Last updated · 2026-10-30
This page describes the information used to scope data-processing arrangements with Relsor. It is not an executed Data Processing Addendum, a signed transfer mechanism or confirmation that an agreement is already in place. Contact hello@relsor.ai to request the documentation for your organisation before processing information that requires it.
Request a DPACustomer and Relsor roles
For personal data supplied or connected to a customer-controlled workspace, the customer generally determines the purposes of processing and acts as controller. DBM LLC processes that information to deliver Relsor on the customer's documented instructions. If the customer itself acts as a processor for another organisation, the relevant roles and authorisations must be reflected in its agreement with us.
DBM LLC separately handles account administration, billing, security and its own business communications for its own purposes where applicable. Those activities are described in our Privacy Policy and are distinct from processing workspace content on the customer's behalf.
Scope of workspace processing
Workspace processing can include receiving and storing messages and files, retrieving authorised connected-service information, analysing material with configured AI providers, producing outputs, carrying out authorised actions and recording task and approval history. Processing depends on the features and instructions selected for the workspace.
The people concerned may include workspace members and the customer's employees, contractors, customers, suppliers or other contacts whose information is supplied. Information can include names, contact details, professional information, communications, document content, media and task metadata. The customer should limit content to what its intended workflow needs. Special-category, highly sensitive or otherwise restricted information requires a separate assessment and any necessary written arrangement before use.
Product controls supporting your instructions
Relsor provides account authentication, workspace roles, tenant-scoped access checks and approval workflows for supported sensitive actions. Connected services operate within their granted scopes. These controls support the customer's governance; the customer still chooses authorised members, lawful uses, appropriate permissions and when an action may proceed.
A security schedule for a DPA should identify the measures relevant to the agreed service and configuration. This page does not claim an independent security certification or replace a review of your requirements.
What the agreement needs to cover
The DPA should identify the parties, service scope, processing duration, information and people concerned, and the customer's instructions. It should also address confidentiality, security responsibilities, incident notification, support for individual rights and compliance enquiries, evidence and audit arrangements, authorised subprocessors, international transfers, and return or deletion when the service ends.
The applicable obligations, notices, assistance process and any transfer terms must be set out in the agreement actually entered into by the parties. A public provider list or privacy notice does not by itself create those contractual arrangements.
Providers and international transfers
The providers and services page identifies implementations used for hosting, storage, communications, payments, measurement and configured AI processing. Their roles differ: a payment provider's own compliance activities and a customer's connected SaaS account are not automatically the same as a subprocessor used to process workspace content.
For a DPA, the relevant provider entities, processing locations, authorisation or objection procedure and any required transfer safeguards must be confirmed for the contracted service. DBM LLC's address in the United States does not establish that every service is US-only or that a particular transfer framework applies.
Rights requests and security concerns
A workspace customer should coordinate requests concerning the information it controls. Contact hello@relsor.ai with the workspace identifier, the nature of the request and an authorised contact. Avoid including additional sensitive information until we agree a suitable channel. For a suspected incident, describe the affected account or workspace and the time and behaviour observed.
The DPA should specify how we assist the customer, report relevant incidents and coordinate any required notices. This information page does not promise an unagreed incident deadline or substitute for a customer's own reporting duties.
Return, deletion and retention
Before ending a workspace, identify the content to export, the systems in scope and the authorised return or deletion instruction. Temporary file expiry, revoking a connection, deleting an item and closing the account have different effects. Content already delivered to third parties remains subject to the arrangements with those recipients.
A DPA should specify the agreed end-of-service process, any legally required retention and the treatment of residual operational copies. Our retention information explains current product distinctions; it does not establish a universal deletion deadline.
Request documentation for your organisation
Email hello@relsor.ai with your organisation's legal name, business address, authorised signatory or contract contact, workspace identifier, intended use, expected data categories, and any required regions or transfer terms. We will use those details to determine the appropriate documentation and configuration with you.
The contracting service provider is DBM LLC, 8 The Green, Ste B, Dover, Delaware 19901, United States. An agreement becomes effective through the execution or acceptance process expressly stated in that agreement.
Relsor · DBM LLC
8 The Green, Ste B, Dover, Delaware 19901, United States
hello@relsor.ai