BLYRELAY
Privacy
Who we are
BLYRELAY is a software product in development by BLY LLC (trade licence no. 2433593.01, issued by Sharjah Media City (SHAMS); registered address: Sharjah Media City, Sharjah, United Arab Emirates), referred to here as “BLY”. Contact for privacy questions: privacy@bly.ae.
For the information described here, BLY decides how it is used. [Role descriptions (controller, processor) to be confirmed after legal review.]
Current stage
BLYRELAY is a shared inbox and customer-relationship tool for business messaging. It is not offered to the public and has no public sign-up: staff accounts exist only by invitation. During this stage it is used by BLY staff, mostly with invented test data, and is connected to Instagram only to receive messages for Instagram accounts that BLY owns or controls.
- Receive-only. BLYRELAY does not send any message through Instagram or any other real account. Sending is blocked in the software and in its database; reply, automation and campaign features run only against invented test accounts and never leave BLY’s computers.
- No external AI. BLYRELAY contains connections to external AI providers, but they are switched off. No message or contact information is sent to any AI provider. Should this change, this page will be updated first.
- Facebook Messenger and WhatsApp are not connected.
Information we process
From Instagram
When someone interacts with a BLY-controlled Instagram professional account connected to BLYRELAY, Meta may notify BLYRELAY. Depending on the event this can include:
- Instagram-scoped identifiers of the account and of the person who interacted with it, and that person’s display name or username;
- message text, attachment links, message identifiers and timestamps;
- read receipts.
BLYRELAY’s database does not store Instagram access tokens or passwords. The credentials BLY uses to connect its own test accounts to Meta (an app secret, a webhook verification code and an access token for a BLY-owned test account) are kept in access-restricted configuration files on BLY’s development computer, outside the database and outside source code. BLYRELAY does not collect information about people who have not interacted with a connected BLY account.
Records BLY staff create in BLYRELAY
For a person who messaged a connected account, staff may add records such as notes, tags, tasks, sales opportunities and their outcome, and further contact details (for example an email address or phone number). Contact lists can also be imported from a spreadsheet; during this stage only test data is imported.
Consent records
BLYRELAY records whether a person agreed to, or withdrew from, automated or marketing messages, with the date, how it was given and a short note of the evidence. A “do not contact” choice is also recorded.
About BLY staff using BLYRELAY
For staff accounts, BLYRELAY stores an email address, a name, a securely hashed password, sign-in sessions (including the browser’s user-agent string) and a security log of sign-ins, sign-in failures, password changes and account recovery. It uses one necessary cookie, only to keep staff signed in. It does not record IP addresses, and uses no analytics or advertising cookies.
How we use it
To test that BLYRELAY receives, shows and organises messages correctly; to check security controls, such as verifying that notifications genuinely come from Meta; to keep staff accounts secure; and to diagnose errors. We do not use the information for advertising or profiling, we do not sell it, and we do not use it to train AI models.
Where it is kept, and for how long
During testing, BLYRELAY and its database run on BLY-controlled computers, with access restricted to authorised staff. Credentials are kept out of source code.
- Raw notifications from Meta are deleted once processed, or after 30 days at most. Notifications for accounts that are not connected are kept for at most 30 days, to diagnose errors.
- Ended sign-in sessions are deleted after 30 days; records of sign-in attempts after one day.
- Delivery statistics keep only counts, for 30 days.
BLY has adopted the following further retention rules. The automatic deletion they need is built but not yet switched on; until it is, this information is kept for the testing stage and deleted on request — see data deletion.
- Conversations, messages, contact details and customer records about a person: deleted after 24 months without any activity, unless a documented legal hold applies.
- If a workspace is closed: a 30-day window to recover or export its data, then the personal information in it is deleted.
- The staff security log: 180 days.
- Local backups: replaced within 30 days of being made.
[Retention of consent records, the “do not contact” choice, audit history and deletion records, and the legal-hold procedure, to be confirmed after legal review.]
Service providers
Information is received from Meta Platforms (Instagram), whose own terms and privacy policy apply to your use of Instagram. During testing, notifications may pass through a network tunnelling service operated by Cloudflare, Inc. to reach BLY’s development computer. This website, including this page, is hosted by Vercel Inc.; Vercel does not receive BLYRELAY information. No other service provider receives BLYRELAY information.
[Statements on international transfers to be added after legal review.]
Your choices
You can stop messaging a BLY account at any time. You can ask for a copy of what BLYRELAY holds about you, or for its deletion, by following the data deletion instructions or contacting privacy@bly.ae. A copy is provided as a structured file.
[Applicable rights, legal bases and response times under UAE law and, where relevant, EU law to be added after legal review.]
Security
Measures appropriate to a testing stage: signature verification of every notification from Meta; separate database accounts with access limited to each workspace; hashed passwords and expiring sessions; a security log; and credentials kept out of source code. No system is completely secure.
Children
BLYRELAY is not directed at children. [Minimum-age statement to be added after legal review.]
Changes
This page will be updated when BLYRELAY’s handling of information changes, and in any case before public or commercial availability.