Public notice

Privacy Policy

This policy explains when Replofy acts as a controller, when it acts as a processor on behalf of customers, what data enters the platform, how long it is kept, and how to contact us about privacy questions.

Applies to

Website visitors, prospective customers, workspace administrators, and customers using Replofy as a processor for support data.

Document summary

How Replofy handles website data, account data, and customer support data processed through the platform.

Controller for website and account data

Processor for customer support content handled on behalf of customers

Retention matrix aligned with platform and contract lifecycle

Section 01

1. Scope and roles

Replofy AI Inc. ("Replofy", "we", "our", or "us") provides AI-powered customer support software at replofy.co and app.replofy.co. This Privacy Policy applies to the Replofy marketing site, documentation site, product sign-up flows, support interactions with Replofy, and the hosted Replofy service.

Replofy acts as a controller for data about website visitors, leads, workspace administrators, billing contacts, and people who contact Replofy directly. Replofy acts as a processor for customer support messages, knowledge-base content, ticket history, and related data that a customer submits into the service for its own business purposes.

When Replofy acts as a processor for customer workspace content, this Privacy Policy is not the customer's own Article 13 or Article 14 notice to its end users, contacts, or employees. Customers remain responsible for their own controller-side privacy notices, lawful bases, and workflow disclosures for the personal data they place into Replofy.

Contact

Privacy questions, access requests, deletion requests, and notices about this policy can be sent to support@replofy.co.

Section 02

2. Data we collect

The categories below reflect the current Replofy product and website. The exact fields processed in a workspace depend on the customer's channels, integrations, workflow configuration, and knowledge sources.

Category	Examples	Primary purpose	Legal basis	Retention
Website and marketing data	IP address, browser metadata, pages viewed, referral data, form submissions, demo requests	Operate the website, respond to requests, measure demand, and improve site performance	Legitimate interests in operating, securing, and improving the website, plus consent for optional marketing or analytics where required	Up to 12 months unless a longer period is needed to resolve an inquiry
Workspace account data	Name, work email, passwordless or auth identifiers, organization, role, billing contact details	Create and secure accounts, administer subscriptions, and provide support	Performance of a contract for account administration and support, plus legitimate interests in securing the service and preventing abuse	For the subscription term and up to 12 months after closure, except billing records kept longer by law
Customer support content	Tickets, messages, attachments, internal notes, AI drafts, customer contact details, channel identifiers	Provide the support platform and AI-assisted or automated workflows requested by the customer	Processed on behalf of the customer under the customer contract and DPA	For the subscription term, then handled under the applicable return-or-deletion workflow. The current target is up to 30 days for primary-system return or deletion and up to 90 additional days for managed backup expiry
Knowledge content and retrieval data	Uploaded files, URLs, help center articles, workflow documents, indexed chunks, embeddings, search metadata	Power knowledge retrieval, AI responses, and customer-configured automation	Processed on behalf of the customer under the customer contract and DPA	For the subscription term, then handled under the applicable return-or-deletion workflow. The current target is up to 30 days for primary-system return or deletion and up to 90 additional days for managed backup expiry
Integrations and secrets	OAuth tokens, account aliases, mailbox metadata, routing configuration, connected channel identifiers	Enable customer-selected integrations and maintain, secure, or troubleshoot those connections	Performance of a contract for requested integrations, plus legitimate interests in securing and monitoring those connections	While connected, then scheduled for deletion or revocation after disconnect. The current target is within 30 days unless longer retention is required for security, audit, or legal reasons
Billing and compliance records	Invoices, plan details, payment metadata, tax records, service credit claims, contract history	Administer subscriptions, document commercial terms, and comply with legal obligations	Contractual necessity and legal obligation	Up to 7 years or longer where required by law
Security and audit data	Access logs, workflow execution logs, queue and error logs, audit trails for administrative actions	Protect the platform, investigate incidents, and demonstrate compliance	Legitimate interests and legal obligation where applicable	Typically 12 months, and longer when necessary for an active investigation, dispute, or legal hold

Section 03

3. How we use data

Replofy uses data to:

provide a multi-tenant helpdesk, knowledge base, workflow engine, widget system, and channel integrations;
retrieve customer-approved knowledge content and generate AI drafts or autonomous responses according to customer settings;
authenticate users, enforce role-based access, and route access through tenant-scoped RPC and MCP boundaries;
synchronize customer-enabled email and other supported third-party integrations;
monitor performance, prevent abuse, troubleshoot incidents, and maintain audit trails for key actions; and
communicate with prospects and customers about service changes, support requests, contracts, invoices, and security events.

