Relevance AI

GDPR overview

GDPR compliance is claimed explicitly and repeatedly: a GDPR badge appears on the home, product, enterprise and agents pages, every pricing tier lists SOC 2 and GDPR compliance, and the security documentation devotes a section to it. Section 13 of the privacy notice sets out EEA and UK data subject rights — access, rectification, erasure, objection, restriction, portability, withdrawal of consent and complaint to a supervisory authority — and a table maps each processing purpose to its lawful basis. Transfers outside the EEA and UK rely on adequacy decisions under Article 45 or on safeguards under Article 46(2), namely Standard Contractual Clauses; transfers to California are named. Sub-processors operate in the United Kingdom, the EEA, the United States and Australia. The single contact point is privacy@relevanceai.com. No Article 27 EU representative and no data protection officer are named.

Who owns the data?

Under the terms, you keep ownership of what you upload: the security documentation states that all data uploaded to Relevance AI remains your property, and you can export it as CSV, Excel or JSON at any time. In exchange, clause 8.3(a) grants OnSearch Pty Ltd and its personnel a non-exclusive, royalty-free, non-transferable, worldwide and irrevocable licence to use Client Data as reasonably required to provide and to improve the Solution. Relevance AI retains ownership of its own Software Content, including the software, text, graphics and logos. Account deletion is processed within 60 days, but clause 4(b) ends any obligation to retain user data once the billing cycle following cancellation closes.

Reuse rights

You may reuse your own data freely, without asking permission: it stays your property, export in CSV, Excel or JSON is available at any time, and knowledge bases, agent logs and files remain under your control for retention and deletion. What the vendor may do with it is narrower than the licence text suggests at first reading. Relevance AI states it does not use customer data to train its models or improve its services unless a specific partnership agreement exists, and repeats that it never trains models on customer data; metadata may improve features such as search, never training. Tool inputs and outputs are not logged. Default third-party models are GPT from OpenAI and Claude from Anthropic, both listed as not logging and not training, with a DPA in place. Against that, clause 8.3(a) licences Client Data to provide and improve the Solution, and clause 8.3(c) lets the vendor remove Client Data it judges inappropriate or illegal.

Data retention & training

Hosting summary

Data is stored in one of three regions chosen at signup: US (N. Virginia), EU (London) or AU (Sydney). The choice is permanent — it cannot be changed after the organisation is created. Agent conversations and Knowledge data stay in the selected region. Infrastructure runs on a cloud IaaS provider, and Relevance AI additionally self-hosts OpenAI and open-source models such as LLaMA and Fireworks inside its own multi-region AWS and Azure environments. The architecture is multi-tenant with logical separation; Enterprise customers with fine-grained access control get a separate service and database, and single-tenant options are described as still in development. Encryption is TLS 1.2 or above in transit and AES-256 at rest, with automatic encrypted backups across multiple availability zones and network isolation through custom VPCs and private subnets. Terms clause 6.3(a) allows cloud storage outside Australia. Sub-processors and operations sit in the United Kingdom, the EEA, the United States and Australia, and the sub-processor list is published on the trust centre.