Document 3: Privacy Policy
Plain-language summary: This explains how Relae handles personal information. Two situations differ. For information about you, our website visitors and the staff who hold accounts, we decide how it is used, so we are the controller. For donor information a charity puts into Relae, the charity is in charge (controller) and we only handle it on the charity's instructions (processor). If you are a donor with a question, contact the charity, not us, and we will help the charity respond. This policy describes what actually happens today. Experimental pilot features and future features that are not yet running are described separately, in Document 13 and the Benchmark Cooperative terms, and are not part of the processing below.
Current processing. Everything in this Privacy Policy describes processing that runs today for all organizations. Pilot and future capabilities are covered elsewhere and are not described here as if they were live.
1. Two roles, made clear
This policy covers two situations: (A) information for which Relae is the Controller (Website Data and Customer Account Data); and (B) Donor Data, for which the Customer charity is the Controller and Relae is only the Processor. The detailed processor terms are in the Data Processing Agreement (Document 4).
2. Information we handle as Controller
Website Data: when you visit relae.ai or submit our request-access form, we collect your name, work email, organization, optional CRA charity number, any message, and standard technical data (see the Cookie and Tracking Notice, Document 6). Customer Account Data: when an organization creates an account, we collect staff names, emails, roles, and login credentials. We also store staff profile photos (avatars) that an organization or its users choose to upload. We use this information to respond to enquiries, provide and administer the Platform, secure accounts, communicate operationally, and comply with law.
A note on staff avatars: staff profile photos are stored in a storage location that is publicly accessible if the file address is known. We tell you this plainly so you can decide what to upload. Donor photographs, by contrast, are stored in a private, access-controlled location. If you would prefer your staff avatar not be stored this way, you can use a non-identifying image or none.
3. Donor Data: what the charity's data includes
Donor Data is the personal information a Customer charity records in the Platform about its donors and prospects. As well as the basics (names, contact details, giving history, relationship notes), the Platform records or derives the following categories, which we list so the picture is complete:
---------------------- ------------------------------------------------
**Category** **What it is**
Access, affinity, and Staff-assigned or tool-suggested ratings of a
capacity (AAC) ratings donor's connection to the organization and
likely capacity to give. Suggestions are
confirmed by a person.
Prospect typing and Categorization of prospects into types or tiers
tiering to help staff prioritize their work.
Predictive lifetime Model-generated estimates of a donor's likely
value and lapse long-term giving and the likelihood that they
likelihood are still an active giver, produced by a
statistical model from the organization's own
giving history.
Model-derived wealth Estimated ranges for a donor's giving capacity,
and capacity ranges derived by the Platform. These are estimates to
aid staff judgment, are shown as suggestions,
and are confirmed or overridden by a person.
They are not automated decisions about the
donor.
Event attendance Records of a donor's attendance at an
organization's events, including data read in
from an event provider where the organization
connects one (see Document 4).
Donor photographs Photographs of a donor where the organization
chooses to add them, stored in a private,
access-controlled location.
Official receipt data The content of official donation receipts the
(where the charity issues through the Platform (donor name,
organization has gift and issue dates, amounts, any advantage and
enabled receipt eligible amount, receipt number), and duplicate
issuance) copies of issued receipts retained for the
charity's CRA record-keeping. Issuance operates
only for organizations that have expressly
enabled it; see Document 11.
Organization data Information about charitable organizations drawn
derived from public from public CRA and open-government sources,
CRA filings used for context. For these lookups Relae sends
only a charity's business number.
---------------------- ------------------------------------------------On the derived categories and "profiling": some of these categories (capacity ranges, predictive values, ratings) are the kind of thing that can look like automated profiling. We want to be accurate: these are aids that a member of staff sees as a suggestion and confirms or changes. The Platform does not make a decision that produces a legal or similarly significant effect about a donor by automated means alone. The one exception to human confirmation is a duplicate-record merge, described in section 6.
4. Donor Data: the charity is in charge
Donor Data is processed by Relae only on the instructions of the Customer charity, which is the Controller. We do not use Donor Data for our own purposes, except to provide the Services. If you are a Donor with a privacy request, please contact the charity that holds your information; Relae will assist the charity in responding.
5. Where data is stored and processed, and cross-border transfers
Our regional model. Relae deploys regional data infrastructure so that a customer's Donor Data is stored and processed in that customer's own region, rather than pooled into a single location. Today, Relae operates one region, Canada, and every current customer is served from it; the Canadian specifics are described below. As Relae opens additional regions, each region's infrastructure and any region-specific details will be described in the same way, and a customer will be told which region serves it. This policy does not describe infrastructure for regions that are not yet operating.
Who operates and contracts with you, in every region. Across all regions, the company you contract with and that operates the Platform is Touch Grass AB, which is located in Sweden. This is a constant of the service and does not change from region to region. It means that, wherever your Donor Data is stored, the operator of the service is a company established outside Canada, in the European Union, and personnel operating the service may access the system from there. We state this plainly rather than let regional data storage imply that every part of the arrangement is local to your region. Touch Grass AB is bound by the data-protection, security, and confidentiality obligations described in this policy and the DPA, wherever it operates and whichever region serves you.
