Relay privacy policy

Who runs Relay

Relay is run by Wonder & Workflow LLC ("we", "us"). Our mailing address is 2505 S River Rd, Ste 2 #2003, St George, UT 84790, United States.

For anything about your data, email operations@wonderworkflow.com.

What data Relay collects

Relay only collects data from the Slack workspace that installs it. It collects:

About the workspace

• The workspace ID and name, and the Enterprise Grid ID if there is one.
• The Slack user ID of the person who installed Relay, the permissions (scopes) they approved, and when.
• Relay's own bot user ID and the access token Slack gives Relay. The token is stored encrypted.

About channels

• The ID and name of each channel Relay is invited to, whether it is private, and when Relay joined.

Messages

• Messages posted in channels Relay has been invited to, and direct messages people send to Relay. For each message Relay keeps the text, the sender's Slack user ID, the channel ID, the message and thread timestamps, and whether it was edited or deleted. Message text is stored encrypted.
• When a message is edited in Slack, Relay replaces its copy. When a message is deleted in Slack, Relay clears its copy of the text.
• Replies your assistant posts through Relay, and a short daily summary of messages that did not need a reply.
• A log of when your assistant was notified about a message, or why it was not (for example, nobody mentioned it).

Relay does not read channels it has not been invited to, and it does not read direct messages between other people.

About your assistant connection

• The label and web address (webhook) of the assistant you connect, and the keys used to sign and check messages between Relay and your assistant. Signing keys are stored encrypted. Your assistant's access token is stored only as a one-way hash, so we cannot read it back.
• A business name, if one is given during setup, and a contact email, if you give us one when we set you up.

Sign-in and security records

• When a workspace admin signs in to Relay's settings page with Slack, Relay keeps a session record with their Slack user ID and workspace ID, and sets a sign-in cookie in their browser.
• IP addresses and times of sign-ins, setup requests and settings changes, to limit abuse and keep a history of changes.

Data Relay receives but does not use or keep

• When someone signs in with Slack, Slack sends Relay their name and email address. Relay does not store or use them. It only uses the Slack user ID and workspace ID.
• Slack message events include more than Relay keeps, such as file details, attachments and formatting data. Relay drops everything except the message fields listed above.
• Relay looks up people's names, time zones, admin status and guest status from Slack only at the moment it needs them: to set a reminder at the right local time, to check that someone is a workspace admin, to check that the person reconnecting Relay is a workspace admin or owner, to name the person who added Relay in its one-time channel introduction, and to check whether a channel has guests before your assistant posts there. It does not store that profile data.
• If a message contains something that looks like a password, API key or token, Relay replaces it with "[REDACTED SECRET]" before storing the message.

How Relay uses the data

Relay uses the data only to run Relay for your workspace:

• To tell your assistant when someone mentions it, sends it a direct message, or uses a wake word your workspace chose.
• To let your assistant read recent messages and post replies, reminders and summaries in your Slack.
• To send your assistant a daily summary of messages that did not wake it.
• To show each person a Home tab in Slack with the channels they share with Relay, how long messages are kept, and help links. Nothing is stored and your assistant is not notified when someone opens it.
• To answer some direct messages itself with fixed text, not AI: help when someone asks for it, and a short note when no assistant is connected, when Relay could not reach your assistant, or when your assistant has not answered yet.
• To post one short introduction the first time Relay is added to a channel. It names the person who added Relay in plain text, so nobody is pinged.
• When your assistant says which message it is answering, to check its post before it goes out, and block ones that would move content from a direct message, a private channel or a Slack Connect channel to people who should not see it. A blocked post is not sent, and Relay records that it was blocked in the security and change history. When your assistant does not say which message it is answering, the post goes out, and Relay records the target channel, whether it is a direct message, and which assistant posted it (no message text).
• To show your settings page, check who is allowed to see it, and keep a history of changes.
• To fix problems and keep Relay secure.

We do not use your data to build profiles of people, and we do not use data from one workspace to benefit another workspace or anyone else.

Who receives your data

Your own AI assistant

Relay does not run an AI model. Each workspace connects its own assistant, such as Grok Bot, Claude, Cursor or another assistant that supports MCP. When a message needs your assistant, Relay sends it a short notice with IDs and labels only (workspace, channel, message ID, time, thread, why it was woken and, for direct messages, that it came from a direct message), not the message text. Your assistant then reads the stored messages and posts replies through Relay, using a token that only works for your workspace.

Your workspace chooses that assistant, and its provider handles what it reads under that provider's own terms and privacy policy. We do not choose or control it. See AI and data for more.

Service providers

We use these companies to run Relay. They process data only to provide their service to us:

Relay also sends messages back to Slack through Slack's own API, because that is how replies get posted.

Nobody else

We do not sell, rent or share your data with anyone else. We do not use it for advertising. We would only disclose it if the law requires us to.

