Roles and purposes
The Spanish operator in the legal notice controls account, billing, security and support data. Contract performance supports delivery; legal obligations support accounting and required disclosures; legitimate interests support proportionate security, fraud prevention and reliability, balanced against your rights.
The current inference offer is limited to content without personal data. Do not submit information about identifiable people in prompts, files, headers or other request fields. The DPA draft is informational, not an executed agreement or part of the current offer. If personal data nevertheless reaches the service, the applicable legal duties still apply; this restriction does not make it anonymous. Spanish information is available.
Account and billing data
Registration requires neither a name nor recovery email. Account IDs, protected credentials, authentication events, usage, model identifiers, token counts, charges and timestamps support access and metering. Pseudonymous identifiers are still personal data where linkable.
Payment providers may require billing details. Zrelay keeps payment references, amounts, credit movements, refunds and acceptance evidence. Purchase email, where used for contract delivery, is separate from optional recovery email and is not used for marketing.
Prompts and outputs
Zrelay forwards your content to inference suppliers and processes responses. Normal prompt and output bodies are not stored as conversation history in its application database. Trial authentication-error diagnostics can retain an upstream error excerpt of up to 4,096 characters. Credentials are redacted, but echoed personal information may remain.
Trial abuse records retain derived content signatures and request metadata. Two active suppliers have confirmed to the operator that they keep usage records, not content; this is not a documented contractual guarantee. Another active supplier can retain prompts and responses. Conditions differ by route. Zrelay does not promise zero retention or exclusion of training across the whole chain.
Network records
Zrelay's own hosts are in Spain. Hosting and security systems process IP addresses and connection information. Logs can contain errors, request references and URLs. The gateway removes common IP-forwarding headers and replaces Zrelay API credentials with supplier credentials. It does not remove every identifier: request content and other client-supplied fields or headers may identify someone.
Communications
Support email uses Purelymail. Resend is selected for transactional security, recovery and purchase emails when enabled. Purchase email does not enable account recovery. Optional Telegram support and operational alerts process messages or limited purchase references; alerts do not intentionally include secrets or prompt bodies.
Optional recovery email and Google linking, where enabled, process addresses, protected identity identifiers and security metadata. Email delivery services receive recipients and message content. Capacity-partner enquiries collect contact email, proposed provider and capacity to respond. These features are separate from ordinary registration.
Browser storage
Necessary authentication cookies and browser storage support sessions, theme, motion and dismissal preferences. Browser controls can clear preferences. No advertising or website analytics integration was identified in the reviewed source. Google Fonts receives browser connection information, including IP addresses. Hosted checkout has separate payment and fraud-storage disclosures.
Retention
Current schedules are 30 days for infrastructure logs and trial diagnostics or behavioural records, 90 days for security events, and 12 months after resolution for ordinary support enquiries. Account and usage records support the ongoing service; unnecessary data is assessed for deletion on verified requests. Provider schedules and comprehensive automatic deletion remain subject to verification.
Accounting documents are retained six years from the last entry; applicable VAT OSS records require ten years from the transaction year's end. Legal duties or claims can extend retention. Financial retention does not justify keeping unrelated telemetry. Backups may temporarily retain deleted data; completed deletion actions must be reapplied on restoration.
Your rights
Contact support@zrelay.net for access, correction, erasure, restriction, portability or objection; consent can be withdrawn where used. Provide a non-secret reference, never credentials. Identity checks are proportionate. Responses are due within one month; a justified extension of up to two further months is explained within the first month.
You may complain to the AEPD or your competent authority. For business-submitted content, contact that business as controller; Zrelay assists as applicable. Legal retention may limit erasure of particular records.