Privacy Policy

Relay is operated by Backpedal Pty Ltd (ABN 88 152 435 286), trading as Relay Tech, a company incorporated in Queensland, Australia. We provide a relief teacher management platform for Australian schools.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We collect personal information that is reasonably necessary to provide the Relay service. This includes:

Account information: Your name, work email address, phone number, and the school or organisation you are associated with. This is collected when you register for an account.

Profile information: Your role (deputy, permanent staff, or relief teacher), employment preferences, preferred teaching year levels, and availability days. This is collected progressively as you use the platform.

Job and leave data: Leave request details, job postings, application history, and assignment records created through normal use of the platform.

Uploaded files: Lesson plans and other documents you choose to attach to a leave request. These are stored securely in Supabase Storage and accessed only via time-limited signed URLs.

Usage data: Standard server logs including IP address, browser type, and pages accessed. This data is used solely for security monitoring and service improvement.

We use personal information only for the purposes for which it was collected:

— To create and manage your Relay account and authenticate your identity.
— To match relief teachers to suitable leave jobs based on their preferences.
— To send transactional notifications about job applications, assignments, and account activity (via Resend).
— To provide school administrators with reporting on leave patterns and relief usage.
— To respond to support requests and improve the platform.

We do not use your personal information for direct marketing beyond the service you have signed up for. We do not sell or rent personal information to third parties.

We share personal information only with the following parties, and only to the extent necessary to deliver the service:

Supabase (Supabase Inc.): Our database and authentication provider. All data is stored in the ap-southeast-2 (Sydney) region. Supabase processes data on our behalf under a Data Processing Agreement.

Resend (Resend Inc.): Our transactional email provider. Email addresses and names are shared to the extent necessary to deliver invitation, assignment, and notification emails. Resend does not use this data for any other purpose.

Vercel (Vercel Inc.): Our hosting provider. Vercel processes HTTP requests to deliver the application but does not persist personal data. Our Sydney-hosted Supabase instance remains the sole data store.

We may disclose personal information if required to do so by law, court order, or regulatory authority, or to protect the rights, property, or safety of Relay, our users, or the public.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

— Cookie-based authentication sessions with short expiry; no tokens stored in browser local storage.
— Row-level security on all database tables, ensuring each school's data is isolated from others.
— Uploaded files stored under unpredictable paths and accessed only via signed URLs that expire after one hour.
— Multi-factor authentication (TOTP) required for platform administrators.
— All data in transit encrypted with TLS 1.2 or higher.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

We retain personal information for as long as your account is active or as needed to provide the service. When an account is closed — whether by the user or by a school administrator — the authentication credential is deleted immediately. Profile and activity records are retained for a period of 12 months after account closure to support reporting accuracy for the school, then permanently deleted.

You may request deletion of your personal information at any time by contacting us at hello@relay.au. We will respond within 30 days.

Under the Privacy Act 1988 (Cth), you have the right to access personal information we hold about you and to request that inaccurate, out-of-date, incomplete, or misleading information be corrected.

To exercise these rights, contact us at hello@relay.au. We will acknowledge your request within 5 business days and respond fully within 30 days. In some circumstances we may decline a request; if so, we will explain why.

Relay uses cookies solely for authentication session management via @supabase/ssr. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The theme preference (light/dark mode) is stored in browser local storage only and contains no personal data.

Relay is not directed at children under the age of 18 and we do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify registered users by email. Continued use of Relay after changes are posted constitutes acceptance of the updated policy.

If you have questions, concerns, or complaints about how we handle your personal information, please contact our Privacy Officer:

Email: hello@relay.au
Backpedal Pty Ltd (ABN 88 152 435 286)
Trading as Relay Tech
Queensland, Australia

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.