Privacy Policy

Relyant ("Relyant", "we", "us") provides an all-in-one operations platform for schools and education organisations, covering facilities, inventory, procurement, bookings, sales, HR, student management, and meeting notes.

• Relyant web app: the application at on.relyant.app and the.relyant.app, including the parent portal and public helpdesk forms.
• Relyant mobile app: the "Relyant" app for Android (package app.relyant.mobile) and iOS.
• Website: relyant.app, including our blog, tools, and contact forms.

Together we call these the "Services". By using the Services you acknowledge this policy. If you do not agree with it, please do not use the Services.

Relyant is used by schools and education organisations (our "Customers"). Staff, parents, and guardians usually get an account because their school invited them.

For information a school puts into Relyant, such as student, guardian, staff, and operational records ("Customer Data"), the school decides what is collected and why. The school is the data controller, and Relyant processes that data on the school's behalf and according to its instructions and our agreement with it. If you have questions about how your school uses your data, or want to exercise your rights over it, please contact your school first. We will help them respond.

Relyant is the controller for the limited data we handle for our own purposes: website visitor data, sales and support enquiries, Customer billing details, and security and service-operation logs.

Depending on which Relyant modules your school uses and the permissions your role has, we may process the following:

• Account and profile: name, email address, password (stored only as a one-way hash), profile photo, phone number, preferred language, the organisation you belong to, and your role. If you choose "Sign in with Google", we receive your name, email address, and profile picture from Google.
• Student and guardian records: entered by your school: student name, date of birth, gender, photo, address, enrolment, class, attendance, behaviour and activity records, notes, learning-support referrals, attachments, invoices, and guardian names, email addresses, phone numbers, and relationship to the student.
• Staff (HR) records: entered by your school or by you through HR self-service: contact details, address, date of birth, gender, nationality, marital status, spouse and dependants, emergency contacts, education history, identity and employment numbers (such as national ID, tax ID, BPJS numbers, passport, and work permit), bank account details, salary band, and HR documents.
• Operational records: work requests and work orders, asset and room bookings, inventory, procurement, transport requests (including pickup and drop-off places you enter), helpdesk submissions, announcements, kudos, and meetings.
• Photos, videos, and files: that you choose to capture or upload, for example photos of a broken asset on a work order, a profile photo, or an HR document.
• Meeting recordings (Scribe): audio you record or upload, and the resulting transcripts, AI-generated summaries, notes, images, and questions you ask about a meeting.
• AI assistant conversations: the questions you ask Relyant's AI features and the answers they return.
• Sales and payment records: point-of-sale and online-shop orders, customer names and email addresses, payment method, amounts, and references. Card payments are handled by our payment providers, and Relyant does not store full card numbers.
• Device, log, and usage data: IP address, browser or device type, operating system, time zone, approximate location derived from your IP address (city, region, and country), sign-in times, and an audit log of actions taken in your organisation. In the web app we also collect product usage events and error reports (see section 6).
• Notification data: if you enable push notifications, a push token that lets us deliver notifications to your device.
• Connected calendars: if you connect Google Calendar, your Google account email address and the calendar events needed to sync bookings and meetings.
• Website visitors: pages viewed, referrer, campaign parameters (such as utm_source), and ad click IDs, plus the details you submit in our contact or demo forms (name, email, phone, school, and message).

The Relyant mobile app only asks for a device permission when you use a feature that needs it. You can deny or revoke any permission in your device settings at any time. The rest of the app keeps working.

• Camera: to scan asset and location QR codes, and to take photos or videos you attach to work requests, work orders, or HR tasks.
• Photos and media: to attach images or videos you select, or to set a profile photo. The app only reads the items you pick.
• Microphone: only when you start a Scribe meeting recording or record a video. Recording can continue while the app is in the background, and a persistent notification is shown the whole time so you always know it is on. Recordings are kept on your device until they upload, and then they are removed from it.
• Notifications: to alert you about assignments, approvals, and updates.
• Files: to attach documents or upload an existing audio or video recording that you choose.

The mobile app does not access your contacts, your device's precise (GPS) location, or your advertising ID. It contains no advertising or third-party analytics SDKs. On your device, the app keeps your sign-in session in the operating system's encrypted secure storage, along with temporary copies of files you open or upload. These are removed when you sign out or uninstall the app.

• To provide, operate, and maintain the Services your school has subscribed to, including the features you choose to use.
• To create and secure your account, verify sign-ins (for example with one-time email codes), and keep sessions active.
• To send service messages, such as sign-in codes, invitations, assignment and approval notifications, meeting summaries, and receipts.
• To power AI features you choose to use (see section 7).
• To provide customer support and respond to your requests.
• To protect the Services, our Customers, and users: preventing abuse, spam, and fraud, rate-limiting, and keeping audit logs.
• To understand how the Services are used, fix bugs, and improve performance and features.
• To bill Customers for their subscriptions.
• To comply with legal obligations and enforce our agreements.

We do not sell personal data. We do not use Customer Data for advertising, and we do not show ads in the Services.

