Privacy & Cookies Policy

1) Who We Are & Contact

This Privacy & Cookies Notice explains how we process personal data when you visit our websites, create an account or use the ReplyEdge Service.

Controller: Suheyl Ünüvar Einzelunternehmen. For full contact details (address, phone), see our Legal Notice.

Contact for privacy matters: support@replyedge.com

Supervisory authority: Our lead supervisory authority is the Bavarian Data Protection Authority (BayLDA), Germany.

2) Scope & Roles

This notice covers:

• visits to our websites (including app.replyedge.com);
• creation and management of customer accounts and subscriptions;
• use of our Gmail, Outlook and WhatsApp integrations; and
• support requests and other communication with us.

For website, account, billing and analytics data, we act as an independent controller under the GDPR.

For email, WhatsApp and other communication content that you choose to process through the Service, we act as your processor and process personal data only on your documented instructions, as described in the Data Processing Addendum (DPA).

3) Data We Collect

We process the following categories of personal data:

• Account & profile data: name, email address, password (stored hashed), and account settings (such as AI preferences and connected services configuration).
• Billing & subscription data: Stripe customer ID, subscription status, trial and renewal dates, and invoice/payment status. Payment card details are processed directly by Stripe and are not stored by us.
• Service configuration data: connected accounts (Gmail, Outlook, WhatsApp), selected folders or labels, blacklist settings, signatures, feature toggles, and similar configuration.
• Service telemetry & logs: IP addresses, device and browser information, timestamps, API endpoints used, error logs, authentication events and security logs.
• Communication content (processed on your behalf): When you enable AI-assisted features, the Service processes email or WhatsApp message content—including any attached media (images, audio, video, documents)—solely to generate draft responses or summaries.
• Support and correspondence: information you send us in support tickets, email, or other channels, including attachments or diagnostic data.
• Product analytics & usage data: feature usage events, funnel steps, aggregate performance data, rough location (based on IP), and identifiers assigned by our analytics tools, where enabled.

4) Purposes & Legal Bases

We process personal data for the following purposes and on the following legal bases:

5) Cookies & Similar Technologies

We use cookies and similar technologies (such as local storage or SDK-based identifiers) on our websites and application.

Under German law, the use of non-essential cookies and similar technologies generally requires prior consent under Sec. 25 of the Telecommunications-Telemedia Data Protection Act (TTDSG) and Art. 6(1)(a) GDPR, while strictly necessary cookies may be used without consent.

You can withdraw or change your consent at any time by adjusting your browser settings or using our cookie consent management tool. Disabling cookies may limit some features.

6) AI Processing & Model Providers

When you trigger AI-assisted features (for example, drafts for Gmail/Outlook or WhatsApp summaries), we send relevant snippets of content (and media where configured) to AI model providers such as OpenAI and Google (Gemini) to generate suggestions.

7) WhatsApp Data Lifecycle & Special Considerations

8) Sharing, Service Providers & Sub-processors

We share personal data with third parties only where necessary, on a need-to-know basis and subject to appropriate safeguards. In particular:

• Payment processor: Stripe (for payments, subscription management and invoices);
• Cloud infrastructure & database: hosting and database providers such as MongoDB Atlas and cloud platforms;
• Email & communication: transactional email providers for account, security and billing notifications;
• Analytics: EU-hosted analytics tools for product analytics and usage metrics, where enabled;
• AI providers: OpenAI, Google (Gemini) and similar vendors for model inference where configured;
• Support tools: tools used to handle support tickets and communications; and
• Professional advisors: legal, tax or security advisors under confidentiality obligations.

We maintain a current list of our main sub-processors in the Sub-processor Annex to our Terms.

We do not sell personal information and do not share it with third parties for cross-context behavioural advertising.

9) International Data Transfers

Because we work with global providers, personal data may be transferred to countries outside the EU/EEA, the UK and Switzerland, particularly to the United States.

For transfers to certain US providers that participate in the EU–US Data Privacy Framework (DPF), such as Stripe, PostHog and Google, we rely on the European Commission's adequacy decision under Art. 45 GDPR. The adequacy of the DPF was upheld by the EU General Court in 2025, which provides additional legal certainty for such transfers.

For other transfers (including to AI providers that are not DPF-certified), we use Standard Contractual Clauses (SCCs) and, where necessary, additional technical and organisational measures (such as encryption and data minimisation) to ensure an adequate level of protection.

You can contact us if you would like more information about the specific transfer mechanisms used for a given provider.

