Relay Privacy Policy

1. Who we are and what this policy covers

Good Turn Digital ("we," "us," or "our") operates Relay, a seller-management application for inventory, listings, tasks, sales records, and related business workflows. This policy explains how we handle personal information in connection with Relay, its optional marketplace tools and Chrome companion, and requests for Relay support.

This is Relay's policy, not a general policy for every Good Turn Digital product or for eBay, Facebook, OpenAI, or Stripe. Those services have their own privacy practices. The public page hosting this policy is delivered through Vercel; visiting it can also generate the hosting information described below.

2. Information we collect

What we receive depends on the features you and your company use.

• Account and company information: names, email addresses, company names, invitations, team memberships and roles, profile details you provide, and account creation or update dates. We maintain authentication records, including password hashes and session information, to operate sign-in.
• Business records and uploaded content: inventory details, descriptions, photographs, purchase and pricing information, listing drafts and marketplace links, tasks and assignments, notes, sales and fee records, and shipment details. These records can include personal information you enter, such as a buyer's name or information visible in a photograph. Please provide only information you are authorized to use and that is needed for your work.
• Photo information: uploaded image files, filenames and image properties, plus versions prepared for display or selected workflows. Original files may retain embedded metadata. Do not upload photos containing sensitive information you do not want stored or shared through a selected feature.
• Marketplace connection information: account labels you supply, authorization permissions, encrypted access and refresh tokens, token-expiration information, connection status, and limited seller-readiness information, as explained in Section 4.
• AI-assistance records: selected inputs, generated suggestions, your review or application of suggestions, and operational information such as model identifiers, request status, timestamps, and usage counts when AI assistance is used.
• Subscription and customer-administration information: plan, trial and subscription status, billing-provider references, renewal or cancellation information, and records needed to administer the customer relationship. We also maintain company-level usage counts and commercial records associated with providing the service.
• Technical and security information: session dates, IP addresses and browser information where supplied to our authentication or hosting systems, activity history, request/error information, and rate-limit information used to operate and protect Relay.
• Support communications: the contact details, messages, and attachments you choose to send us, including correspondence about privacy requests.

When you visit this policy page, our hosting provider Vercel processes technical request information, such as IP address, browser information and request details, to deliver and protect the page. Publishing this notice does not send Relay's inventory database or private photographs to Vercel.

3. How we use information

We use information to:

• provide accounts, company workspaces, team access, and the features you request;
• store and organize inventory, listing, task, sales, and shipment records;
• perform optional AI or marketplace actions you initiate;
• administer subscriptions, customer support, and our business relationship with your company;
• maintain activity history, protect accounts, prevent abuse, diagnose errors, and improve the reliability of Relay;
• answer privacy requests and comply with applicable legal obligations.

Where a legal basis is required, the relevant basis depends on the processing: providing a requested service or fulfilling a contract; legitimate interests such as security, service administration and support, subject to applicable safeguards; complying with law; or consent where it is required. A feature request is not blanket consent to unrelated uses of your information.

4. eBay and other marketplace workflows

eBay authorization and current functionality

Connecting eBay is optional and requires an authorized company Owner to initiate the connection and approve eBay's consent screen. You authenticate with eBay; Relay does not ask you to provide your eBay password to Relay.

The current API connection is for eBay Sandbox testing. Relay requests eBay Inventory, Account, and Fulfillment permissions. The enabled connection workflow uses authorization and seller-readiness checks; requesting those permissions does not mean every permitted operation is implemented or performed.

During a readiness check, Relay receives seller-registration/privilege information, business-policy information and inventory-location information from eBay. Relay stores encrypted authorization tokens, granted scopes, expiry and connection metadata, seller-registration status, and counts of policies and enabled locations. It does not retain full readiness-response payloads as business records. Temporary authorization codes are exchanged for tokens, and one-time connection-state records protect the connection flow.

The current API workflow does not automatically publish listings, import eBay orders or buyer records, or synchronize a production seller account. Manually entered sales records may nevertheless contain a buyer's name or other information entered by your company. We use eBay information to provide the authorized integration, maintain its security, and address support or legal requirements—not for unrelated advertising or profiling.

Disconnecting eBay

An authorized company Owner can disconnect eBay in Relay. This removes the current connection's stored tokens and connection-state records from Relay's active database. It does not delete your inventory, previously exported files, manual marketplace records, or listings on eBay. Disconnecting in Relay is not the same as revoking Relay's authorization within eBay; you can separately manage or revoke that authorization through eBay's account settings. Copies in backups, if any, are subject to the retention and deletion considerations in Section 7.

Listing exports and the Facebook Chrome companion

Relay's manual posting packages and eBay draft exports contain the listing content and photos you choose to prepare. Downloading an export does not itself publish a listing. When you upload or paste that content into a marketplace, the marketplace receives and handles it under its own policies.

The optional Facebook Chrome companion imports a file you select, containing prepared listing text, price, photos, company/account labels, and a Relay listing identifier. When invoked, it reads the active Facebook tab's URL and checks relevant form controls to identify the supported page and fields. When you instruct it to fill the Facebook form, it transfers the selected listing content and photos into that page. Facebook may receive or process information entered into its form before you publish. You review and publish through Facebook yourself; the companion does not click the publication controls.

The companion uses temporary Chrome session storage for the imported draft and local extension storage for the trusted Relay address you select. It does not use Chrome's synced storage for drafts, collect your Facebook password or cookies, or perform background listing synchronization. You can clear the imported draft. Downloaded handoff files remain on your device until you delete them. Returning a published listing link to Relay requires your confirmation before Relay updates its record.

