Data processing agreement
The contract that governs how we handle your workspace data as a processor - and how to get a signed copy.
What the DPA is
inrelay is operated by LabiOffice Inc. (“LabiOffice”, “we”, “us”); LabiOffice Inc. is the processor named in the agreement, and the party you contract with. When your team uses inrelay, the conversations in your workspace are your data - you are the controller, we are the processor. The data processing agreement is the contract that makes that binding: it sets out what we may do with that data, and nothing more. It incorporates into the terms of service for every customer.
What it covers
- Scope and instructions. We process workspace content, including the order data we copy from stores you connect, only to provide the service - storing it, routing conversations to teammates, sending them and the order facts they need to AI providers for triage and drafting, and indexing them for search, on your instruction.
- Confidentiality and security. The technical and organisational measures we maintain.
- Subprocessors. We use the vendors listed at /subprocessors, flow the same obligations down to them, and notify you before adding one.
- International transfers. Safeguards for data leaving the EEA/UK.
- Assistance. Helping you answer data-subject requests from your customers, and notifying you of personal-data breaches.
- Return and deletion. Export of your data on exit and deletion afterwards, on the timeline in the privacy policy.
AI providers under the DPA
Drafting sends conversation content to our AI model providers over their APIs, and search indexing sends message text to OpenAI to create embeddings; under those providers’ API terms your data is not used to train their models. They appear in the subprocessor list like any other vendor - no special carve-outs.
Requesting a signed copy
If your compliance process needs a countersigned DPA, request one at hello@inrelay.ai and we will return an executed copy. For the summary of your rights under GDPR, see /gdpr.