Updated 2026-09-12
Privacy notice
How AgentRelay handles personal information, and how to contact us about your rights.
Who is responsible
AgentRelay is created by SansaVision, a subdivision of Sansagroup AB, organisation number 559111-9507. Our postal address is Soldathemsgatan 20, 415 28 Gothenburg, Sweden.
Sansagroup AB is responsible for account administration, service security and its own business records. For workspace email processed on a customer’s instructions, the customer controls the purposes of that processing. Contact that customer first about information in its communications; we can help route your request.
Privacy contact: support@agentrelay.my (also our data-protection contact; we have not appointed a separate external DPO). You can also write to our postal address, marked “AgentRelay privacy”.
Information we use and why
You need to provide an email address to sign in. Other workspace information depends on how you and your organisation use the service. Please do not send unnecessary sensitive information.
Account and contact information
Name, work email, workspace membership and support correspondence, provided by you or your workspace administrator.
Sign-in, account administration and support. Contract where you are our customer; legitimate interests in supporting business users and administering customer accounts otherwise.
Workspace communications
Sender/recipient details, message content, attachments, drafts and conversation history, supplied by customers and their correspondents.
Provide the email service on customer instructions. The customer determines its lawful basis for the communications it supplies.
Security and service records
IP address, session records, request information, usage counts, policy decisions, approvals and delivery events, generated when the service is used.
Protect accounts, prevent abuse, operate and troubleshoot the service, and investigate delivery. Legitimate interests in a secure, reliable service; legal obligations where applicable.
Billing information
Contact and business details, selected plan, payment status and transaction references, supplied by you and the payment provider.
Manage subscriptions and financial records. Contract and applicable accounting obligations.
Who receives information
Authorised members of your workspace can access information according to their permissions. Messages are shared with the recipients you select and their email providers. The table below lists the subprocessors that may process workspace content, with what they do and where they operate.
| Provider | Role | Data handled | Transfer basis |
|---|---|---|---|
| Cloudflare | Hosting, database, queues, mail delivery, and malware-scanning compute (Workers, D1, R2, Queues, Email Service, Containers). | Account, workspace, message, and attachment content needed to operate the service. | EU–US Data Privacy Framework where certified, otherwise EU Standard Contractual Clauses. |
| Mail delivery infrastructure | Outbound and sign-in mail delivery. | Sender/recipient addresses, message content, and delivery events. | Same basis as hosting above. |
| Google Workspace | Support mailbox hosting. | Support correspondence you send us. | EU–US Data Privacy Framework where certified, otherwise EU Standard Contractual Clauses. |
| Stripe Managed Payments | Merchant of record for paid subscriptions. | Payment and billing information only — never workspace email content. Processed under its own privacy notice. | EU–US Data Privacy Framework where certified, otherwise EU Standard Contractual Clauses. |
We may also disclose information when required by law or to investigate abuse and protect people and the service. Customer-configured integrations receive the information you choose to send to them. Review those services’ privacy practices before connecting them. Our support team remains responsible for product support.
International processing
The service uses international providers and is not offered as EU-only hosting. Provider processing or support may take place outside the EEA, including in the United States where Cloudflare, Google, and Stripe operate. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses with the provider. The current transfer basis per provider is listed in the subprocessor table above; contact us for the full transfer information relevant to your workspace before sending data with residency restrictions.
How long information is kept
Account information is kept while the account is used and for 24 months after closure to resolve disputes or meet legal obligations, then deleted. Workspace communications and their history remain available until deletion is arranged with the workspace owner; after an account ends we delete or anonymise workspace content within 90 days unless retention below requires otherwise. Security and audit records are kept for 12 months for abuse investigations, legal claims or legal holds; financial records are kept for 7 years under Swedish accounting law (bokföringslagen).
The pilot does not yet provide a self-service account deletion tool. Request deletion through our privacy contact and we complete it within 30 days; we confirm in writing what was removed and any records that must be retained by law. A revoked key or deleted inbox disables access immediately but is not itself confirmation that all associated data has been erased — erasure follows the timelines above.
Cookies and tracking
Our site uses essential sign-in cookies and remembers when you dismiss the cookie notice. It does not load advertising or optional analytics trackers. Closing the notice does not permit future tracking. See cookie details for purposes, storage periods and controls.
We do not sell personal information or share it for cross-context behavioural advertising through this service. Global Privacy Control and Do Not Track do not enable any additional collection; advertising tracking remains off for everyone.
Privacy rights: EU/EEA and California
The rights below depend on the applicable law, our role and permitted exceptions. California rights apply where the CCPA/CPRA covers the processing. This summary is not a statement that the service has been certified compliant.
| Request | EU/EEA — GDPR | California — CCPA/CPRA |
|---|---|---|
| Access | Request access to your personal data and information about its use. | Request the categories and specific pieces collected, their sources, purposes and disclosures. |
| Correction / deletion | Ask to correct inaccurate data or erase data, subject to exceptions. | Ask to correct inaccurate information or delete it, subject to exceptions. |
| Portability | Request a portable copy where the right applies. | Request a usable copy of information provided in response to an access request. |
| Restriction / objection | Request restriction or object, including to processing based on legitimate interests. | Opt out of sale/sharing; limit certain uses of sensitive information where applicable. No advertising sale/sharing is enabled here. |
| Consent / fair treatment | Withdraw consent where processing relies on it; withdrawal does not undo earlier lawful processing. | Exercise applicable rights without unlawful discrimination; authorised agents may submit requests. |
To make a request, email support@agentrelay.my or write to the postal address above. Describe your request and your connection to the workspace. Do not email passwords, sign-in codes or identity documents. We may ask for proportionate verification and, for an agent, evidence of authority before disclosing information or deleting records.
GDPR requests normally require a response within one month; applicable California access, correction and deletion requests normally require a response within 45 days. If a permitted extension is needed, we will explain it within the initial response period. These request deadlines are not a promise of an automated deletion feature.
You may complain to Sweden’s privacy authority, IMY, or your local supervisory authority. California residents can contact the California Privacy Protection Agency.
Automated processing and children
Automated checks can hold or block messages for safety and policy reasons. Workspace administrators review approvals and choose how to use the service. AgentRelay is a business service, not intended for children. Do not use it to make decisions with legal or similarly significant effects about people without the safeguards your use requires.
Changes and questions
We update this notice when our practices change and show the date above. Material changes affecting existing users will need appropriate notice. Contact us for processing terms or questions about using AgentRelay with personal data.