Controller and processor distinction

Customers decide what end-user data they upload into Replofy and what workflows they enable. Customers remain responsible for ensuring they have an appropriate lawful basis for that data. Replofy only processes that customer content under documented customer instructions and the DPA.

AI and workflow responsibility

Replofy provides AI-assisted drafting and workflow tooling for customer-configured use cases. Customers remain responsible for deciding whether autonomous features are enabled, what approvals are required, and whether any human review, notice, or additional controls are required under applicable law for their workflows.

Section 04

4. Sharing, subprocessors, and integrations

Replofy does not sell customer support data. We share data only as needed to operate the service, comply with law, enforce our contracts, or support customer-selected integrations.

Recipient type	Examples	Why data is shared
Managed infrastructure	Supabase and Google Cloud services used for database, authentication, storage, Edge Functions, Cloud Run APIs, and tenant-scoped runtime services	Host and secure the platform, process requests, and persist customer workspace data
AI and retrieval services	Google-hosted AI and retrieval services used to process customer prompts and retrieve approved knowledge context	Generate drafts, automate responses, and execute customer-configured AI workflows
Customer-enabled integrations	Google APIs for Gmail, widget endpoints, or other customer-selected third-party services supported by the product or a customer-specific agreement	Synchronize messages and events between Replofy and the channels the customer chooses to connect
URL ingestion and content extraction	Scraping or crawling services used when a customer submits website URLs for knowledge ingestion	Fetch public customer-provided content so it can be indexed into the knowledge base
Professional advisers and authorities	Lawyers, auditors, regulators, courts, and law enforcement when legally required	Comply with law, protect rights, and manage disputes or investigations

A current operational summary of core subprocessors appears in the Data Processing Agreement and the Security Summary. Customers and individuals may request the latest subprocessor or transfer-safeguards summary at support@replofy.co.

Section 05

5. International transfers, retention, and security

Replofy may process data in the United States and in other locations where Replofy or its service providers operate. Where required, Replofy relies on recognized transfer mechanisms such as adequacy decisions and standard contractual clauses, together with supplementary contractual or technical measures where appropriate. A summary of the relevant safeguards can be requested at support@replofy.co.

Replofy is built around a schema-per-tenant data model and tenant-scoped RPC and MCP boundaries. Current platform controls include role-based access restrictions, authenticated workspace membership checks, audit logging, prompt hardening, token protection for connected integrations, and managed infrastructure controls operated by our hosting providers.

Replofy uses encrypted web connections for customer access and integration authentication. Certain stored integration secrets and OAuth tokens rely on provider-managed storage protections and restricted service access controls. Replofy relies on managed cloud infrastructure providers for platform durability, backup, and recovery operations.

Retention baseline

Unless a longer period is required by law or an active dispute, customer content is kept for the active subscription term, then scheduled for return or deletion under the applicable contract workflow. The current operational target is up to 30 days for primary-system return or deletion, with managed backups typically expiring within up to 90 additional days depending on provider retention cycles.

Section 06

6. Your rights and choices

Depending on applicable law, you may have rights to access, amend, delete, restrict, object to, or port certain personal data. When Replofy is acting as a processor for customer workspace content, we will direct the request to the relevant customer unless we are legally required to respond directly.

Workspace administrators can disconnect integrations, export or remove knowledge content, delete tickets subject to workspace permissions, and close an account through the product or by contacting support. Marketing emails can be opted out through the message itself or by contacting support.

Where Replofy relies on consent, consent can be withdrawn using the relevant product control, the message-level unsubscribe mechanism, or by contacting support. You may also have the right to lodge a complaint with the supervisory authority where you live, work, or where the relevant processing took place.

Certain account, billing, and service-administration details are required to create, secure, or maintain a workspace subscription. If that data is not provided, Replofy may be unable to create the account, provide billing support, or continue the affected service.

Section 07

7. Changes to this policy

Replofy may update this Privacy Policy as the product, law, or our processing activities change. Material changes will be posted on this page with an updated revision date and, where appropriate, communicated through the product or by email.

Last updated: April 18, 2026.

Legal questions