Privacy Policy

This is the same document shown at app.relayant.net. If they differ, the one in the app applies.

This policy explains how Relayant (Relayant, we, us), collects, uses, holds and discloses personal information through the Relayant service: the portal, the API, the relay, and the Boxes and Agents installed at customer sites.

We follow the information privacy principles of the New Zealand Privacy Act 2020 and, for information about people in Australia, the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Relayant is a business service. We hold personal information in two ways: as the business responsible for it (for example, the people who use our customers' accounts), and on behalf of our customers (for example, information about their own clients and about devices at their sites). Section 13 explains the second.

1. Who we are

1.1 Relayant is a New Zealand business.

1.2 Our privacy officer can be reached at [email protected].

2. What we collect

2.1 Account information. For each user: work email address, role (owner, operator or viewer), password (stored only as an Argon2id hash, never in a form that can be read back), whether multi-factor authentication is on (its secret is encrypted), sign-in times, failed sign-in counts and invitations. For each customer: organisation name, the description chosen at sign-up (for example “security installer”) and plan.

2.2 Sign-up details. When an account is opened through the sign-up page we keep the IP address and browser description (user agent) it came from, the referring page, and any campaign tags in the link (such as utm_source), to prevent abuse and to understand how people find us. We also record which version of our Terms of Service and this policy each new user agreed to, when, and from which IP address and browser.

2.3 Site and device information. The names, addresses and notes you give your sites. For each device a Box or Agent finds on a site network:

• its MAC address and local IP address;
• its manufacturer, which we look up from the MAC address in our own copy of the public IEEE registry (no address, or part of one, is sent to an outside lookup service);
• its model, where it can be determined;
• names it announces on the network, such as DHCP, mDNS or NetBIOS names;
• its open ports and short replies to standard protocol requests, such as HTTP server headers and page titles, RTSP and ONVIF device information, and SNMP or BACnet identity; and
• the names and labels your users give it.

A MAC address, IP address or device name is personal information where it can be linked to a person, for example a phone on a home network.

2.4 Box and Agent telemetry. The identity and software version of each Box or Agent, its regular check-ins, the internet address it connects from, the state of its tunnel, and how many bytes have passed through our relay for each site.

2.5 Device health. The results of health checks on devices you choose to monitor, changes in their state and hourly availability. Any credentials you give us for health checks (such as SNMP community strings) are encrypted.

2.6 Alerts, alarm signals and notifications. Alert records, alarm signals (for example account numbers and event codes sent by SIA DC-09), and the destinations you set up: email addresses, phone numbers for SMS, webhook addresses, and Microsoft Teams and Slack addresses (which are encrypted), with a record of what was delivered and when.

2.7 Reports. Monthly PDF reports, the email addresses they are sent to, and logos and other branding you upload for them.

2.8 Audit log. A record of significant actions in your account, by your users, by the system and by our support staff: who did what, when, and from which IP address.

2.9 Billing information. Billing email address, plan, subscription status, invoices, and the brand and last four digits of the card on file. Card details are entered on Stripe's own pages and never reach our servers: we do not see or store full card numbers.

2.10 Support. The emails you send us and our replies.

2.11 Server logs. Our servers log requests (time, IP address, path and result) for security and troubleshooting. Logs are rotated automatically and are not archived.

2.12 Video and camera streams are not recorded. When your monitoring software views a camera or recorder through our relay, the stream passes through the relay in real time. We do not record, store, inspect or analyse video, audio or images. We count only how many bytes passed, for billing and capacity. Health checks talk to a device only enough to see whether it answers (for example, an RTSP OPTIONS request); they never ask for a video stream and never log in to a device.

3. Cookies and browser storage

3.1 We use only the cookies the portal needs to work:

• a session cookie that keeps you signed in. It cannot be read by scripts in the page, is sent only to our own site, and expires after at most 12 hours; and
• a trusted-device cookie, only if you tick “Remember this device” when entering a second factor. It lasts 30 days.

3.2 The portal also keeps a few preferences in your browser's local storage, such as light or dark mode, which sidebar groups are open, and your organisation's portal theme. They never leave your browser.

