Privacy Policy
Effective date: October 27, 2026
1. Who we are
Relay (relayto.ai) is operated by Neopolis Global, Inc. (“Neopolis”, “we”, “us”). Relay lets you share a doc with someone and the supporting context with their AI agent, guided by one purpose and your rules, and ask others for context. This policy explains what we collect when you use the Relay website, web app and MCP server at https://relayto.ai/mcp, and how we use it. Neopolis is the controller of this information. Contact: support@neopolis.ai. Neopolis Global, Inc., Mountain View, California, USA.
2. What we collect
- Account information: your email address and name, and which sign-in you used (Google or an email link). When you sign in with Google we receive your name and email from Google, nothing else from your Google account.
- What you relay: the content of relays, drafts and versions you create, including the summary, sections, purpose, rules and recipient details (name, email, role and organization) you or your agent provide, and PDF files you attach.
- Requests: requests for context you send or receive, including the recipient’s name and email, the topic, the checklist and any replies, and when the request was first and last opened, read by an agent, and started on, so its sender can see where it stands.
- Activity on relays: who opened a relay and when, whether they read it on the page or through an agent, the questions, feedback, counter-proposals and suggestions they send, and your answers. This includes questions asked in the Ask box on a relay’s page and the answers given there, and replies to Relay’s emails, which are added to the relay. To tell one agent from another we record the agent’s name from its user agent and a one-way hash of part of its network address; we do not store that address with the relay.
- Connected agents and apps: when you connect an agent through OAuth, its name, when it connected and when it was last used, and the access tokens that let it act for you.
- Technical data: our hosting provider’s request logs (which include IP addresses, browser or agent type and timestamps) for security and operations, and cookies described in section 8.
- Usage analytics: on Relay’s public site (not on relays, review pages or the app), which pages are visited, how visitors arrived (for example a search engine or a link) and their general browser and device type, counted without cookies: unique visitors are counted from a hash that changes every day, and IP addresses are not stored. From the service itself, events such as signing up, connecting an agent, drafting, sending, opening and reading a relay, with your account id and email. Never the contents of a relay.
3. How we use it
- To run Relay: create and deliver relays and requests, check that only the people you shared with can read them, show you who read what, and pass questions and answers between you.
- To send email you or the other person need: sign-in links, relay and request invitations, and notifications about replies.
- To draft relays when you start one in the web app (see section 4).
- To keep Relay secure: prevent abuse, enforce rate limits, investigate incidents and fix problems.
- To answer you when you contact support.
We do not sell personal information, we do not use it for advertising, and we do not use your relays to train AI models.
4. AI processing
Most relays are drafted by your own agent (for example Claude or ChatGPT) and sent to Relay through the MCP connector; that agent’s provider handles your conversation under its own terms. When you start a relay in the Relay web app instead, we send your request, the notes you paste and your answers to an AI model on Google Cloud Vertex AI (Gemini or Claude) to prepare the draft. Nothing is shared with anyone until you review and approve the draft.
When a reader asks a question in the Ask box on a relay’s page, we send the question, together with the version of the relay they may read and the text of its attached files, to an AI model on Google Cloud Vertex AI (Gemini), so it can answer only from what the sender approved. Questions it can’t answer from the relay, questions on the sender’s must-ask list, and questions over a daily limit go to the sender instead. The sender sees every question and every answer given about their relay.
When someone you relayed to gives the relay to their own agent, that agent and its provider process the content you approved, under the recipient’s terms with that provider. The rules you attach tell their agent what it may say, what it must check with you and what it must never do; we cannot control third-party agents, so only relay what you are comfortable with the recipient’s agent reading.
5. Who we share it with
- The people you relay to or request from: they see what you approved, your name and email, and the purpose. When you read a relay, its sender sees that you read it, when, and through which agent, along with anything you send back.
- Service providers under contract, only to run Relay: Google Cloud (hosting, database, file storage, Vertex AI), Google Sign-In, Mailgun (email delivery), and PostHog (usage analytics, in the United States).
- Legal and safety: when required by law, or to protect the rights and safety of people and of Relay.
- Business transfers: in a merger, acquisition or sale of assets, with this policy continuing to apply.
6. How long we keep it
We keep your account and relays while your account exists. You can revoke a relay at any time (readers lose access at once, and you can restore it), or delete it permanently with all its versions, readers and history. Deleting your account deletes your relays, drafts, requests you sent, attachments, connected agents and sessions. Sign-in sessions expire after 14 days. Hosting logs are kept for a limited period for security and operations.
7. Security
Relay uses HTTPS everywhere, data encrypted at rest by our hosting provider, OAuth 2.1 with PKCE for agents, per-reader access checks on every read, and short-lived tokens. No system is perfectly secure; report suspected vulnerabilities to support@neopolis.ai.
8. Cookies
We use only cookies that Relay needs to work: a sign-in session cookie (up to 14 days), a security cookie that protects forms against cross-site requests, and a short-lived cookie used during Google sign-in (10 minutes), and a cookie that remembers the browser an invitation link was first opened in, so that link works only there (up to 400 days). We do not use analytics or advertising cookies.
9. Your choices and rights
In the Relay app under Account you can download your data, disconnect agents, end other sessions and delete your account. Depending on where you live (for example the EEA, UK or California), you may also have rights to access, correct, delete, restrict or object to processing, and to data portability. To exercise them, email support@neopolis.ai; we may need to verify your identity. You can also complain to your local data protection authority. Where the GDPR applies, we process your data to provide the service you asked for (contract), to keep it secure and improve it (legitimate interests), and to meet legal obligations. Information may be processed in the United States and other countries, with appropriate safeguards where required.
If someone relayed to you or sent you a request, they gave us your name and email. You can ask them, or us, to remove it.
10. Children
Relay is not for people under 16, and we do not knowingly collect their information.
11. Changes
We will post changes here with a new effective date, and tell you by email or in Relay before material changes take effect.
12. Contact
support@neopolis.ai · Neopolis Global, Inc., Mountain View, California, USA