How long data is kept

• Messages, replies and daily summaries: kept for 7 days by default, then deleted. A workspace can keep them for 1, 3 or 7 days. A workspace admin or owner, or the person who installed Relay, can make the period shorter on the Relay settings page, but not longer. We can also set it, and only we can make it longer again; email operations@wonderworkflow.com to ask. A cleanup job runs once a day, so an item can last up to one extra day.
• Workspace, channel and assistant connection records: kept while Relay is installed, and after removal as described below.
• Security and change history: 90 days.
• Notification log (when Relay woke your assistant, or why it did not; no message text): 30 days. The most recent time Relay woke your assistant is kept longer, so the settings page can show that the connection works.
• Sign-in and setup attempt records (IP address and time, used to limit abuse): 2 days.
• Sign-in to the settings page: a Slack sign-in lasts 14 days, then the person has to sign in again. The sign-in record is deleted when it expires.
• Setup links: a setup link that an assistant asks for on its own stops working after 24 hours if nobody uses it. The daily cleanup then deletes it.
• Single-use codes for Slack sign-in and install: they expire after 10 minutes and are deleted a day later.

The same daily cleanup job deletes all of these. None of these records hold message text.

When you remove Relay

When Relay is removed from a workspace, or its access is revoked in Slack, right away:

• Relay stops reading messages for that workspace, deletes Slack's access token, and notes the time of removal.
• All stored messages, assistant replies, daily summaries and unused pairing codes for that workspace are deleted.

For up to 13 days after removal, Relay keeps the following, so that reconnecting brings back the same setup without connecting your assistant again:

• your assistant connection (its name, web address, signing secret and one-way hash of its token);
• the sender key for your assistant's webhook, and the one address it may be sent to (stored encrypted);
• the workspace's message encryption key;
• the list of channels Relay was in;
• the workspace record (its name, IDs and Relay settings, without the Slack access token);
• the notification log and the security and change history (no message text);
• the setup record (business name, and contact email if you gave one), and the plan record if there is one;
• sign-in records for the settings page, until they expire.

Full deletion within 14 days

Once 13 days have passed since removal, a daily job deletes everything listed above for that workspace, including its sign-in records and its security and change history. So full deletion happens within 14 days of removal, which is within 14 business days. Two things remain after that:

• If we set your workspace up ourselves, we keep the setup record (business name, and contact email if you gave one) as our own customer record. Its link to your Slack workspace and your assistant details are removed.
• One line in our own history that says the workspace was deleted, with its Slack workspace ID and the time of removal, as proof of deletion. It is deleted after 90 days with the rest of the history.

Sign-in and setup attempt records are not linked to a workspace. They are deleted after 2 days, as above.

Reconnecting before then

If a workspace admin or owner, or the person who first installed Relay, reconnects Relay within those 13 days, nothing more is deleted and your settings come back as they were. The Relay settings page shows the date by which to reconnect. Slack takes Relay out of every channel when it is removed, so after reconnecting, type /invite @Relay in each channel you want it to read again.

To have everything deleted sooner, email operations@wonderworkflow.com. We handle the request within 14 business days, as described below.

Where data is stored

Relay's app and its database both run in the United States: Vercel hosts the app in its iad1 region (Washington, D.C.), and Neon hosts the database in its iad1 region (Washington, D.C.). Relay offers no other region today.

How we protect data

• Message text, replies and daily summaries are encrypted with AES-256-GCM, using a separate key for each workspace.
• Slack access tokens and assistant signing keys are encrypted with AES-256-GCM.
• Assistant tokens, setup links and sign-in sessions are stored only as one-way hashes.
• The database keeps each workspace's data separate: every request can only see rows for the one workspace it is working on.
• Relay checks Slack's signature on every event it receives, and signs every notice it sends to your assistant.
• Relay only sends notices to secure (https) web addresses.

No AI training

Relay never uses Slack data to train an AI model, and we do not let anyone else use it to train one. Relay runs no model of its own.

No marketing email

Relay does not use Slack data to email or contact people in your workspace. If we ever want to contact users outside Slack, we will ask for permission first.

Access, transfer and deletion

You can ask us to:

• Tell you what data Relay holds about you or your workspace, and give you a copy.
• Give you that copy in a common format you can move to another service.
• Correct it, or delete it.

Email operations@wonderworkflow.com from an address we can match to your workspace, and tell us the workspace name. We reply within 2 business days and complete the request within 14 business days. Removing Relay from Slack deletes stored messages right away and everything else within 14 days, as described above. Depending on where you live, laws such as the GDPR or CCPA may give you more rights, and we will honor them.

Your workspace admins and Slack also control your Slack data. A request to delete messages from Slack itself goes to your workspace admin.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how your data is used, we will tell workspace admins before it takes effect.

Contact

Wonder & Workflow LLC, 2505 S River Rd, Ste 2 #2003, St George, UT 84790, United States.
Email: operations@wonderworkflow.com