We share personal data only in the following ways:

• Within your organisation: Other members of your school can see information according to the roles and permissions your school configures. For example, a facilities manager sees work requests, and HR administrators see staff records.
• Service providers (subprocessors): We use trusted providers to run the Services. They may only use personal data to provide their service to us:

• Cloudflare: hosting, database, file storage (including photos and recordings), session storage, bot protection, and network security.
• Resend: delivering transactional email.
• OpenAI: AI features: the in-app assistant, student insights, and meeting summaries and Q&A.
• ElevenLabs: speech-to-text transcription of Scribe meeting recordings.
• PostHog: product analytics and error monitoring in the web app. PostHog receives usage events and your name and email so we can link them to your account.
• Google: "Sign in with Google", Google Maps and Places for addresses and transport locations, and Google Calendar sync if you connect it.
• Stripe: processing Relyant subscription payments from Customers.
• HitPay: processing payments for schools that connect it to their point of sale or online shop.
• Expo: mobile app updates and delivery of push notifications.
• Vercel, Umami, and HubSpot: hosting this website, privacy-friendly website analytics, and handling contact and demo form submissions.

• Legal reasons: when we believe in good faith that disclosure is required by law, regulation, or valid legal process, or is needed to protect the rights, property, or safety of Relyant, our users, or the public.
• Business transfers: if Relyant is involved in a merger, acquisition, or sale of assets. Personal data would remain subject to this policy.
• With your consent or at your school's direction: for example when your school connects an integration.

Some Relyant features use artificial intelligence. Examples are meeting transcription and summaries (Scribe), the AI assistant, and student insights. When you or your school use them, the relevant content is sent to our AI providers (OpenAI and ElevenLabs) to generate the result. That content can be a recording or transcript, or the records needed to answer a question. Results are stored in your school's workspace.

AI-generated output can be inaccurate. Please review it before relying on it, especially for decisions about students or staff. Relyant does not use Customer Data to train AI models, and schools can choose not to use AI features.

Relyant serves schools in Indonesia, Singapore, and elsewhere. Our infrastructure and service providers operate globally, so your data may be processed in countries other than your own, including the United States. When we transfer personal data internationally, we take steps to protect it as required by applicable law, such as Indonesia's Personal Data Protection Law (UU PDP), Singapore's PDPA, and the GDPR. These steps include contractual safeguards with our providers.

We keep Customer Data for as long as the school's account is active, or as long as the school instructs us. When a school closes its account, we delete or anonymise its Customer Data within a reasonable period, unless the law requires us to keep it longer. Schools can export their data before they leave.

Sign-in sessions expire after 30 days of inactivity, and one-time sign-in codes expire after 5 minutes. We keep billing records and security logs for as long as needed for legal, accounting, and security purposes.

We protect personal data with technical and organisational measures, including:

• encryption in transit (HTTPS/TLS) and encryption at rest by our infrastructure providers;
• passwords stored only as one-way hashes, and payment-gateway credentials encrypted with AES-256;
• strict separation between organisations, and role-based access control within each school;
• audit logs, rate-limiting, and bot protection on public forms.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify the affected school, and you where required, in line with applicable law.

The Relyant apps are designed for school staff, parents, and guardians, and are not directed at children. Children should not create Relyant accounts. Student information is entered and managed by the student's school, which is responsible for having a lawful basis for it. This includes, where required, consent from a parent or guardian. Relyant processes student data only to provide the Services to that school. We never sell it, use it for advertising, or build profiles of students for any purpose other than the school's own.

Parents and guardians who want to review, correct, or delete their child's information should contact the child's school. We will support the school in responding.

Depending on where you live, you may have the right to:

• access the personal data we hold about you, or get a copy of it;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• complain to your local data protection authority.

You can update your name and profile photo in the app, and staff can update HR details through self-service where their school allows it. For other requests, contact your school, or email us at hello@relyant.app. We may need to verify your identity, and for Customer Data we will pass your request to your school.

You can ask us to delete your Relyant account and its associated personal data at any time, from the web or from the mobile app.

• Option 1: ask your school: Your school's Relyant administrator can deactivate and remove your account from the organisation.
• Option 2: email us: Send an email from the address linked to your account to hello@relyant.app with the subject "Delete my account", saying which school (organisation) you belong to. If your email isn't linked to your account, we will verify your identity before deleting anything.

We will confirm your request and complete the deletion within 30 days. We delete your profile, your sign-in credentials and sessions, your push tokens, and personal content that belongs only to you, such as your own meeting recordings and AI chats. Records that belong to your school are kept or deleted according to your school's instructions. Examples are work orders you submitted, attendance you recorded, and HR records your school is legally required to keep. We may also keep limited data where the law requires it, such as billing records and security logs, for the period the law requires. After that it is deleted.

Deleting the mobile app from your device does not delete your account.

• Essential cookies: keep you signed in to the web app, protect sign-in flows, and remember your language. The Services do not work without them.
• Analytics: In the web app, PostHog uses cookies and local storage to understand feature usage and catch errors. On this website we use Umami and Vercel Analytics, which measure page views without cross-site tracking.
• Marketing attribution: This website stores how you first and last arrived (referrer and campaign parameters) in first-party cookies and local storage for up to 90 days, so we know which channels bring schools to us.

You can block or delete cookies in your browser settings, but parts of the Services may stop working.

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the changes are significant, we will notify Customers or show a notice in the Services.

If you have questions about this policy or how we handle personal data, email us at hello@relyant.app. We aim to respond within 30 days.