Operations
Data processing and retention
How email, AI conversations and support data are processed, retained and deleted.
Processing email
You control sender domains, recipients and message content. RavenRelay processes these to queue email, submit it for delivery and report delivery outcomes. Use the service only for recipients and messages you are authorized to contact. PostgreSQL stores account and email data, Redis coordinates queues, our delivery provider processes delivery, and Railway hosts the application.
AI assistants and your data
AI assistance is optional. Ask a Raven sends your question, recent conversation, current page, selected DNS provider and relevant public documentation to the configured AI provider. When a project is selected, it also sends its name, environment, status and up to 15 domains with their saved DNS records and verification status. It does not load email bodies, API key values or other projects into diagnostics. Anything you type may still contain personal information; do not share passwords, API keys, MFA codes or private email content. Common credential patterns are redacted, but detection is not exhaustive.
The public documentation assistant sends your question, current docs page, up to six recent messages and relevant documentation to the AI provider. It does not access your account or project diagnostics and does not create support tickets. Shared rate-limit counters use the request IP to limit abuse; these are separate from chat content.
OpenAI is the initial AI provider. RavenRelay sets store: false on OpenAI Responses requests to disable response application-state storage. This is not a guarantee of zero retention: OpenAI normally retains abuse-monitoring logs for up to 30 days, with exceptions described in its policy. API content is not used for model training by default unless the customer opts in. Different configured AI providers have their own terms and retention controls; operators must review them before switching.
- OpenAI data controls: https://developers.openai.com/api/docs/guides/your-data
AI conversations and support retention
| Data | Current retention and deletion behavior |
|---|---|
Signed-in AI conversations | Stored in PostgreSQL with up to 32 recent messages, source links and page/project/provider context. No automatic time-based expiry or individual chat deletion control is currently implemented. Deleting the user record cascades to their conversations. |
Browser conversation reference | Dashboard session storage keeps the conversation ID per user/project. Closing the panel or starting a new conversation does not delete the server-side history. |
Public docs conversations | Kept in browser memory and sent with follow-up questions. Refreshing clears local history. Chat content is not stored in RavenRelay’s application database; AI-provider retention still applies. |
Escalated support tickets | A copy of the transcript, sources and troubleshooting context is stored in the ticket for authorized super admins. Closing a ticket does not delete it. Tickets and replies have no automatic expiry; deleting the user record cascades to their tickets and messages. |
Support notifications | Email notifications include ticket message content and may therefore include the escalated transcript. Recipient inboxes and the email delivery provider retain their own copies. Notification delivery records are stored separately and have no automatic expiry. |
Request access, correction, export or deletion through dashboard Support, or contact the operator if you cannot sign in. Requests require identity verification and operator handling; there is no self-service account-wide erasure flow. Deleting a conversation alone does not remove its copied ticket transcript, notification records, delivered emails, backups or provider-held data. Include these copies when making or handling a deletion request.
Retention and deletion
Message HTML and text expire after 7 days. Queued messages older than 7 days fail instead of sending without content. Addresses, subjects, metadata, recipient outcomes and related webhook delivery history expire after 90 days. Processed raw provider feedback is scrubbed after 7 days. A running worker performs cleanup every minute in bounded batches; active sends and webhook dispatches finish before cleanup.
Owners and administrators can permanently delete a finished email log from its detail page. Pending webhook deliveries are cancelled; future feedback for the deleted email is ignored. Deletion cannot recall emails or webhook payloads already delivered to external systems.
Minimal tombstones retain IDs, timestamps, status, provider correlation ID and hashes for idempotency and operational integrity. Usage counters, security audit records and workspace suppressions are retained independently. Removing a log does not restore quota, permit duplicate sends or remove a suppression. Suppression entries can be managed separately by owners and administrators.
Backups may retain deleted data until the configured backup retention period expires. Restored backups require retention cleanup before resuming services. Backup schedules and retention must be configured by the operator; the application does not claim to erase copies held by your recipients or webhook applications.
Security and requests
API keys are stored as hashes, webhook secrets are encrypted and all access is scoped to workspace and project membership. Message bodies and BCC are omitted from read APIs and the dashboard. Request account-data access, correction, export, contractual documentation or account erasure through the operator; account-wide erasure is not an automated dashboard feature.