Privacy Notice

Reley collects the following categories of personal data to provide the service:

Reley retains personal data for the following periods, or for longer when required by applicable law:

Account and identification data: for the duration of the contract and for five (5) additional years from its termination, in accordance with the commercial record-keeping periods of the Mexican Commercial Code.

Documents uploaded to the service and counterparty data: in accordance with the Client's instructions and the retention policy published at reley.ai/security; the Client may delete them at any time from their account.

Attestations and audit logs: ten (10) years from their issuance, as set out in Section 5 of the Terms and Conditions.

Billing data: five (5) years from the date the tax invoice was issued, in accordance with the obligations of the Federal Tax Code (Código Fiscal de la Federación).

Access logs and technical logs: ninety (90) days, unless they form part of a formal audit log, in which case they are retained for ten (10) years.

Once the above periods have elapsed, data will be deleted or anonymized so that it can no longer be associated with an identified or identifiable person.

Primary purposes are those necessary to provide the service under Article 20 of the LFPDPPP and do not require your additional consent. Secondary purposes are optional: you can object to them without affecting the provision of the service.

When you receive documents from your counterparties through Reley, you (or your organization) are the data controller of the personal data those documents contain, as defined in Article 3, section XIV of the LFPDPPP. Reley acts as data processor in the terms of Article 21 of the same Law.

As data processor, Reley: (i) processes Counterparties' personal data only in accordance with the Client's instructions; (ii) does not use it for any purpose other than those contemplated in the service; (iii) does not transfer it except to the sub-processors listed in Section 5; (iv) keeps it under the security measures described in Section 10; (v) returns or destroys it at the end of the contract in accordance with the policy published at reley.ai/security and with the Terms and Conditions.

Counterparties who share documents through the service receive at the time of interacting with the audience link a specific privacy notice describing the processing of their data. The Client is the primary responsible party vis-à-vis its Counterparties and must ensure that they have the necessary information under applicable law.

The details of the data processing relationship — including sub-processors, mechanisms for returning or destroying data at the end of the service, and specific obligations of the processor — are set out in the Terms and Conditions that the Client accepts when contracting Reley.

Reley relies on technology providers (sub-processors) to operate the service. These transfers are necessary for the provision of the service and do not require your additional consent under Article 37, section I of the LFPDPPP, since they are governed by legal relationships between Reley and each provider that bind them to comply with Mexican data protection legislation. Current providers are:

Vercel Inc. (United States of America) — application hosting and content delivery network. Data received: all information in transit through the application.

Supabase Inc. (United States of America) — database, file storage, and authentication. Data received: account data, documents, audit logs.

Datalab (OCR processing; registered address under verification) — conversion of documents to structured text. Data received: images and PDFs of documents processed with OCR.

Kapso (Mexico) — message delivery through the WhatsApp Business API. Data received: phone number and notification message content.

Stripe Inc. (United States of America) — payment processing for paid-plan users. Data received: tokenized card data and billing information. Reley does not store full payment card data.

AI model providers accessed through Vercel AI Gateway, including Anthropic PBC (United States of America) and OpenAI LLC (United States of America), among other equivalent providers — to assist in reading and classifying documents. Data received: text extracted from documents. These providers operate under zero data retention agreements; no client document feeds future training.

Reley requires these providers to maintain the same level of personal data protection described in this Notice through contractual clauses equivalent to those required by the LFPDPPP. The updated list of sub-processors is published at reley.ai/subprocessors.

Certain data may also be processed by JARO FREIGHT LLC, the affiliated United States entity, in its capacity as global owner of the brand and provider of technical operations. This international transfer is made under a legal relationship between both entities (Article 37, section I LFPDPPP) that binds JARO FREIGHT LLC to comply with the LFPDPPP and equivalent regulations, solely for purposes compatible with those described in this Notice.

Reley does not sell your personal data or your counterparties' personal data to third parties for commercial purposes under any circumstances.

