Data Processing Addendum
Last updated 4 November 2026
A boutique's records include personal data about other people: its shoppers, its staff, the sales reps on its vendor orders. Relay handles that data for the boutique and on its instructions. This addendum sets out how.
This Data Processing Addendum (“DPA”) is part of the Terms of Service between CairnRock Solutions, LLC (“Relay”, “we”) and the business that uses Relay (“the store”, “you”). It applies whenever Relay processes Store Personal Data. If this DPA and the Terms disagree about personal data, this DPA wins.
- Words used here
- Who does what
- Your instructions
- Confidentiality
- Security
- Subprocessors
- Helping with requests
- Breach notice
- Deletion and return
- Audits
- Data outside the United States
- US state privacy law
- General
- Annex 1: the processing
- Annex 2: security measures
1. Words used here
- Store Personal Data is personal data in the records Relay holds or processes for your store: customer profiles imported from your POS, names and contact details in vendor orders and emails, your staff's names and roles, and anything personal in files or pictures you add.
- Data protection law means the privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended (“CCPA”) and similar US state laws, and, where they apply, the EU and UK General Data Protection Regulations.
- Breach means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Store Personal Data.
- Words such as controller, processor, business, service provider and data subject mean what data protection law says they mean.
2. Who does what
For Store Personal Data, you are the controller (or “business”) and Relay is your processor (or “service provider”). You decide why the data is processed; Relay processes it for you. You are responsible for having a lawful basis and giving any notices your shoppers, staff and vendors need, including telling them that you use service providers like Relay.
Relay is the controller of its own account, billing, support and website records, as the Privacy Policy describes. This DPA does not cover those.
3. Your instructions
Relay processes Store Personal Data only on your documented instructions. Your instructions are: the Terms and this DPA; the way you set up and use Relay (the systems you connect, the settings you choose, the orders you approve); and anything else you ask in writing that we agree to. Those instructions include Relay learning from your store's records to improve the results it gives your store, and adding your store's de-identified sell-through counts to totals across stores, as section 9 of the Terms describes. Those totals contain no personal data.
We tell you if we think an instruction breaks data protection law, and we do not have to follow it. If the law makes us process Store Personal Data in another way, we tell you first unless the law forbids it.
4. Confidentiality
Everyone at Relay who can reach Store Personal Data is bound to keep it confidential, and reaches it only to provide, support or secure the service.
5. Security
Relay keeps the technical and organisational measures in Annex 2, and reviews them as the service and the risks change. We may change them, as long as the overall level of protection does not go down.
6. Subprocessors
- You authorise Relay to use the subprocessors listed at relay.boutique/subprocessors.
- Each subprocessor is bound by a written contract that protects Store Personal Data at least as well as this DPA does for the work it does. Relay stays responsible to you for its subprocessors.
- Before a new subprocessor starts receiving Store Personal Data, we update the list and email the store's owners at least 14 days ahead. In an emergency that threatens the service, we may give shorter notice and say why.
- You may object within that notice period, on reasonable data protection grounds, by writing to privacy@relay.boutique. We will try in good faith to resolve it. If we cannot, you may close your store before the change takes effect, and we refund any fees you paid for the rest of the month.
7. Helping with requests
If a shopper, a member of staff or anyone else asks Relay directly to see, correct or delete Store Personal Data, we tell you and do not answer them ourselves, except to say they should contact you. Relay helps you answer such requests: owners can see, correct and delete records in Relay, export much of it from the pages that show it, and ask us at privacy@relay.boutique for anything they cannot do themselves. We also give reasonable help with data protection impact assessments and with questions from a regulator about Relay.
8. Breach notice
If Relay becomes aware of a Breach, we tell the store's owners without undue delay, and in any case within 72 hours of confirming it. We say what happened, what data and how many people it may affect, what we are doing about it, and who to contact. We add details as we learn them, and we help you meet any duty you have to tell regulators or the people affected. Telling you is not an admission of fault.
