Privacy Notice

1. Discovery and previous screening submissions

Free Discovery booking is provided through a Google appointment schedule, where the information you enter is processed to arrange the call. In the private workspace, Relystra may collect discovery answers, supporting files and a transcript supplied for a Basic Report. Earlier screening tools may have collected business contact details, answers and results; those historical records remain subject to this notice even though those tools no longer appear in the normal visitor journey. Do not enter passwords, authentication secrets, payment-card details, regulated personal data, client secrets or material you are not authorized to share into public forms.

2. Client Portal

The authenticated Client Portal is different from the public screening tools. When a user creates or uses a portal account, Relystra’s service providers may process account identifiers, authentication information, company/workspace information, tasks, project dates, milestone records, measurement records, activity records, notifications, and documents intentionally uploaded to the private company workspace. Portal information is used to administer the workspace and, where a signed client agreement exists, to support the contracted engagement.

3. Categories of information

Depending on features used, categories may include business contact information such as name, email, optional phone number, company and role information; discovery, historical screening and diagnostic responses and results; communication and consent preferences; account/authentication records; website and consent information; device/browser and IP-related technical data; project/task information; process and measurement records; communications; filenames and document metadata; and the contents of documents a user intentionally uploads to the authenticated portal.

4. Documents and sensitive information

The portal provides an authenticated, private document workspace, but users should still minimize what they upload. Do not upload passwords, authentication secrets, payment-card data, medical records, highly sensitive personal information, regulated data, or confidential third-party material unless Relystra has expressly approved that data type and handling method in a signed engagement and the user is authorized to provide it. Public forms and public screening tools remain inappropriate for sensitive documents.

5. Purposes

Information may be used to operate and secure the website and portal; generate and preserve requested Basic Reports or diagnostic results; respond to inquiries; conduct relevant business follow-up; honor communication and consent choices; authenticate accounts; maintain company workspaces; exchange client-approved documents; coordinate tasks and milestones; record measurement history; provide workspace notifications; administer contracted services; maintain business records; understand website usage after consent; and comply with applicable legal obligations.

6. Service providers and recipients

Information may be processed by service providers used for hosting, database/authentication, private file storage, analytics/CRM, communications, scheduling, automation, security, and professional services, as those functions are actually enabled. Relystra currently uses Supabase infrastructure for database records, authentication, private file storage, and application data services. The public site is delivered through Cloudflare Pages; Vercel may remain available temporarily as a development or rollback path during migration. HubSpot analytics may load only after the applicable analytics consent. Third-party providers process information under their own contractual and technical terms.

7. Portal access controls

The current portal is configured so authenticated company users are scoped to their permitted company workspace and the document bucket is private. Database and file-access rules use row-level authorization controls. These controls reduce exposure but do not make any internet-connected system immune from configuration mistakes, unauthorized access, provider failures, credential compromise, or other security events.

8. Notifications and text consent

The portal may display in-app notifications and, if a user grants browser permission, may display browser notifications while supported by the user’s device/browser. Historical screening submissions may include optional text-marketing consent. A phone number alone is not consent to receive marketing texts. Email, SMS, push, and other notification delivery are not guaranteed.

9. Analytics and tracking choices

Optional HubSpot analytics is configured to load only after the visitor selects “Accept” in the website consent banner. If the browser exposes a Global Privacy Control signal through the supported browser interface, the current website treats that signal as a decline for optional analytics. Browser “Do Not Track” signals are not treated as a separate universal instruction because there is no single industry-standard interpretation.

10. Sale, targeted advertising, and sensitive data

Relystra does not intend to sell personal information collected through the website or portal. Relystra does not request sensitive personal data through public Discovery. If future functionality materially changes these practices, this notice and applicable consent mechanisms should be updated before materially different processing begins.

11. Review, correction, deletion, and privacy requests

Privacy requests can be raised through the existing Relystra client or booking contact channel. A dedicated public privacy contact is pending confirmation. Where applicable law grants access, correction, deletion, opt-out, appeal, or other rights, requests will be evaluated according to the law applicable to the requester and processing at issue. Identity, account ownership, or authority may need to be verified before action is taken.

12. Data minimization and retention

Relystra intends to collect and retain information only as reasonably necessary for the stated business purpose, contractual obligations, legal requirements, security needs, dispute/documentation needs, and operating practices. Portal retention and deletion rules may also be defined in a signed client agreement. Closing an account or completing an engagement does not necessarily require immediate deletion where lawful business, contractual, backup, security, or legal retention obligations remain.

13. Security

Relystra seeks reasonable administrative, technical, and organizational safeguards appropriate to the information and service, including authenticated access and private storage for current portal documents. No website, cloud provider, authentication system, transmission method, storage service, AI system, or security control can be guaranteed completely secure.

14. Children

This business-to-business service is not directed to children and is not intended to knowingly collect personal information from children through lead-generation or portal features.

15. Policy changes

Material changes will be reflected by an updated effective date and, where reasonably appropriate, a website or account notice or renewed consent request before materially different optional processing begins.

16. State and other privacy laws

Different U.S. state and other privacy laws may apply depending on Relystra’s scale, visitors, activities, contractual relationships, and data practices. Applicable thresholds and obligations should be reassessed as the business grows.