Updated 2026-09-12
Data processing addendum
This addendum applies when you use AgentRelay to process personal data on your instructions. It is a product contract summary, not legal advice.
Parties and roles
Sansagroup AB, organisation number 559111-9507, Soldathemsgatan 20, 415 28 Gothenburg, Sweden (“we”) is the processor for workspace email and related content you supply. You (the customer organisation) are the controller for that content. We remain controller for account administration, security logs, and billing records as described in the privacy notice.
Instructions
We process workspace communications only to provide AgentRelay: store, transmit, screen, and display messages according to your configuration, and to protect the service. We will not use workspace content to train general models or to advertise. If we cannot follow an instruction, we will tell you.
Personnel and subprocessors
People who handle workspace data are bound to confidentiality. Our subprocessors for workspace content are listed with their roles in the privacy notice subprocessor table: Cloudflare (hosting, database, queues, mail delivery, scanning compute), mail delivery infrastructure, and Google Workspace (support mailbox). Stripe Managed Payments handles billing information only — never workspace email content — under Stripe’s own terms. We update that table before a new subprocessor handles workspace content and notify workspace owners by email at least 14 days in advance; you may object within that period and we will work with you in good faith, including by ending the affected processing.
Security and international processing
The service uses TLS in transit, access controls, and workspace isolation in the application database. It is not offered as EU-only hosting. Transfers outside the EEA use the EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses — see the transfer basis per provider in the privacy notice. Contact us before sending data with residency restrictions.
Assistance, incidents, and deletion
We will help with reasonable controller requests for access, correction, deletion, and export of workspace data we hold, and with information needed for your DPIA. If we become aware of a personal-data breach affecting your workspace we notify you without undue delay and no later than 72 hours after becoming aware, with what happened, what data is affected, and what we are doing. After the account ends, we delete or anonymise workspace content within 90 days under the privacy notice retention rules; legally required billing (7 years) and security (12 months) records may remain.
Audits and law
On written request we will provide available security and processing information reasonably needed to verify this addendum. These terms follow Swedish law, without removing mandatory protections that apply to you. Contact support@agentrelay.my.