Privacy notice
Privacy requires collecting less, not explaining more collection.
This notice describes the limited information involved in delivering the site, reviewing submitted reports and assessment requests, and operating a consent-bound investigation Case.
The short version
No advertising profiles. No third-party analytics. Sensitive Evidence is kept out of complaints.
A Case requires a User contact channel and verified Subject Data. Subject Data and original results are encrypted separately; only redacted Shareable Evidence can enter External Material.
Ordinary visits
RightsRelay does not use advertising profiles or third-party analytics on this site. The hosting and network services needed to deliver the site may process basic connection information, such as an IP address, user agent and request time, for security, abuse prevention and reliability.
Cases you choose to create
A Case stores its starting URL, factual summary, User contact, Investigation Scope, consent records and an email address or phone number used as Subject Data. The User contact is encrypted. Subject Data is encrypted in separate object storage and represented in the operational record only by a mask and keyed fingerprint.
The intake applies a temporary anti-abuse limit. The address used for that limit is not added to the Case record.
Information that does not belong in a report
Do not submit passwords, authentication codes, payment-card details, bank credentials, private keys or identity documents. The pilot accepts only an email address or phone number controlled by the User as Subject Data. Narrative fields must not contain Subject Data or unrelated personal information.
Security assessment requests
An assessment request stores the requester's name, work email, organization and role together with the proposed target, service type, objective, initial scope information and authorization confirmations. The target is recorded as submitted; the form does not visit, scan or test it.
A private administrative messaging service receives only the request reference, assessment type and proposed target host. Contact details, the assessment description and operational constraints remain in the private review system. Do not submit credentials, private keys, production data or confidential documents through the initial request form.
Investigation and evidence
The worker follows only the recorded Investigation Scope. Public websites can learn the worker IP, access time and browser metadata. Telegram can learn the investigation account, any public channel membership, the exact Controlled Query and the complete Complaint Package presented for Approval. The mail provider can learn the verification recipient and each approved recipient-specific message and Shareable attachment it delivers.
Every material state is recorded in the ordered Trace and captured as evidence. Originals are Sensitive Evidence. Redacted derivatives are Shareable Evidence and retain a derivation link and integrity hash. Reports are not sold or used for advertising.
Complaint disclosure and Approval
The complete Complaint Package is presented to the User in Telegram before Approval. It contains recipient-specific messages and Shareable Evidence only. A registrar or platform may forward the complaint's subject or supporting material to the reported party. Anonymity is therefore not guaranteed.
Inspection, retention and deletion
The private Case view lets the User inspect retained Sensitive Evidence and request deletion when no active investigation action requires it. Deletion removes evidence objects and identifying contact fields while retaining only non-identifying integrity and audit metadata needed to account for the Case. No internet system can be guaranteed completely secure, so the pilot deliberately narrows accepted Subject Data and external disclosures.