The Canadian region (current). For customers served from the Canadian region, Donor Data is stored in Canada in the Supabase ca-central-1 region, and application compute runs in Canada (Montreal). The interactive AI features (donor-capture assistance, coaching suggestions, thank-you drafting, and the "Ask Relae" assistant) run in Canada, on Amazon Nova through AWS Bedrock in a Canadian region. For these features, Donor Data is processed in Canada.
Within the Canadian region, there are two deliberate flows where limited information is processed outside Canada, and we describe them precisely:
- Donor research (opt-in, per organization). If an organization turns on donor research for a prospect, Relae sends that prospect's name together with public identifying context the organization already holds, specifically the entity type, city, education, and known employer, board, or company affiliations, plus web-search queries, to AI and web-search services in the United States, in order to find and confirm the right person and gather publicly available information. This feature never sends the private record: no giving history, no amounts, no AAC or capacity ratings, no prospect type or tags, and no notes. These are removed before the request is made. This transfer happens only when the organization has opted in, and exactly what is sent and what is never sent is shown at the point the feature is turned on.
- Funder research (organization name only, off by default). A weekly research feature, available only under a specific entitlement that is off by default, sends organization names and research topics (not donor personal information) to AI and web-search services in the United States.
Where information is processed or accessed outside a customer's region, whether by our Swedish operating company or by the research services described above, it may be subject to the laws of the country involved, including lawful access by authorities there. We make the disclosures applicable law requires and impose comparable protection by contract on each party that handles the data. Because the Swedish operating arrangement and the research transfers are standing features of the service rather than temporary ones, where we process personal information of Quebec residents we conduct the privacy assessment Quebec Law 25 requires for transfers of personal information outside Quebec, and we obtain the consent Law 25 and PIPEDA require, both for the operating arrangement and for the donor-research transfer.
6. Automated processing and human involvement
AI outputs in the Platform are suggestions that a person reviews and confirms. No decision producing a legal or similarly significant effect about a Donor is made by automated means alone. Where Quebec Law 25 applies, a donor has the right, through the charity as Controller, to be informed of and to contest a decision based exclusively on automated processing; Relae's features are designed so that a person stays in the loop. The one automated exception is a duplicate-record merge ("dedupe"): the Platform can merge records it identifies as duplicates. This runs only where an organization has turned it on, is off by default, and is reversible.
7. Sharing and sub-processors
We share personal information with the service providers (Sub-processors and connected data sources) listed in the DPA, who process it under contract or at the organization's direction. We do not sell personal information, and we do not sell, broker, or share individual Donor Data. We do not use third-party advertising trackers, marketing pixels, session recording, or chat widgets.
8. A future capability: the Benchmark Cooperative
Dormant future capability. The Benchmark Cooperative is not running. An organization can record its consent to take part in the future, but no donor-derived data is pooled or shared today.
The Platform lets an organization opt in to a future Benchmark Cooperative. Opting in records the organization's consent to contribute de-identified, aggregate figures if and when the cooperative launches. Today, the comparison an organization sees is its own numbers shown next to published sector figures from the Association of Fundraising Professionals; nothing from one organization is pooled with or shared to another. If the cooperative is built, it will be described and governed before any pooling begins (see the Benchmark Cooperative Terms, Document 8).
9. Legal bases and consent
For Website Data and Customer Account Data, Relae relies on consent and on its legitimate interest in operating and securing the Platform, consistent with PIPEDA and applicable provincial law. For Quebec residents, we provide the transparency information Law 25 requires at or before collection, including the purposes of collection, the categories of third parties to whom information may be disclosed, and whether information is transferred outside Quebec. Relae has designated a person responsible for the protection of personal information, reachable below.
10. Retention
We keep personal information only as long as needed for the purposes described or as required by law. We retain Website Data for up to twenty-four (24) months from last contact, and Customer Account Data for the life of the account plus ninety (90) days. Donor Data retention is governed by the Customer's instructions and the DPA. Where an organization has enabled receipt issuance, duplicate copies of issued receipts are retained while the organization's subscription is active and are included in the organization's data export; after export, the charity is responsible for retaining them for the period CRA requires, as the DPA describes.
11. Your rights
Depending on your province, you may have rights to access, correct, or withdraw consent regarding your personal information, and, under Quebec Law 25, rights to data portability and rights concerning decisions based exclusively on automated processing. For information we control, contact us below. For Donor Data, contact the charity that holds your information; we will assist the charity in responding within legal timelines.
12. Security and breach
We use the safeguards described in Schedule 1 to the DPA. If a breach of security safeguards creates a real risk of significant harm, we will report to the Office of the Privacy Commissioner of Canada and notify affected individuals or the relevant Controller as required by PIPEDA and applicable provincial law, including Quebec Law 25, keep the records the law requires (including a register of confidentiality incidents), and assist Customers with their obligations. Relae maintains a documented breach-response procedure and a designated privacy officer.
13. Children
The Platform is for organizational use by adults. Donor Data may occasionally include information about minors; the Customer, as Controller, is responsible for any consent required, and Relae processes such information only on the Customer's instructions.
14. Contact and changes
Questions, or to reach our privacy officer: privacy@relae.ai. We may update this policy and will revise the date below.
Last updated: 14 July 2026.