Compliance & Privacy
We build trust through transparent data practices, regulatory compliance, and clear policies that give you control over your data.
GDPR Ready
Full support for data subject rights: access, erasure, portability, rectification, and restriction of processing. 30-day response commitment.
CCPA Compliant
California Consumer Privacy Act compliance with right to know, right to delete, right to opt-out, and non-discrimination protections.
SOC 2 Journey
Our infrastructure partners (Supabase, Vercel, Stripe) are SOC 2 Type II certified. We are pursuing our own SOC 2 Type 1 certification.
Your Data Rights
Under GDPR and CCPA, you have the following rights over your personal data.
Right to Access
Request a copy of all personal data we hold about you. We respond within 30 days with a machine-readable JSON export.
Right to Erasure
Request deletion of your personal data. We verify your identity and complete deletion within 30 days, subject to legal retention requirements.
Right to Portability
Receive your data in a structured, machine-readable format (JSON). Includes profile information, credit history, and image metadata.
Right to Rectification
Correct inaccurate personal data through your profile settings or by contacting our privacy team.
Right to Restrict Processing
Request a temporary halt of data processing while a concern is investigated.
Right to Object
Object to specific data processing activities including marketing and analytics through granular consent controls.
Data Handling & Retention
Data Classification
All data is classified by sensitivity level with appropriate retention periods and access controls.
| Classification | Examples | Retention |
|---|---|---|
| PII | Email, user ID | 7 years |
| Confidential | Payment info, Stripe IDs | 7 years |
| User Content | Property photos, staged images | 3 years |
| Behavioral | Usage metrics, browser info | 1 year |
Consent Management
We use a granular consent model. Essential processing (authentication, service delivery) cannot be opted out. Analytics, marketing, and data sharing are opt-in only with versioned consent records.
Cross-Border Transfers
Data is primarily hosted in the US (AWS us-east-1). For EU data transfers, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions. All third-party processors have signed Data Processing Agreements (DPAs).
Third-Party Processors
All vendors have signed Data Processing Agreements.
| Vendor | Data Processed | DPA Status | Certification |
|---|---|---|---|
| Supabase | User data, images | Signed | SOC 2 |
| Stripe | Payment info | Signed | PCI DSS |
| Vercel | Hosting, logs | Signed | SOC 2 |
| Upstash | Session data | Signed | SOC 2 |
| Fal AI | Image processing | Signed | DPA signed |
Ongoing Compliance Monitoring
Monthly
Audit log review for anomalies
Quarterly
Retention policy compliance assessment
Annually
GDPR/CCPA compliance review
Trust Center
Enterprise customers can request detailed documentation for their security and compliance reviews.
Vendor Security Questionnaire
Pre-filled CAIQ / SIG Lite responses covering our security controls, policies, and practices.
Data Processing Agreement (DPA)
Standard DPA with GDPR-compliant terms, sub-processor list, and Standard Contractual Clauses.
SOC 2 Reports (Vendors)
SOC 2 Type II reports from Supabase, Vercel, and Stripe available under NDA for enterprise customers.
Architecture & Data Flow Diagram
Technical overview of how data flows through RELTO, including encryption points and storage locations.
Request any of these documents by contacting security@relto.app or through the enterprise onboarding process.
Data Protection Contact
For data subject requests, privacy concerns, or enterprise compliance questionnaires, reach our Data Protection Officer.
Response time: 48 hours