9. Deletion and return
While your store is open you can export records from the pages that show them, or ask us for a copy. When a store closes, everyone loses access at once and Relay deletes its Store Personal Data 30 days later. You can ask us to delete it sooner. Copies in backups are overwritten in the normal backup cycle and are kept secure until then. We may keep data longer only where the law requires it, and then only for that purpose.
10. Audits
Relay shows that it meets this DPA by documentation: once a year, and after a Breach, we answer a reasonable written security questionnaire and give you the information you need to check our compliance. If a regulator requires more, or the documents do not answer a specific, reasonable concern, we agree the scope, timing and cost of any further review with you in advance. Anything you learn this way is our confidential information.
11. Data outside the United States
Relay is a US company. Store records are hosted in the European Union, and some subprocessors are in the United States and elsewhere, as the subprocessor list shows. Where data protection law requires a transfer mechanism for personal data leaving the EU, the UK or Switzerland, the European Commission's Standard Contractual Clauses (and the UK Addendum to them) apply between you and Relay, with Relay as the data importer, and are incorporated into this DPA by reference.
12. US state privacy law
Where the CCPA or a similar US state law applies, Relay is your service provider (or processor) and:
- does not sell or share Store Personal Data, as those laws define selling and sharing, including for cross-context behavioural advertising;
- does not keep, use or disclose it for any purpose other than providing Relay to you under the Terms, or outside its direct business relationship with you, except as those laws allow (for example, to keep the service secure or to meet a legal duty);
- does not combine it with personal data Relay gets from anyone else, except as those laws allow;
- gives it the same level of privacy protection those laws require of you, and tells you if it can no longer meet its obligations under them;
- lets you take reasonable and appropriate steps to stop and fix any use of it that those laws do not allow.
Relay certifies that it understands these restrictions and will comply with them.
13. General
This DPA lasts as long as Relay processes Store Personal Data for you. Each side's liability under it is subject to the limits in the Terms. It is governed by the same law as the Terms, except where data protection law or the Standard Contractual Clauses say otherwise.
Annex 1: the processing
| Subject and length | Providing Relay to the store, for as long as the store uses it, and then until the data is deleted under section 9. |
|---|---|
| What Relay does | Collecting from the systems the store connects, storing, organising, reading documents with AI models, matching, analysing, displaying, sending to the store's POS or web store when the store says so, and deleting. |
| People concerned | The store's shoppers; its owners, staff and accountants; its vendors' sales reps and other contacts; anyone pictured in photos the store adds. |
| Kinds of data | Shoppers, as held in the store's POS: name, email, phone, birthday (day and month), whether they accept marketing email, loyalty points, when they joined, their spending and number of purchases each year, and which sales were theirs. Staff: name, email, role, what they did in Relay. Vendor contacts: name, email, phone and other details printed on orders and emails. Photos: a person's likeness, where the store adds one. |
| Sensitive data | None intended. The store should not put sensitive personal data (health, financial account numbers, government ID numbers) into Relay. |
Annex 2: security measures
- Encryption in transit: HTTPS for every connection to Relay and from Relay to the systems and providers it uses.
- Encryption at rest: the database provider encrypts stored data; the credentials Relay holds for connected systems are encrypted again with AES-256-GCM, each under its own key, wrapped by a master key kept outside the database.
- Separation between stores: every request is limited to the signed-in person's store; the database also enforces row-level rules per store.
- Access control: roles inside each store (owner, manager, staff, accountant), with customer records limited to owners and managers. Passwords are handled by the sign-in provider and stored hashed; Relay's servers never receive them.
- Relay's own access: limited to staff with administrator access, for support and security; viewing a store is read only and recorded.
- Least data to providers: each AI or picture provider receives only what its task needs, under terms that do not let it train on the data. Shopper records are never sent to an AI provider.
- Connections: disconnecting a system stops Relay using it at once; when a store closes, Relay deletes its credentials for every connected system.
- Records: Relay keeps a log of significant actions in each store (approvals, sends to a POS, connections, settings changes, and Relay staff viewing the store).
- Payments: card details go to Stripe and never reach Relay.