Document 3: Privacy Policy
Plain-language summary: This explains how Relae handles personal information. Two situations differ. For information about you, our website visitors and the staff who hold accounts, we decide how it is used, so we are the controller. For donor information a charity puts into Relae, the charity is in charge (controller) and we only handle it on the charity's instructions (processor). If you are a donor with a question, contact the charity, not us, and we will help the charity respond. This policy describes what actually happens today. Experimental pilot features and future features that are not yet running are described separately, in Document 13 and the Benchmark Cooperative terms, and are not part of the processing below.
Current processing. Everything in this Privacy Policy describes processing that runs today for all organizations. Pilot and future capabilities are covered elsewhere and are not described here as if they were live.
1. Two roles, made clear
This policy covers two situations: (A) information for which Relae is the Controller (Website Data and Customer Account Data); and (B) Donor Data, for which the Customer charity is the Controller and Relae is only the Processor. The detailed processor terms are in the Data Processing Agreement (Document 4).
2. Information we handle as Controller
Website Data: for inquiries, access applications and beta waitlist requests, we collect your work email and declared organization region (Canada, United States, European Union, or Global / elsewhere). Selecting Canada or the United States records the corresponding country; for European Union and Global inquiries, a specific country is optional. We also collect the name, organization, primary need, Canadian charity number and message you choose to provide. We record the site region and inquiry type separately from your declared organization region, and submitted campaign source, medium, campaign name and entry-page information. Campaign fields are limited to 120 characters each and entry pages to recognized marketing paths; we do not collect the full referring URL for this purpose. Do not include donor records or sensitive personal information in an inquiry.
We use inquiry information to respond, administer the request or waitlist entry, understand demand by declared region, country where provided and organizational need, and evaluate inquiry sources. Submitting an inquiry does not create a customer account. We record the request's network address to prevent abuse. We also record the privacy notice version, time, name, email, browser information, network address and form wording version associated with an affirmative submission. These records document collection, not acceptance of a subscription or enrollment in unrelated promotional communications. Reply to beta correspondence or contact privacy@relae.ai to ask to leave the waitlist or stop those updates.
Our hosting provider supplies an IP-derived country indication to choose an initial marketing page. You can select another region. This is approximate routing, not a determination of your residence, nationality, legal rights or organization eligibility. Inquiry country is the country you provide, not one inferred from your IP. Technical request information is also processed to serve and secure the website.
Customer Account Data: when an organization creates an account, we collect staff names, emails, roles, and login credentials. We also store staff profile photos (avatars) that an organization or its users choose to upload. We use this information to respond to enquiries, provide and administer the Platform, secure accounts, communicate operationally, and comply with law.
A note on staff avatars: staff profile photos are stored in a storage location that is publicly accessible if the file address is known. We tell you this plainly so you can decide what to upload. Donor photographs, by contrast, are stored in a private, access-controlled location. If you would prefer your staff avatar not be stored this way, you can use a non-identifying image or none.
Agreement Records: when your organization enters into an agreement with us, we keep a record of it. Where you accept our terms online, that record is the document accepted, its version, a cryptographic hash of the exact text shown to you, the name and email of the person who accepted, the date and time, and the network address and browser the acceptance was made from. Where your organization signs an Order Form, the record also includes the signer's name, title and email, the signature image, and a completion certificate produced by our signing system, which lists when the document was opened, signed and completed and the network addresses those actions came from. We use Agreement Records for one purpose: to establish what was agreed, by whom, and when. We do not use them for marketing, analytics, or profiling, and we do not disclose them except to our professional advisers or where law or legal process requires. Our signing system runs on infrastructure we operate in your own Region, so a signed agreement is not sent to a third-party signing service.
3. Donor Data: what the charity's data includes
Donor Data is the personal information a Customer charity records in the Platform about its donors and prospects. As well as the basics (names, contact details, giving history, relationship notes), the Platform records or derives the following categories, which we list so the picture is complete:
---------------------- ------------------------------------------------
**Category** **What it is**
Access, affinity, and Staff-assigned or tool-suggested ratings of a
capacity (AAC) ratings donor's connection to the organization and
likely capacity to give. Suggestions are
confirmed by a person.