3.3 We do not use analytics, advertising or tracking cookies, and the portal loads no third-party scripts. Its fonts are served from our own site. Cloudflare, which protects our website, may set strictly necessary security cookies of its own.

4. How we use information

4.1 We use personal information to:

• provide the Service: discovery, health checks, remote access, alerts, alarm signals and reports;
• create and secure accounts, sign people in and confirm their email addresses;
• detect, prevent and investigate abuse, fraud and security incidents;
• bill for the Service and collect payment;
• answer support requests;
• send service emails, such as confirmation links, invitations, alerts and reports;
• improve the Service, including how it identifies devices, using technical information that does not identify anyone; and
• comply with the law and enforce our Terms of Service.

4.2 We do not sell personal information, and we do not use it for advertising.

4.3 We do not currently send marketing emails. If we start, we will send them only where the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Cth) allow, and every one will let you unsubscribe.

5. Why we may use it

5.1 We collect personal information only for lawful purposes connected with providing the Service, and only what we need for them (IPP 1; APP 3).

5.2 In particular, we rely on:

• our contract with you: to provide what our Terms of Service promise, including billing;
• our legitimate interest in keeping the Service secure, preventing abuse and improving it, in ways people would reasonably expect;
• legal obligations, such as keeping tax records and notifying privacy breaches; and
• your organisation's choice, for optional features such as AI device identification (section 6), which an owner must turn on and can turn off.

5.3 We collect most information directly from you or your users, or from the Boxes and Agents you install. Some comes from Stripe (payment status) and from the devices on your site networks.

6. AI device identification (optional)

6.1 AI identification is off unless an owner of your organisation turns it on, and an owner can turn it off at any time. While it is off, nothing about your devices is sent to an AI provider.

6.2 When it is on, and our own rules cannot identify a device with confidence, we send a summary of that device's technical evidence to the AI provider we use, which is either Google (Gemini) or OpenAI. The summary contains things like the manufacturer, open ports, and words from protocol replies that describe the device type and model.

6.3 Before anything is sent, we remove MAC addresses, IP addresses, serial numbers, email addresses, web addresses and host names, and any names that look like they identify a person or a site (including the device's own name and your site's name). A device whose evidence still fails our checks is not sent.

6.4 The scrubbed summary and the provider's answer are kept in a shared cache for up to 180 days, so a similar device can be identified again without another request.

6.5 How a provider may use what it receives depends on the provider's own terms for the service we use. Under some providers' free or trial services, the provider may use the data sent to improve its products; under their paid services, they state they do not. This is one reason we remove device identifiers before anything is sent, and the feature stays off unless your organisation switches it on. Their answers are suggestions only; nothing changes unless one of your users accepts one.

7. Who we share it with

7.1 We use these service providers to run Relayant. Each receives only what it needs for its purpose.

7.2 Remote-access traffic from a Box or Agent reaches our relay directly, over its encrypted tunnel; it does not pass through Cloudflare.

7.3 Destinations you choose. When you set up an alert or report destination, such as an email address, a webhook, a Microsoft Teams or Slack channel, or an alarm receiver at a monitoring centre, we send the alerts, signals or reports you have asked for to it. Those recipients are chosen by you, not by us.

7.4 We may also disclose information to our professional advisers, to a buyer of our business (who must protect it as this policy does), or where the law requires or permits it, for example to prevent a serious threat to someone's life or health, or in response to a lawful request from a court or authority.

8. Sending information overseas

8.1 Some of the providers above store or process information outside New Zealand and Australia, mainly in the United States, as the table in section 7 shows.

8.2 Where a provider holds information only to provide a service to us, it does so on our behalf and we remain responsible for it. Before we disclose personal information to anyone overseas for their own use, we make sure it will be protected by safeguards comparable to those in the New Zealand Privacy Act 2020 (IPP 12), and we take reasonable steps, including contractual terms, to make sure overseas recipients handle it in line with the Australian Privacy Principles (APP 8).