5. Optional AI assistance and billing

AI assistance

When you request AI preparation or listing assistance, Relay sends selected product information and a limited number of optimized product photos to OpenAI to generate suggestions. Depending on the workflow, this can include listing text, category and item specifics, condition, brand/model, dimensions, currency, desired or minimum prices, and available category names. It is not a transfer of your entire company database.

The dedicated private-notes, acquisition-cost/source, storage-location, account-credential, and team-identity fields are excluded from the AI request. However, information you put into a selected photo, listing description, category name, or other submitted field can still be transmitted. Review that content before requesting AI assistance.

You can use manual preparation instead. Relay stores preparation/analysis records, suggestions and associated usage information to support review and reuse. This policy does not promise that the AI provider has no retention of request data. Provider-side processing is governed by the applicable service terms and data-processing arrangements. AI output is advisory and does not itself publish a listing.

Subscription billing

Where Stripe billing is enabled, Stripe processes payments through its hosted checkout and account-management pages. Relay may send the company Owner's name and email, company name, and workspace/plan references needed to establish and manage the subscription. Relay retains billing references and subscription-status information; its billing integration does not store full payment-card numbers or security codes. Stripe's own privacy practices also apply to information it collects directly.

6. Who can receive or access information

• Your company and its authorized users: workspace data and tasks are shared within the company according to application roles. Company Owners manage membership and permissions. A shared company task board is not a public internet board.
• Authorized Good Turn Digital operators: we can access information needed to administer and support Relay. The restricted platform administration console includes customer/company information, team names and emails, roles, activity indicators, subscription details and business-usage metrics. Company separation does not mean that the service operator can never access customer information.
• Service providers: providers supporting selected features can process the information necessary for their services. These include OpenAI for optional AI assistance, Stripe for enabled billing, and Vercel for hosting the public policy page. Support correspondence is processed through the systems used to operate our support mailbox. The processing described here remains our responsibility where we act as the responsible business; a provider's separate policy does not replace this policy.
• Marketplaces and recipients you select: information is shared when you authorize an integration, transfer prepared content, or export and share a file. Content you publish may become public under the marketplace's settings and policies.
• Legal or safety recipients: we may disclose information when reasonably necessary to comply with applicable law or valid legal process, protect rights and safety, or investigate fraud or abuse.
• A business successor: if ownership of Relay changes through a merger, acquisition or similar transaction, relevant information may transfer subject to applicable law and the commitments in this policy. Such a transaction does not itself authorize unrelated uses.

We do not sell or rent personal information collected through Relay, or share it for cross-context behavioral advertising. The current Relay workspace does not include third-party advertising pixels. These statements do not describe unrelated websites you visit through links or the independent practices of marketplaces.

7. Retention, deletion, and your choices

Retention depends on the type of information, whether your account or company workspace is active, the service you request, security and audit needs, legal requirements, and any applicable company agreement. Not every record has an automatic expiration date.

Archiving or deleting an inventory item is not a promise of permanent erasure. Some actions hide or soft-delete records while retaining history and photos; records tied to listing or sales activity may be retained or restricted from deletion. Removing a team member's workspace access also does not automatically erase the person's account or historical activity attribution.

You can edit supported account or business fields, choose manual rather than AI preparation, clear companion drafts and downloaded files, and use available marketplace-disconnection controls. Company access changes are handled by an authorized company Owner.

For a request to access, correct, obtain a copy of, or permanently delete personal information, email support@goodturn.digital. Include enough information to identify the relevant account or company and describe your request. Do not send passwords, API keys, or access tokens. We may ask for reasonable additional information to verify your identity and authority before taking action. If your company controls the relevant business records, we may need to coordinate with its authorized representative.

Depending on the law applicable to you and the processing involved, you may also have rights to object to or restrict processing, withdraw consent for processing based on consent, receive information in a portable format, appeal a decision about a request, or complain to an appropriate regulator. We will handle requests within the timeframes and exceptions required by applicable law. We do not require you to give up applicable privacy rights to contact us.

Permanent deletion may require manual handling and separate consideration of business records, security/audit history, legal retention duties, and backups where maintained. We will explain any applicable limitations rather than treating a disconnect, archive, or ordinary record deletion as complete erasure of every copy. Deleting information from Relay does not remove copies independently held by a marketplace or a person who received an export; their processes also apply.

8. Cookies, browser storage, and security

Relay uses sign-in/session cookies and browser storage for essential operation and preferences such as appearance. Blocking essential cookies can prevent sign-in. The Chrome companion's storage is described in Section 4. The separate Good Turn Digital website may have additional site-specific features; any collection beyond the public-page hosting described here requires its own accurate disclosure.

Relay includes company-scoped authorization, role-based access controls, authenticated access to private media, and encryption of stored eBay authorization tokens. These are specific safeguards, not a claim that every stored field is encrypted or that security can be guaranteed. Protect your credentials and downloaded files, limit the personal information you upload, and report suspected unauthorized access to our support address.

9. Processing locations and children

Information may be processed where Good Turn Digital or the providers used for a selected feature operate. These locations may differ from your own and may have different privacy laws. Where applicable law requires protections for international transfers, those requirements must be met for the processing involved. We do not promise that every feature's data stays in one country.

Relay is a business-management tool and is not directed to children. If you believe a child has provided personal information to Relay, contact us so we can investigate and take appropriate action.

10. Changes and contact

We may update this policy when our practices, features or legal requirements change. We will update the date above and provide additional notice or seek consent when required by law. Publishing a new version does not, by itself, authorize a materially different use of previously collected information.

For Relay privacy questions, data requests, or concerns, contact: