Privacy Policy

relaybell (“relaybell”, “we”) is a web push notification service operated by Nexistech (nexistech.in). We provide the service to website and app operators (“Customers”). This policy explains how we handle personal data for two groups: visitors who subscribe to push notifications on a Customer’s site (“Subscribers”), and Customers who use our dashboard and API.

Data we process for Subscribers

When a visitor opts in to notifications on a Customer’s website, we process:

• The browser push subscription (endpoint URL and encryption keys) needed to deliver notifications.
• Technical attributes: device/browser type, language, and approximate country (derived from IP at subscribe time; we do not store the IP address).
• The page URL where opt-in occurred and the time and policy version of consent.
• Any tags or events the Customer chooses to send us (e.g. an account ID, or a “purchase” event) to power segmentation and automations.

For Subscriber data, relaybell acts as a data processor on behalf of the Customer, who is the data controller. We process this data only to provide the service.

How we use data

• To deliver the notifications a Customer sends or automates.
• To provide analytics (delivery, clicks, conversions) to the Customer.
• To operate, secure, and improve the service.

We never sell personal data, and we do not use Subscriber data for our own advertising.

Consent

Push notifications require the visitor’s explicit browser permission. We record when consent was given, the originating page, and the applicable policy version. A Subscriber can withdraw consent at any time via the browser’s notification settings or an unsubscribe control the Customer provides.

Data retention

Customers can configure a retention window, after which event logs are automatically deleted. Subscription records persist until the Subscriber unsubscribes or the Customer deletes them.

The live demo

On relaybell.com/demo you can send a sample notification to your own browser. Here relaybell is the data controller: allowing notifications on that page subscribes your browser to relaybell’s own demo project, which stores:

• The browser push subscription (endpoint URL and encryption keys).
• Your browser’s user-agent string, device type, language and time zone, and approximate country (derived from IP; we do not store the IP address).
• The demo page URL and the time you allowed notifications.

We use this only to deliver the demo notifications you send yourself. Those notifications are not stored: we keep no copy of their text and no delivery or click records. To limit the demo to 3 notifications an hour, we count sends under a one-way hash of your IP address (for IPv6, of its /56 network) and under a hash of the subscription; the counts hold nothing else and are deleted an hour after the first send.

Demo subscriptions don’t expire on their own. The subscription, user-agent string and device type are deleted when you choose “Turn demo notifications off” on the demo page, or when a demo send finds the subscription has expired; the language, time zone, country, page URL and consent time are kept. Records of subscribing and unsubscribing are deleted after 90 days. To have the rest deleted, email privacy@relaybell.com.

Shopify stores

When a merchant installs the relaybell app from the Shopify App Store, relaybell connects their store to a relaybell website. The merchant is our Customer and the data controller; relaybell processes the store’s data on their behalf, only to provide the service.

From the store, we receive:

• Store details: store name, store domains, the store owner’s email (to create or find their relaybell account), currency and time zone.
• Product catalog: product titles, prices, stock, images and links, used for price-drop, back-in-stock and recommendation notifications.
• Orders and checkouts: order and cart totals, currency, and which products and quantities, used for cart reminders and to show which sales a notification led to.

Shopper activity (Shopify web pixel). The app adds a Shopify web pixel to the store. It runs only when the shopper’s consent settings on the store allow analytics and marketing, and relaybell keeps its events only for shoppers who have subscribed to notifications or are signed in to their store account. It reports product views, add to cart, checkout started and checkout completed, with product ids, titles, prices, quantities, totals and currency.

Signed-in shoppers. When a shopper is signed in to their account on the store, Shopify confirms their customer id to relaybell, so their notifications and activity are linked to the same person across devices.

What we never collect from Shopify: shoppers’ names, email addresses, phone numbers, postal addresses or payment details.

Protection. Shopify customer ids are stored encrypted (AES-256-GCM) or as keyed one-way hashes, and so are order ids and cart identifiers. The store’s access tokens are encrypted. Checkout and order-status links are not stored.

Deletion.

• When a merchant uninstalls the app, we delete the store’s access tokens immediately.
• 48 hours later, unless the app was installed again, we delete the store’s data. That means the website the app created for the store, with its subscribers and history, or, if the merchant linked a website they already had, the Shopify customer ids and cart identifiers in it.
• When a merchant asks us, through Shopify, to erase a customer, we delete that customer’s subscriptions and activity.
• When a merchant asks us, through Shopify, for a customer’s data, we provide what we hold for that customer.

Your rights

Depending on your jurisdiction (including the GDPR and CCPA), you may have the right to access, correct, delete, or export your data. Because the Customer controls the data, please direct requests to the site you subscribed on. relaybell provides Customers with self-service tools to fulfil access and deletion requests, and will assist Customers as their processor.

India: the Digital Personal Data Protection Act, 2023

For Subscribers, the Customer whose site you subscribed on decides why and how your data is used (the “Data Fiduciary”), and relaybell processes it on the Customer’s behalf (a “Data Processor”). For our own Customers’ account details, Nexistech is the Data Fiduciary.

Under the Act, you can:

• ask for a summary of the personal data held about you and how it is processed;
• ask for it to be corrected, completed, updated or erased;
• withdraw consent at any time, as easily as you gave it (for push notifications: turn them off in your browser);
• nominate someone to exercise these rights for you if you die or become unable to; and
• have a grievance addressed, as set out below.

If you are a Subscriber, the Customer’s site is usually the quickest place to start; we help Customers answer these requests. You can also write to us directly.

Grievance Officer

Grievance Officer, Nexistech (relaybell): privacy@relaybell.com. We acknowledge every grievance within 24 hours and aim to resolve it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Where data is stored

relaybell runs on servers in the European Union (Contabo data centre). Nightly encrypted backups are stored with Cloudflare R2. If you are in India or elsewhere, your data is therefore transferred to and stored outside your country, with the safeguards described in our Data Processing Agreement.

Security & sub-processors

Data is encrypted in transit (TLS) and stored on access-controlled infrastructure. We use a limited set of sub-processors for hosting, backups and transactional email. The current list, with what each one handles, is on our sub-processors page. More detail is on our security page.

Contact

Questions about this policy or your data: privacy@relaybell.com. We reply within 24 hours.