9. How long we keep it

9.1 We keep information only as long as we need it. The Service deletes these automatically:

9.2 Account, site and device information, alerts and alarm signal records, bandwidth records, legal acceptances and the audit log are kept while your organisation's account is open, so that you can see your history. When the account ends they are deleted as clause 10 of our Terms of Service describes, except for records we must keep by law, such as invoices and tax records.

9.3 When you remove a device or a site, its information is removed from the portal; some records of it may remain in the audit log and in backups until they are deleted as above.

10. How we protect it

10.1

• Encryption in transit. The portal and API are served only over HTTPS. Boxes and Agents connect to our relay through encrypted WireGuard tunnels.
• Secrets encrypted at rest. Second-factor secrets, health-check credentials, webhook and messaging addresses, relay keys and AI provider keys are encrypted with AES-256-GCM using a key kept outside the database.
• Passwords and tokens. Passwords are hashed with Argon2id. Session, confirmation, invitation and device tokens are stored only as one-way hashes.
• Multi-factor authentication. Available to every user, and always required for our platform administrators.
• Separation between customers. Every request is limited to the signed-in user's own organisation.
• Restricted access to devices. A relayed device can be reached only from the internet addresses its owner allows, unless the owner deliberately opens it wider.
• Audit log. Significant actions are recorded, including every action our support staff take while viewing your account, under their own name.
• Limits on abuse. Sign-in attempts are limited and accounts lock after repeated failures; sign-up and other public requests are rate-limited.
• Backups. Encrypted nightly backups are kept off-site.

10.2 Between our relay and your monitoring software, a relayed device is reached using its own protocol (for example RTSP), which may not be encrypted. You can choose which addresses may connect.

10.3 If a privacy breach is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as the Privacy Act 2020 requires, and, where the Notifiable Data Breaches scheme applies, the Office of the Australian Information Commissioner and affected individuals. Where the breach affects information we hold for a customer, we will tell that customer without undue delay.

11. Access and correction

11.1 You may ask for access to the personal information we hold about you, and ask us to correct it (IPP 6 and 7; APP 12 and 13). Many details, such as your email address, password and second factor, you can change yourself in the portal.

11.2 Email [email protected]. We will confirm your identity first, and will respond within 20 working days (or within 30 days for a request under the Australian Privacy Principles). Access is free unless the law allows a reasonable charge, which we would tell you about in advance. If we refuse a request, we will tell you why and how to complain.

11.3 If your information is held in a customer's account (for example, you are a client of a monitoring centre that uses Relayant), we will pass your request to that customer and help them respond.

11.4 You can ask us general questions without identifying yourself, but we cannot provide an account without an email address.

12. Complaints

12.1 If you are concerned about how we have handled your personal information, please contact our privacy officer at [email protected]. We will acknowledge your complaint promptly and aim to resolve it within 20 working days.

12.2 If you are not satisfied with our response, you can complain to:

• in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); or
• in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).

13. Information we process for our customers

13.1 Our customers decide what devices, sites, clients and destinations they put into Relayant. For personal information about their End Clients, about people at their sites, and about the devices on those networks, the customer is responsible for it under privacy law (as the agency or APP entity that holds it), and we hold it on the customer's behalf, as its agent and processor, under section 11 of the Privacy Act 2020 and our Terms of Service.

13.2 For that information, we:

• use it only to provide the Service to the customer and as the customer instructs;
• do not use it for our own purposes, except technical information that identifies nobody (section 4);
• keep it confidential and protect it as section 10 describes;
• use only the providers listed in section 7, and tell customers before we add a new one;
• help the customer respond to requests from individuals, and tell the customer of any breach affecting it;
• delete it when the customer's account ends, as our Terms of Service describe.

13.3 Customers are responsible for telling their End Clients and the people at their sites how their information is handled, including that it is held by Relayant on their behalf, and for any consents the law requires.

14. Children

14.1 Relayant is a service for businesses and is not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe we have, please contact us and we will delete it.

15. Changes to this policy

15.1 We may update this policy. Each version is published at this address with its version number and effective date. If a change materially affects how we handle your information, we will tell your organisation's owners by email or in the portal before it takes effect.

16. Contact us

16.1 Privacy officer, Relayant
Email: [email protected]

Relayant · Terms of Service · Questions: [email protected]