BugRelay is a product by Rizaklabs. The registered legal operator name, official business contact and registered address must be added before public launch. Hosting regions and final tax treatment will be updated after deployment is configured. This is a working draft for owner review.
Who operates BugRelay
BugRelay is being developed by Rizaklabs for product teams and digital agencies. The data controller’s registered name, official email address, contact number and headquarters address will be shown here before the service launches. Privacy questions can currently be submitted through the contact form.
Information we handle
When you use BugRelay, the service processes account and workspace details, team memberships, projects and reports you choose to submit. A report may contain a title, description, reproduction steps, annotations, a screenshot, a reviewed screen recording, selected console or network metadata, and browser or viewport details. The collector excludes request bodies, headers, cookies and browser storage contents. Diagnostic text filtering is best effort.
If you contact us, the form stores your name, reply email, topic and message so the team can respond. Do not send passwords, access tokens, payment details or private report links through the contact form.
Capture is deliberate
Capture starts when the user activates it. Screen recording requires an explicit browser surface selection and has no audio. Screenshot masks cover selected pixels; blur is visual obscuring and should not be treated as a guarantee of anonymization. Screenshot edits do not redact video. Layout replay is optional and records masked page shapes, clicks and scroll positions; it does not copy page text, field values, scripts or original images. Review all evidence before upload and sharing.
Why information is used
We use account details to authenticate users and provide workspaces; report data to store, display and organize the evidence requested by the team; contact details to respond to support requests; and limited technical records to protect, troubleshoot and maintain the service. Capture and sharing actions are user initiated. The final notice will identify the applicable processing basis and explain any consent choices in line with Saudi Arabia’s Personal Data Protection Law and its implementing rules.
Access and sharing
Reports are private to authorized workspace and project members by default. If an owner creates a share link, anyone holding that link can access the selected report until the link expires or is revoked. A visual-only share omits diagnostic events and environment details. Connecting GitHub, email or another provider sends only the fields chosen for that integration; recipients may retain their own copies.
Service providers and international transfers
The BugRelay Supabase project is provisioned in the EU West (Paris) region and the verified Resend sending domain is in the US East region. Production hosting and private file storage are not yet deployed. Before launch this notice will list the actual providers, processing locations and transfer safeguards, including any processing outside Saudi Arabia. We will not describe planned services as live data processors until they are configured.
Retention and deletion
Reports follow the workspace retention setting (14 days by default) and may be retained longer if an owner changes that setting. Expired reports are removed from access before background object cleanup completes. The contact-message endpoint currently applies a 90-day retention period. Unsynced extension drafts expire locally after 24 hours. Deletion may not remove copies already exported, sent to an integration or retained in a provider’s backups.
Your privacy requests
You may request access to your personal data, a copy, correction or deletion, and withdraw consent where processing relies on consent, subject to applicable law and identity verification. Workspace owners can export workspace data and request account deletion through the product. Contact BugRelay through the privacy request form; we will publish the verified contact details and response process before launch. Individuals may also contact the competent Saudi authority where applicable.
Security and updates
We use access controls, private storage and limited diagnostic collection. No online service can promise absolute security. This notice will be updated when production hosting, email, billing or integrations change. The effective date and version history will be added before launch.
Working draft · 1 November 2026 · Questions or corrections?