Prospect typing and Categorization of prospects into types or tiers
tiering to help staff prioritize their work.
Predictive lifetime Model-generated estimates of a donor's likely
value and lapse long-term giving and the likelihood that they
likelihood are still an active giver, produced by a
statistical model from the organization's own
giving history.
Model-derived wealth Estimated ranges for a donor's giving capacity,
and capacity ranges derived by the Platform. These are estimates to
aid staff judgment, are shown as suggestions,
and are confirmed or overridden by a person.
They are not automated decisions about the
donor.
Event attendance Records of a donor's attendance at an
organization's events, including data read in
from an event provider where the organization
connects one (see Document 4).
Donor photographs Photographs of a donor where the organization
chooses to add them, stored in a private,
access-controlled location.
Official receipt data The content of official donation receipts the
(where the charity issues through the Platform (donor name,
organization has gift and issue dates, amounts, any advantage and
enabled receipt eligible amount, receipt number), and duplicate
issuance) copies of issued receipts retained for the
charity's CRA record-keeping. Issuance operates
only for organizations that have expressly
enabled it; see Document 11.
Organization data Information about charitable organizations drawn
derived from public from public CRA and open-government sources,
CRA filings used for context. For these lookups Relae sends
only a charity's business number.
---------------------- ------------------------------------------------On the derived categories and "profiling": some of these categories (capacity ranges, predictive values, ratings) are the kind of thing that can look like automated profiling. We want to be accurate: these are aids that a member of staff sees as a suggestion and confirms or changes. The Platform does not make a decision that produces a legal or similarly significant effect about a donor by automated means alone. The one exception to human confirmation is a duplicate-record merge, described in section 6.
4. Donor Data: the charity is in charge
Donor Data is processed by Relae only on the instructions of the Customer charity, which is the Controller. We do not use Donor Data for our own purposes, except to provide the Services. If you are a Donor with a privacy request, please contact the charity that holds your information; Relae will assist the charity in responding.
5. Where data is stored and processed, and cross-border transfers
Website inquiries and correspondence. Relae Inc., a Canadian corporation based in Toronto, Ontario, is responsible for Website Data. Website hosting and requests use Vercel; inquiry and submission records are stored using Supabase. Where email is configured, Resend handles inquiry confirmations and internal notifications. Internal notifications contain inquiry information, so copies also pass through operators' email systems. Authorized personnel may access these records from Sweden. Website processing is distinct from Canadian donor hosting. Provider infrastructure, email delivery, support access and recipients' mailboxes may involve processing outside Canada or your country. Contact privacy@relae.ai for information about the safeguards applicable to a particular transfer and how to obtain available information about them. Selecting a marketing region does not promise local data storage.
Our regional model. Relae deploys regional data infrastructure so that a customer's Donor Data is stored and processed in that customer's own region, rather than pooled into a single location. Today, Relae operates one region, Canada, and every current customer is served from it; the Canadian specifics are described below. As Relae opens additional regions, each region's infrastructure and any region-specific details will be described in the same way, and a customer will be told which region serves it. This policy does not describe infrastructure for regions that are not yet operating.
Who operates and contracts with you, in every region. Across all regions, the company you contract with and that operates the Platform is Relae Inc., a Canadian corporation with its registered office in Toronto, Ontario. This is a constant of the service and does not change from region to region. Some of the personnel who operate and support the service work from Sweden, in the European Union, and may access the system from there. We state this plainly rather than let regional data storage imply that every part of the arrangement is local to your region. Relae Inc. and its personnel are bound by the data-protection, security, and confidentiality obligations described in this policy and the DPA, wherever that access occurs and whichever region serves you.
The Canadian region (current). For customers served from the Canadian region, Donor Data is stored in Canada in the Supabase ca-central-1 region, and application compute runs in Canada (Montreal). The interactive AI features (donor-capture assistance, coaching suggestions, thank-you drafting, and the "Ask Relae" assistant) run in Canada, on Amazon Nova through AWS Bedrock in a Canadian region. For these features, Donor Data is processed in Canada.
