Privacy Policy

1. Who is responsible

For your account data, Open4Growth is the controller. For the recipients you add (phone numbers, names, references, messages), you are the controller and Relayr acts as your processor: we process that data only to schedule and send your messages. Contact: contact@open4growth.com.

2. What we process

Account: your name or business name, email address and a salted, hashed password (we never see your password).

Messages you schedule: recipient phone number, optional name/details and reference, the send date and time, your message template and optional custom text, and the delivery status.

Phones: for iPhone, a hashed device key and your pause setting; for Android, the SMS Gateway username and password you connect.

Contact form: your name, email, reason and message.

Technical data: IP address and browser information processed by Cloudflare for security, bot protection and logs.

3. How it is protected

Recipient phone numbers and Android gateway credentials are encrypted with AES-256-GCM before they are stored, using a key kept separately from the database. They are decrypted only to send a message or when you press “Show phone number”.

Names, references and message texts are stored unencrypted so they can appear in your calendar — do not put sensitive data (such as health data) in them.

Passwords are hashed with PBKDF2, device keys and reset links are stored only as hashes, all traffic uses HTTPS, and sign-in, registration, password reset and contact are protected by Cloudflare Turnstile.

4. Why we process it (legal basis)

To provide the service you signed up for — contract (GDPR Art. 6(1)(b)).

To keep Relayr secure and prevent abuse — legitimate interest (Art. 6(1)(f)).

To answer your contact messages — legitimate interest, or steps before a contract.

Recipient data: you must have your own legal basis to message your recipients (for example an existing customer relationship or their consent). Marketing SMS without consent are not allowed.

5. Who else processes it

Cloudflare, Inc. — hosting, database (Cloudflare D1), security, Turnstile bot protection and Web Analytics (cookieless, aggregate visit statistics).

Brevo (Sendinblue SAS, France) — sending password-reset emails and forwarding contact messages.

SMS Gateway for Android (sms-gate.app) — only if you connect an Android phone in Cloud mode: the message text and recipient number pass through its server to reach your phone.

Apple — on iPhone, messages are sent by the Shortcuts app on your own device. If you use the Cherri Playground to build a Shortcut, the code you paste (which includes your device key) is processed by that third-party site.

Your mobile carrier delivers the SMS. Some providers may process data outside the EU; where this happens, it relies on EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Account and message data: while your account exists. When you delete your account (Settings → Profile), your account, messages, phones and gateway credentials are deleted immediately from the live database; backups roll over within 30 days.

Password reset links: until used or at most 1 hour.

Contact messages: in our email inbox for as long as needed to handle your request, then deleted.

Security logs kept by Cloudflare: according to Cloudflare's retention, usually a few days.

7. Your rights

Under the GDPR you can access, correct, delete, restrict or export your data and object to processing. You can edit your profile and delete your account yourself in Settings. For anything else, write to us via the contact page; we answer within 30 days.

Recipients of your messages should contact the business that messaged them; we will help that business respond.

You can also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or the authority in your country.

8. Children

Relayr is not intended for people under 16, and we do not knowingly collect their data.

9. Changes

If we change this policy in a meaningful way, we update the date above and, for important changes, tell account holders by email.