Reley uses artificial intelligence to assist in reading, extracting fields from, and classifying documents uploaded to the service. These evaluations may influence the information the Client sees about the status of its Counterparties' documents (for example, whether a field was correctly extracted or whether a document is current).

AI-generated evaluations are support tools for the Client; they do not constitute autonomous decisions about individuals. The Client is the one who decides, based on the service's output, whether to admit, approve, or continue with a Counterparty.

Under Article 16 of the LFPDPPP, data subjects have the right to request that an evaluation that directly affects them be reviewed by a person. To exercise this right, the data subject may write to privacidad@reley.ai describing the evaluation in question.

You have the right to Access your personal data, Rectify it when it is inaccurate or incomplete, Cancel it when you consider it is not required for any of the stated purposes, or Object to its processing for specific purposes.

To exercise these rights:

1. Write to privacidad@reley.ai from the email address registered in your account.

2. Include: full name, a clear description of the right you are exercising, the data it applies to, and, where applicable (for example for rectification), documents that support your request. We may request an identity verification method when reasonably necessary.

3. We will respond within a maximum of 20 business days under Article 32 of the LFPDPPP, and will give effect to your request within the following 15 business days when appropriate.

If your request is not addressed or you consider the response insufficient, you may file a claim with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at inai.org.mx.

You may withdraw at any time the consent you have given for the processing of your personal data for secondary purposes, following the same procedure as for ARCO rights.

If you wish to withdraw consent for primary purposes necessary to provide the service, note that such withdrawal may prevent us from continuing to provide the service in whole or in part; in that case we will let you know before proceeding, and you may terminate the contract in accordance with the Terms and Conditions.

You may limit the use or disclosure of your personal data by writing to privacidad@reley.ai. Where appropriate, we will add you to Reley's internal exclusion list to prevent you from receiving promotional or commercial-prospecting communications.

Reley applies reasonable administrative, technical, and physical measures to protect your personal data from damage, loss, alteration, destruction, or unauthorized use, access, or processing. Among them: encryption in transit via TLS 1.2 or higher, encryption at rest (AES-256), role-based access control, immutable audit logs, logical segregation of data by organization through Row-Level Security at the database layer, periodic review of providers, and regular evaluation of our security posture.

When we obtain external audits or independent certifications, we will publish them at reley.ai/security together with their scope.

Breach notification: in the event of a security breach that significantly affects the financial or moral rights of data subjects, Reley will notify the affected data subject immediately by email, describing the nature of the breach, the data affected, the corrective measures taken, and the steps the data subject can take to protect themselves. Reley will also notify the INAI in accordance with the procedure established in the LFPDPPP and its Regulations.

Reley uses the following categories of cookies:

Strictly necessary cookies: required for user session operation and authentication. They cannot be disabled without preventing use of the service.

Anonymous or pseudonymized analytics cookies: when we engage analytics tools (such as Vercel Analytics or equivalents), they are used to measure aggregate product usage without generating individual profiles or identifying data subjects.

We do not use third-party advertising cookies or share browsing data with advertising networks.

You can manage cookies from your browser settings. Disabling strictly necessary cookies may prevent use of the service.

Reley reserves the right to modify this Privacy Notice at any time to reflect changes in applicable legislation, in the service, or in our practices. Modifications take effect upon their publication at reley.ai/privacy.

When changes are substantial (for example, the addition of new purposes requiring consent, or changes to sub-processors handling sensitive data), we will notify you by email at least 15 calendar days before they take effect. If you do not agree with the changes, you may exercise your right of cancellation as described in Section 7.

For any questions about this Notice or the processing of your personal data:

Privacy Department — SBT FREIGHT BROKER SA de CV (operating as Reley)

Email: privacidad@reley.ai

Address: Av. Magallanes 1155, Int. 6 A - 1, Col. Santa Anita Camino Real, San Pedro Tlaquepaque, Jalisco, C.P. 45600, Mexico.