Within the Canadian region, there are two deliberate flows where limited information is processed outside Canada, and we describe them precisely:
- Donor research (opt-in, per organization). If an organization turns on donor research for a prospect, Relae sends that prospect's name together with public identifying context the organization already holds, specifically the entity type, city, education, and known employer, board, or company affiliations, plus web-search queries, to AI and web-search services in the United States, in order to find and confirm the right person and gather publicly available information. This feature never sends the private record: no giving history, no amounts, no AAC or capacity ratings, no prospect type or tags, and no notes. These are removed before the request is made. This transfer happens only when the organization has opted in, and exactly what is sent and what is never sent is shown at the point the feature is turned on.
- Funder research (organization name only, off by default). A weekly research feature, available only under a specific entitlement that is off by default, sends organization names and research topics (not donor personal information) to AI and web-search services in the United States.
Where information is processed or accessed outside a customer's region, whether by personnel operating the service from Sweden or by the research services described above, it may be subject to the laws of the country involved, including lawful access by authorities there. We make the disclosures applicable law requires and impose comparable protection by contract on each party that handles the data. Because operational access from Sweden and the research transfers are standing features of the service rather than temporary ones, where we process personal information of Quebec residents we conduct the privacy assessment Quebec Law 25 requires for transfers of personal information outside Quebec, and we obtain the consent Law 25 and PIPEDA require, both for the operating arrangement and for the donor-research transfer.
6. Automated processing and human involvement
AI outputs in the Platform are suggestions that a person reviews and confirms. No decision producing a legal or similarly significant effect about a Donor is made by automated means alone. Where Quebec Law 25 applies, a donor has the right, through the charity as Controller, to be informed of and to contest a decision based exclusively on automated processing; Relae's features are designed so that a person stays in the loop. The one automated exception is a duplicate-record merge ("dedupe"): the Platform can merge records it identifies as duplicates. This runs only where an organization has turned it on, is off by default, and is reversible.
7. Sharing and sub-processors
We share personal information with the service providers (Sub-processors and connected data sources) listed in the DPA, who process it under contract or at the organization's direction. We do not sell personal information, and we do not sell, broker, or share individual Donor Data. We do not use third-party advertising trackers, marketing pixels, session recording, or chat widgets.
8. A future capability: the Benchmark Cooperative
Dormant future capability. The Benchmark Cooperative is not running. An organization can record its consent to take part in the future, but no donor-derived data is pooled or shared today.
The Platform lets an organization opt in to a future Benchmark Cooperative. Opting in records the organization's consent to contribute de-identified, aggregate figures if and when the cooperative launches. Today, the comparison an organization sees is its own numbers shown next to published sector figures from the Association of Fundraising Professionals; nothing from one organization is pooled with or shared to another. If the cooperative is built, it will be described and governed before any pooling begins (see the Benchmark Cooperative Terms, Document 8).
9. Legal bases and consent
For information subject to Canadian privacy law, we obtain meaningful consent where required and rely on an exception only where applicable law permits it. A GDPR legal basis does not create a general legitimate-interest exception under Canadian law.
Where EU or UK GDPR applies to Website Data, we rely on legitimate interests in handling professional inquiries and requested waitlist entries, understanding regional demand and preventing abuse, subject to necessity and individuals' rights. Where we take steps at your request toward a contract with you personally, the contractual basis may instead apply; representing an organization does not itself make you a party to its contract. Optional promotional email requires specific consent where applicable law requires it. You may withdraw consent without affecting earlier lawful processing or your ability to inquire. Limited compliance records may be kept for applicable legal obligations or legitimate interests in establishing or defending legal claims, only where that basis's requirements are met. Canadian tax law does not itself create an EU or UK GDPR legal-obligation basis.
For Customer Account Data, we obtain consent where required and process information to administer and secure the account and fulfill our agreement with the organization, subject to applicable privacy law. For Quebec residents, we provide the transparency information Law 25 requires at or before collection, including the purposes of collection, the categories of third parties to whom information may be disclosed, and whether information is transferred outside Quebec. For Agreement Records, Relae relies on the necessity of the processing to enter into and perform the contract with your organization, and on its legitimate interest in establishing, exercising and defending its contractual rights, and on the legal obligation to keep them described in section 10. Relae has designated a person responsible for the protection of personal information, reachable below.
