Last updated: May 6, 2026
ClientRelay is operated by ClientRelay Technologies, based in Norway. We are committed to protecting your privacy and handling your data transparently.
ClientRelay Technologies
Molde, Norway
Email: contact@clientrelay.tech
| Data Type | Source | Purpose |
|---|---|---|
| Email address | Google OAuth | Authentication, account identification, hub membership |
| Display name | Google OAuth | UI personalization |
| Profile photo URL | Google OAuth | Avatar display in dashboard |
| Knowledge base content | User uploads | Training AI chatbot responses |
| Chat logs | End-user conversations | Analytics, quality monitoring, lead capture |
| Lead form submissions | End-user chat interactions | Business lead generation for hub owners |
| IP address hash | Automatic (rate limiting) | Security - rate limit enforcement. The actual IP address is never stored. |
| Landing page visit data (anonymous) | Automatic (landing page script) | Anonymous visitor counting - page path, referrer domain, browser language, device type (mobile/desktop). No IP addresses, no cookies, no user identifiers. |
| Processing | Legal Basis | GDPR Article |
|---|---|---|
| Dashboard login (Google OAuth) | Contract — necessary for service delivery | Art. 6.1(b) |
| Chat messages (anonymous) | Legitimate interest — service improvement | Art. 6.1(f) |
| IP hash (rate limiting) | Legitimate interest — security | Art. 6.1(f) |
| Lead data (name, email, phone) | Consent — voluntarily submitted by end-user | Art. 6.1(a) |
| Landing page analytics (anonymous) | Legitimate interest - aggregate visitor statistics | Art. 6.1(f) |
All data is stored on Supabase infrastructure within the European Union. Authentication is handled by Supabase Auth (Google OAuth provider).
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase Inc. | Database, auth, serverless functions | All application data | EU region |
| Google LLC | Gemini AI (chatbot), OAuth (dashboard) | Knowledge base content, chat messages, email | USA (EU-US Data Privacy Framework) |
| GitHub Inc. | Static website hosting (GitHub Pages) | No user data (static files only) | USA (EU-US Data Privacy Framework) |
| Resend Inc. | Email notifications for lead capture | Recipient email address, lead name | USA (EU-US Data Privacy Framework) |
| Google LLC (Analytics) | Website traffic analytics (GA4) | Anonymous usage data (page views, device type, traffic source) | USA (EU-US Data Privacy Framework) |
Some data may be transferred to countries outside the EU/EEA (USA). Such transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs).
When end-users interact with chatbots created on the platform:
When a business uses a ClientRelay chatbot widget on their website with lead capture enabled, both ClientRelay (as data processor) and the business (as data controller) share responsibility for personal data collected. The business is responsible for informing their end-users about data collection.
| Data | Retention Period |
|---|---|
| Chat logs (anonymous) | 3 months, then automatically deleted |
| Lead data (name, email, phone) | 2 months, then automatically deleted |
| Dashboard account | Until account is deleted |
| Knowledge base | Until you delete it or account is terminated |
| IP hash (rate limiting) | 24 hours (in-memory, not permanently stored) |
| Landing page analytics | 12 months, then automatically deleted |
| After account deletion | All data deleted within 30 days |
Under the General Data Protection Regulation (GDPR), you have the right to:
For chat data: since chat logs are anonymous, there is no personal data to delete. For lead data: contact us or the website owner for deletion.
We respond to all requests within 30 days. Contact us at contact@clientrelay.tech.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
We do not sell personal information. We do not share personal information with third parties for their marketing purposes.
The Service uses:
cr_visited) records today's date to avoid counting the same visitor twice per day. No personal data is stored._ga, _ga_*) to distinguish unique visitors. No personally identifiable information is collected. See Google's Privacy Policy.We implement industry-standard security measures including:
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect data from children.
If you believe we are processing your personal data in violation of GDPR, you have the right to lodge a complaint with the supervisory authority:
Datatilsynet (Norwegian Data Protection Authority)
Phone: +47 22 39 69 00
Email: postkasse@datatilsynet.no
Website: datatilsynet.no
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service constitutes acceptance of the updated policy.
For privacy-related questions or requests:
ClientRelay Technologies
Email: contact@clientrelay.tech
Location: Molde, Norway