by ExpoGenie

Security

Straight answers about your data.

Who owns your leads, who can see them, where they are stored, how AI is used, and what is not in place yet. The full detail is in our Privacy Policy.

Who owns the leads?

Your company does. Lead data belongs to the company that holds the Relay account, and ExpoGenie processes it on your behalf.

Your company can export its leads from the web app at any time. A Data Processing Addendum is available on request from info@expo-genie.com.

Who can see them?

Relay is one account per company. Everyone on your account can see the company’s leads and folders, so nothing is lost when someone leaves. Admins add and remove users, change roles, manage billing and export data.

Event organizers never see your leads, notes, voice notes or transcripts. If you use Relay through an organizer’s event, they can see that your company has Relay, whether it bought Attendee Match, and summary counts such as how many leads you captured there.

ExpoGenie support can access an account when your company asks, or when needed to keep Relay secure.

Where is it stored, and how is it protected?

In the United States, on Google Cloud. Data is encrypted in transit and at rest, access controls limit who at ExpoGenie can reach customer data, and our systems are monitored.

People sign in with a one-time code sent to their work email, or with Google or Apple.

How is AI used?

Badge and card reading runs on the phone. Voice notes are transcribed on the phone too, using Wispr Flow’s on-device model, so badge photos and voice audio are not sent to an outside AI or transcription vendor.

Contact enrichment uses Apollo.io and an AI agent, under contracts that limit them to providing the service and do not allow training on the data. Relay does not use your leads, voice notes or transcripts to train AI models.

Does Relay record conversations?

No. Voice notes are for your own recap after a conversation, recorded only when you tap record. Relay never records in the background and does not create voiceprints.

How long is data kept?

Voice note audio: 90 days after it is transcribed, then deleted. Leads, transcripts, notes and badge images: while your account is open, unless you delete them sooner. Deleted items leave Relay right away and backups within 30 days.

If you close your account, you have 30 days to export, and the data is deleted within 90 days after that.

Service providers

Who helps us run Relay.

CRMs you connect, such as Salesforce or HubSpot, receive data at your direction and are not our service providers.

Google CloudHosting, storage and backups
Apollo.ioContact enrichment
AI service providersThe AI agent used for contact enrichment
Mandrill by MailchimpWelcome emails, sign-in codes, receipts and reports
StripePayments, including Apple Pay
AppleApp distribution and App Store purchases
Google SheetsAttendee Match lookups against the organizer’s own sheet
NetlifyWebsite hosting and website forms

Today and on the roadmap

What is in place, and what is not yet.

In place today

  • Encryption in transit and at rest
  • Company-owned data with export at any time
  • Admin roles for users and billing
  • On-device badge reading and transcription
  • Do-not-enrich list for people who ask
  • GDPR access, export and erasure requests

Not in place yet

  • SOC 2 or ISO 27001 certification. We do not hold either today.
  • Single sign-on (SSO). It is on the roadmap.
  • Published uptime or performance commitments.

If a specific control is a hard requirement, tell us before you roll Relay out.

Talk to us

Bring your security questions early.

We will walk your team through how Relay handles data, and send a DPA if you need one.