10. Retention
We keep personal information only as long as needed for the purposes described or as required by law. We retain Website Data for up to twenty-four (24) months from last contact, and Customer Account Data for the life of the account plus ninety (90) days. Donor Data retention is governed by the Customer's instructions and the DPA. Where an organization has enabled receipt issuance, duplicate copies of issued receipts are retained while the organization's subscription is active and are included in the organization's data export; after export, the charity is responsible for retaining them for the period CRA requires, as the DPA describes.
Inquiry and beta-waitlist privacy acknowledgments remain Website Data; they are not executed subscription agreements and do not automatically inherit the executed-contract retention period below. Withdrawals and objections are handled under applicable law; contact privacy@relae.ai. Longer retention requires a specific legal requirement or documented dispute. Sending another promotional email does not itself restart the inquiry retention period.
Agreement Records are a deliberate exception to the periods above. This exception applies to agreements actually entered into. We retain a signed Order Form, its completion certificate, and the record of any online acceptance until the end of the seventh calendar year after the calendar year in which the term of that agreement ends.
The period is set by Canadian law, not chosen by us. An executed agreement is one of the records Relae Inc. must keep under section 230 of the Income Tax Act (Canada), which requires records to be kept for six (6) years from the end of the last taxation year to which they relate. For a multi-year agreement, that is the taxation year in which its term ends. Because a taxation year need not end on 31 December, we count to the end of the following calendar year and then add the six years, so the period is never shorter than the law requires. A three-year price lock converted in 2027, with its term ending in 2030, is retained until the end of 2037.
Agreement Records are not deleted when an account closes. They are held in your own Region, and contain no Donor Data.
11. Your rights
Depending on your province, you may have rights to access, correct, or withdraw consent regarding your personal information, and, under Quebec Law 25, rights to data portability and rights concerning decisions based exclusively on automated processing. You also have the right to complain to the Office of the Privacy Commissioner of Canada, at www.priv.gc.ca, or to the privacy regulator in your province. For information Relae controls, contact us below. For Donor Data, contact the charity that holds your information; we will assist the charity in responding within legal timelines.
Where EU or UK GDPR applies, you may have rights to access, correction, erasure, restriction, portability where applicable, and objection to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent without affecting earlier lawfulness. Contact privacy@relae.ai. We respond within the applicable period, ordinarily one month for EU or UK GDPR requests; lawful extensions and exceptions may apply. You may complain to a competent supervisory authority, including in the EEA country where you live or work or where an alleged infringement occurred, or to the UK Information Commissioner's Office where appropriate. Other local laws may provide additional rights and complaint or appeal routes; contact us to exercise applicable rights. A site region or organization country does not waive your rights.
12. Security and breach
We use the safeguards described in Schedule 1 to the DPA. If a breach of security safeguards creates a real risk of significant harm, we will report to the Office of the Privacy Commissioner of Canada and notify affected individuals or the relevant Controller as required by PIPEDA and applicable provincial law, including Quebec Law 25, keep the records the law requires (including a register of confidentiality incidents), and assist Customers with their obligations. Relae maintains a documented breach-response procedure and a designated privacy officer.
Where other privacy laws apply, we assess and make the notifications they require. Under EU or UK GDPR, this includes notifying the competent authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to create a risk to individuals' rights and freedoms, and notifying affected individuals without undue delay where the required high-risk threshold is met.
13. Children
The Platform is for organizational use by adults. Donor Data may occasionally include information about minors; the Customer, as Controller, is responsible for any consent required, and Relae processes such information only on the Customer's instructions.
Our inquiry and beta-waitlist forms are intended for adults acting in a professional or organizational capacity. Do not submit children's personal information through them. Contact privacy@relae.ai if you believe a child has submitted information so we can assess and address it under applicable law.
14. Contact and changes
Questions, or to reach our privacy officer: privacy@relae.ai. We may update this policy and will revise the date below.
Last updated: 19 October 2026.