookies or browser-storage access. Reloads, tests and automated requests may count, so the totals do not represent unique people or prove that someone saw or opened the assistant.
The totals are used for service-usage reporting and diagnosis under the customer's service arrangements. They are not joined to individual visitor or conversation records for profiling. ClientRelay's existing Data Processing Agreement describes the customer and processor responsibilities; the website operator is responsible for its own visitor information and any required consent.
These aggregate counts are separate from technical request logs. Our infrastructure providers process connection metadata, which can include IP addresses, browser information and request timestamps, to operate and secure the service. The load counter does not copy those identifiers into its daily totals.
On supported browsers, a visitor may choose to dictate a chat-message draft. The first microphone click displays a disclosure. Dictation starts only after the visitor clicks again and grants any microphone permission requested by the browser.
Raw microphone audio is processed by the speech-recognition service provided or selected by the visitor's browser or operating system. Depending on that browser or device, audio may be transmitted to the browser or operating-system provider. ClientRelay does not receive, record, or store the raw audio. The resulting transcript remains in the message field for review and is handled as a chat message only if the visitor presses Send.
The speech-service provider controls its processing location, security measures, and any provider-side retention. Visitors should consult their browser or operating-system provider's privacy information. A visitor can avoid this processing by not enabling dictation or by denying microphone permission.
| Processing | Legal Basis | GDPR Article |
|---|---|---|
| Dashboard login (Google OAuth) | Contract — necessary for service delivery | Art. 6.1(b) |
| Chat messages (no account required; may include visitor-provided personal data) | Legitimate interest — service improvement | Art. 6.1(f) |
| IP hash (rate limiting) | Legitimate interest — security | Art. 6.1(f) |
| Lead data (name, email, phone) | Consent — voluntarily submitted by end-user | Art. 6.1(a) |
| Landing page analytics (anonymous) | Legitimate interest - aggregate visitor statistics | Art. 6.1(f) |
| Optional browser dictation | Consent - activated by the visitor after disclosure and browser permission | Art. 6.1(a) |
Application data stored by ClientRelay is hosted on Supabase infrastructure within the European Union. Authentication is handled by Supabase Auth (Google OAuth provider).
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase Inc. | Database, auth, serverless functions | All application data | EU region |
| OpenAI | AI response generation | Knowledge base content, chatbot instructions, chat messages and relevant conversation history | May be outside the EU/EEA; see API data controls |
| Google LLC | Gemini AI (chatbot), OAuth (dashboard) | Knowledge base content, chatbot instructions, chat messages and relevant conversation history (Gemini); account profile and email (OAuth) | USA (EU-US Data Privacy Framework) |
| Hostinger | Website hosting, content delivery and security | Technical request data, including IP addresses, browser information and requested URLs | Processing locations vary by hosting and CDN infrastructure; see Hostinger's privacy policy |
| Resend Inc. | Email notifications for lead capture | Recipient email address, lead name | USA (EU-US Data Privacy Framework) |
| Google LLC (Analytics) | Website traffic analytics (GA4) | Anonymous usage data (page views, device type, traffic source) | USA (EU-US Data Privacy Framework) |
| Visitor's browser or operating-system speech provider (optional) | Speech-to-text dictation initiated by the visitor | Microphone audio; ClientRelay does not receive the raw audio | Determined by the provider and may be outside the EU/EEA |
Some data handled by ClientRelay's listed service providers may be transferred to countries outside the EU/EEA. The applicable provider terms describe the safeguards for those transfers. Optional browser dictation is governed separately by the visitor's browser or operating-system speech provider.
When end-users interact with chatbots created on the platform:
When a business uses a ClientRelay chatbot widget, the business is normally the data controller for personal data processed through the chatbot, including chat messages and lead submissions. ClientRelay normally acts as a data processor on the business's behalf. An authorized partner or reseller may act as a controller, processor, or subprocessor depending on the customer relationship and processing activity. The business is responsible for informing its end-users about data collection.
Businesses that offer optional dictation should also ensure their own privacy information accurately covers any browser or operating-system speech service available to their visitors.
Daily assistant-load totals are retained with the assistant and removed when its database record is permanently deleted. There is currently no separate timed expiry for these totals; archiving or soft-deleting an assistant does not remove them. Infrastructure logs have separate provider-managed retention and are not part of these totals.
| Data | Retention Period |
|---|---|
| Chat logs (may include visitor-provided personal data) | 30 days, then automatically deleted |
| Lead data (name, email, phone) | 2 months, then automatically deleted |
| Dashboard account | Until account is deleted |
| Knowledge base | Until you delete it or account is terminated |
| IP hash (rate limiting) | 24 hours (in-memory, not permanently stored) |
| Landing page analytics | 12 months, then automatically deleted |
| Optional dictation audio | Not retained by ClientRelay; any provider-side retention is governed by the visitor's browser or operating-system provider |
| After account deletion | All data deleted within 30 days |
Under the General Data Protection Regulation (GDPR), you have the right to:
Chat use does not require authentication, and ClientRelay's application rate limiting stores a hash of the IP address rather than the original address. Those facts do not make message content anonymous: a visitor may include personal data in a chat. For requests about chat or lead data, contact the website operator that provided the assistant or contact us at contact@clientrelay.tech so the request can be handled by the appropriate controller and processor.
We respond to all requests within 30 days. Contact us at contact@clientrelay.tech.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
We do not sell personal information. We do not share personal information with third parties for their marketing purposes.
Optional reseller signup measurement: An unchecked option during reseller hub creation lets you allow Google Analytics and analytics cookies to count a completed signup. This optional measurement starts only after you select it and a reseller hub is successfully created; ordinary logins, failed creation and pending client requests do not trigger it. The event uses a fixed measurement-page address and records the Google sign-in method and reseller signup type. It does not send your name, email, website, hub identifier or dashboard address. Google still receives normal browser and network information when its tag connects. A local marker containing the created hub identifier prevents another measurement attempt for that hub in the same browser until browser storage is cleared; it is not sent to Google. Analytics cookies for this measurement may remain for up to one year. Advertising storage, advertising user data and ad personalization remain disabled for this optional measurement.
The Service uses:
cr_visited) records today's date to avoid counting the same visitor twice per day. No personal data is stored._ga, _ga_*) to distinguish unique visitors. No personally identifiable information is collected. See Google's Privacy Policy.We implement industry-standard security measures including:
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect data from children.
If you believe we are processing your personal data in violation of GDPR, you have the right to lodge a complaint with the supervisory authority:
Datatilsynet (Norwegian Data Protection Authority)
Phone: +47 22 39 69 00
Email: postkasse@datatilsynet.no
Website: datatilsynet.no
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service constitutes acceptance of the updated policy.
For privacy-related questions or requests:
ClientRelay Technologies
Email: contact@clientrelay.tech
Location: Molde, Norway