10) Retention

We keep personal data only for as long as necessary for the purposes described in this notice, for as long as we have a legitimate interest in the data, or as required by law. In particular:

• Account & profile data: for the duration of your account and up to the end of applicable statutory retention periods (e.g. up to 10 years for certain tax-relevant records under German law).
• Billing data: as required by tax and commercial law (usually 10 years under German law).
• Logs & security data: for as long as necessary for security, troubleshooting and documentation purposes (typically 12 months).
• Communication content (emails/WhatsApp): retained in line with your use of the Service and our role as processor. For WhatsApp specifically, see Section 7 for detailed retention periods.
• Support tickets: retained for 3 years or for as long as needed to handle your request, whichever is shorter.

When you request deletion of your account, we will delete or anonymise personal data associated with your account in accordance with our DPA and internal deletion routines, unless we are legally required or permitted to keep it longer. Deletion typically completes within 30 days of your request.

11) Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include, among others:

• encryption in transit (TLS 1.2+) and at rest for sensitive data (AES-256-GCM for OAuth tokens, API keys, and WhatsApp session data);
• role-based access control and least-privilege access to production systems;
• separation of environments and comprehensive access logging;
• secure development practices, dependency scanning and vulnerability management; and
• incident response processes and regular security reviews.

No system can be perfectly secure. If we become aware of a personal data breach affecting you, we will notify you without undue delay and provide information as required under applicable law.

12) Automated Decision-Making & AI Outputs

13) Your Rights under EU/UK Law

If the GDPR or UK GDPR applies to you, you have the following rights in relation to personal data we process as controller (subject to legal conditions and limitations):

• Access: to obtain confirmation whether we process personal data about you and to receive a copy.
• Rectification: to have inaccurate or incomplete personal data corrected.
• Erasure: to request deletion of personal data, for example where it is no longer needed or processed unlawfully.
• Restriction: to request that we limit processing in certain circumstances.
• Portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• Objection: to object to processing based on our legitimate interests, including profiling, for reasons relating to your particular situation; and to object at any time to processing for direct marketing.
• Withdrawal of consent: where processing is based on consent, you may withdraw that consent at any time with future effect.
• Not to be subject to automated decision-making: to not be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you.

To exercise your rights, please contact us at support@replyedge.com. We may need to verify your identity before responding. We aim to respond to all requests within 30 days.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our lead authority is the BayLDA in Bavaria, Germany.

14) US State Privacy Addendum

This section applies to you if you are a resident of certain US states with comprehensive consumer privacy laws, including for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Delaware, New Jersey, New Hampshire, Iowa, Indiana, Montana, Tennessee, Maryland, Minnesota, Nebraska and other states that may adopt similar laws in the future.

Depending on your state, you may have the following rights (subject to legal conditions and exemptions):

• Right to know/access: to request that we confirm whether we process personal information about you and to provide certain details.
• Right to portability: to receive a portable copy of certain personal information.
• Right to correction: to request correction of inaccurate personal information.
• Right to deletion: to request deletion of personal information we have collected from you, subject to exceptions.
• Right to opt out of certain processing: for example, to opt out of the sale of personal information or certain forms of profiling.

We do not sell your personal information and do not share it for cross-context behavioural advertising. If we ever materially change this, we will update this notice and provide required opt-out mechanisms.

You can submit a privacy request by emailing us at support@replyedge.com. Please specify that your request is a "US privacy request" and indicate your state of residence.

15) "Do Not Sell or Share My Personal Information" (CPRA)

Under the California Privacy Rights Act (CPRA), certain sharing of personal information for cross-context behavioural advertising is treated as a "sale" or "sharing".

We do not sell personal information in this sense and do not share personal information for cross-context behavioural advertising. If this changes in future, we will update this notice and provide a clear "Do Not Sell or Share My Personal Information" link.

If you still wish to submit an opt-out request, you can email us at support@replyedge.com.

16) Children

The Service is aimed exclusively at business users. We do not knowingly target or knowingly collect personal data from children under 16 (or any higher age required by local law for valid consent).

If you believe that a child has provided us with personal data in violation of this section, please contact us and we will take appropriate steps to delete such data.

17) Changes to This Notice

We may update this Privacy & Cookies Notice from time to time, for example to reflect changes in the Service, in our processing activities or in applicable law.

We will post the current version of this notice on this page and, where appropriate, provide additional notice. Material changes will be notified at least 30 days before they take effect. Your continued use of the Service after an update constitutes your acknowledgement of the updated notice.

Notification of Material Changes:

• Changes to AI provider data use commitments
• Changes to data retention periods
• Changes to sub-processor list (major additions)
• Changes to international data transfers