Privacy Policy

1. Who this policy covers, and who operates Relay

"Relay" is a trading name. The Platform is legally owned and operated by Mustafa Ahmad Alalawi Establishment, a sole proprietorship registered in Saudi Arabia (Commercial Registration No. 1010183482), based in Safwa 32827, Eastern Province, Saudi Arabia ("Relay," "we," "us"). This policy applies wherever you interact with Relay: as a customer booking a service through WhatsApp, or as staff of a merchant business using the Relay merchant portal.

This policy is written to be read and understood by ordinary customers and merchants, and it is written with Saudi Arabia's Personal Data Protection Law (PDPL, Royal Decree No. M/19, in force since 14 September 2023, regulated by the Saudi Data & Artificial Intelligence Authority — SDAIA) in mind. It is not a substitute for legal advice, and it does not claim any specific certification or accreditation Relay has not obtained.

2. What Relay does

Relay provides a WhatsApp-based AI booking and operations service to Saudi small and medium businesses, currently mobile car washing and auto repair / body shop businesses in the Eastern Province. A business (the "Merchant") uses Relay to receive bookings, manage jobs, and communicate with its own customers over WhatsApp. Relay is not the merchant itself — each Merchant is a separate, independent business.

3. Personal data we collect

From customers, through WhatsApp conversations

• Your WhatsApp phone number
• Your name, as you provide it in conversation
• Vehicle plate number, where relevant to the service booked
• Service location — a shared GPS pin or a written address, for mobile services
• Booking details — service type, date and time, price, and payment status
• The content of your messages with the Relay assistant, to the extent needed to understand and fulfil your booking

From merchant staff, through the Relay merchant portal

• Phone number, used to sign in via a one-time passcode (OTP)
• Name and role (for example, owner or staff)

We do not ask merchant staff to create or store a password. We do not collect or store card numbers or bank account details from anyone.

4. Why we collect it

• To understand and fulfil a booking request sent by WhatsApp message
• To let a Merchant's staff see and manage that Merchant's own bookings in the portal
• To confirm payment status against the Merchant's own payment account
• To send booking confirmations and reminders
• To keep a working record a Merchant can refer back to for a returning customer

5. Who we share data with

We share the minimum data needed with the following service providers, each of whom processes data only to provide their specific service to Relay:

• Meta Platforms, Inc. — delivers WhatsApp messages between you and the Relay assistant
• Moyasar — a Saudi-licensed payment gateway; processes payment for a booking through the Merchant's own Moyasar account. Relay does not hold or process funds itself
• Authentica (authentica.sa) — a Saudi OTP provider; delivers the one-time passcode used by merchant staff to sign in to the portal
• Supabase — hosts our database. Data is stored on infrastructure in the AWS Mumbai (ap-south-1) region — see Section 6 on cross-border storage
• Anthropic (Claude API) — processes the text of a booking message to interpret informal date and time expressions (for example, "tomorrow at 10" in Gulf Arabic), so the assistant can correctly schedule a booking
• Railway — hosts the automation workflows that process bookings and messages
• Vercel — hosts the merchant portal and this website

We do not sell personal data, and we do not share it with any party for their own marketing purposes.

6. Where your data is stored

Our database is hosted in the AWS Mumbai (ap-south-1) region. There is no Bahrain or UAE region available from our database provider at this time, so your data is stored outside Saudi Arabia. Saudi Arabia's PDPL regulates transfers of personal data outside the Kingdom, and we take reasonable steps to limit what is transferred and to work only with providers that maintain appropriate technical and organizational safeguards. If you have questions about this, contact us using the details in Section 10.

7. How long we keep your data

We keep booking and customer conversation data for as long as your relationship with a Merchant is active, and for a reasonable period afterward to support returning bookings, resolve disputes, and meet the Merchant's own tax and accounting obligations. We keep merchant staff account data for as long as that staff member has access to the portal, plus a reasonable period after removal for account security and audit purposes.

8. Your rights, and how to exercise them

Under the PDPL, you can ask to see the personal data we hold about you, ask us to correct it, or ask us to delete it, subject to any legal or legitimate business reason we may have to keep it (for example, a Merchant's tax records). To make a request, email m16.alalawi@gmail.com from the phone number or account the request relates to. We will respond within a reasonable time.

9. Security

We use industry-standard access controls, including per-business data isolation in our database and restricted access to production systems. Relay is a small, actively-developing platform — we do not currently hold any specific third-party security certification, and we will update this policy if that changes.

10. Contact

For any privacy question or request, contact Mustafa Ahmad Alalawi Establishment at m16.alalawi@gmail.com.

11. Changes to this policy

We may update this policy as Relay grows or as our legal obligations change. We will update the "Last updated" date above when we do. Continued use of Relay after an update means you accept the revised policy.