This notice supplements our Privacy Policy. It explains how your data is processed when you use the AI Steward at steward.relyd.co. For everything not set out here, the Privacy Policy applies.
1. Who is responsible
- Content of your work in the Steward (tasks, answers, approvals, memory entries and data from connected systems) is processed on behalf of the organisation that gave you access, usually your employer. It is the controller; relyd is its processor under the DPA. For questions about this content, please contact that organisation first.
- Your sign-in and the operation and security of the Steward are the responsibility of the relyd company named in section 1 of the Privacy Policy: relyd Limited, 3 Ballsbridge Park, Dublin, D04 C7H2, Ireland, for the European Union, the European Economic Area, the United Kingdom, Switzerland and Liechtenstein, and relyd Inc., 28-07 Jackson Ave, New York, NY 11101, USA, for all other countries.
Contact for all data protection matters: privacy@relyd.co.
2. Which data is processed
Sign-in. You sign in with your relyd account. The Steward receives from relyd: your name, e-mail address, the identifier of your account, your organisation and whether the sign-in was confirmed in two steps. The Steward never receives or stores your password.
Your work in the Steward:
- the tasks you give and the answers of the Steward;
- each step the Steward takes, with its result;
- approvals and rejections, with your name and the time;
- memory entries, skills and schedules that you propose or approve;
- data from the systems your organisation has connected, as far as a task needs it.
Technical data. For operation and security, the server records the time, the address called and the status of each request, without the content of your tasks.
3. Purposes and legal bases
- Providing the Steward on behalf of your organisation: processing on its instructions under the DPA; the legal basis is determined by your organisation.
- Sign-in and your account: performance of the contract with your organisation and our legitimate interest in giving access only to authorised persons (Art. 6(1)(b) and (f) GDPR).
- Operation and security: our legitimate interest in a secure and stable service and in detecting misuse (Art. 6(1)(f) GDPR).
4. Artificial intelligence
To generate an answer or the next step, the Steward sends the content needed for that step to the AI provider listed in our subprocessor list. The provider may not use this content to train its models. It keeps it for at most 30 days to detect abuse and then deletes it.
The Steward does not take decisions that have legal effects for you or affect you in a similarly significant way. Actions that change data in a connected system are approved by a person or carried out by a skill that your organisation has approved; payments and deletions are never carried out by the Steward.
5. Who can see your data
- In your organisation: owners and approvers see all tasks of the organisation; members see their own tasks.
- Service providers: our subprocessors for servers and backups (OVH, EU), network protection (Cloudflare) and the AI model, as listed in the subprocessor list.
- Connected systems: when the Steward writes to a system your organisation has connected, for example a note in Exact Online, the content becomes part of that system.
We do not sell your data and do not pass it on for advertising.
6. Cookies
The Steward uses one cookie that is necessary for signing in (steward_session, valid for 12 hours). Cloudflare may set a technically necessary cookie to protect the service against automated attacks. We do not use cookies for analysis or advertising. Fonts are served by the Steward itself; no data is sent to font providers.
7. How long data is kept
| Data | Retention |
|---|---|
| Your account in the Steward and your work | as long as your organisation uses the Steward; deleted 30 days after the end of its subscription |
| Backups | encrypted, at the latest 12 months |
| Technical data of requests | at the latest 30 days |
| Content at the AI provider | at the latest 30 days |
Your organisation can delete memory entries and schedules at any time.
8. Your rights
You have the rights described in section 8 of our Privacy Policy: access, rectification, erasure, restriction, data portability, objection and complaint to a supervisory authority. For content that your organisation controls, we forward your request to it.
9. Changes
We may update this notice. The current version is always available at legal.relyd.co.