Privacy Policy

Your data at a glance

• What we store: your account details and the replies you keep in ReplyGuard, including the client email, subject and context you submitted and the generated replies.
• What goes to AI: the client email, any subject and extra context you add, and your tone and scope-concern settings. They are sent to OpenAI to generate the reply.
• Payments: handled by Stripe. We never see or store your card details.
• Trackers: no advertising trackers and no third-party analytics. ReplyGuard's analytics are first-party.
• Hosting: the website runs on Netlify. The API and database run on DigitalOcean in New York, United States.
• Deleting data: delete individual replies in the app. For account deletion or any other request, email contact@akrinum.com. Deleted data can remain in server backups until those backups expire.

For a plain-language walkthrough, see How ReplyGuard handles your client emails.

1. Controller and contact details

The controller responsible for processing your personal data in connection with ReplyGuard is:

• Akrinum OÜ
• Registration code: 16014688
• VAT ID: EE102717822
• Registered office: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia
• Email: contact@akrinum.com

We process personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and other applicable data protection laws.

2. Scope of this Policy

This Policy applies to personal data we collect when you visit the ReplyGuard website, create an account, use the application, receive our emails or otherwise interact with us in connection with ReplyGuard. It does not apply to third-party websites or services that may be linked from ReplyGuard.

3. Categories of personal data

We may process the following categories of personal data:

• Account data: your name, email address, a hash of your password (never the password itself), your language setting, and when you accepted our Terms and which version. If you sign in with Google, we also receive your Google account ID, name, email address, whether that email address is verified, and your profile picture link. Temporary verification codes and password-reset tokens are kept only while they are needed.
• Usage and technical data: actions within ReplyGuard (for example, sign-ins, replies generated and credit usage), and technical request data such as your IP address, the address requested, the time, browser/user-agent details and error information, which our servers and hosting providers process to deliver the Service and keep it secure.
• Payment data: the billing details you choose to save in ReplyGuard (billing email, company name, VAT number and address), and records of your credit-pack purchases (pack, amount, currency, status and Stripe references such as receipt links). Your card details and the information you enter at checkout are collected by Stripe and are not stored by us.
• Content data: the client email you submit, the optional subject and extra context you add, and your generation settings (default tone and scope concern) (inputs); and what ReplyGuard generates from them: a reply pack in five tones, next-step suggestions, scope signals with a short hint about the email, and details needed to show and manage the reply, such as its status and the credits used (outputs). Your inputs are saved together with the generated reply once a generation succeeds. If a generation fails, no submitted content is kept in that record. Please do not include sensitive personal data unless necessary.
• Communication data: messages you send us (for example via email or support channels), feedback and survey responses.
• Analytics and browser storage data: random identifiers our website stores in your browser's local storage (a visitor identifier and a session identifier), together with the pages you visit on our website, how you arrived (referring website, search engine or campaign parameters), which buttons you click, and key steps such as sign-up, login and reply generation, with timestamps. After you sign up or log in, this information may be linked to your account. Our analytics do not include your email content or generated replies, and do not store your IP address or browser details.

4. Purposes and legal bases

We process personal data for the following purposes and legal bases:

• Providing and operating the Service – to create and manage your account, authenticate you, generate reply packs, save your history and provide core functionality.
  Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Billing and accounting – to process payments, provide payment receipts, keep mandatory accounting records and handle related inquiries.
  Legal basis: performance of a contract and compliance with legal obligations (Article 6(1)(b) and 6(1)(c) GDPR).
• Service improvement and product development – to analyse how ReplyGuard is used, improve existing features, maintain performance and prevent abuse.
  Legal basis: our legitimate interests in improving and securing the Service (Article 6(1)(f) GDPR).
• Security, fraud prevention and misuse detection – to protect accounts, investigate suspicious activity and enforce our Terms & Conditions.
  Legal basis: legitimate interests and/or compliance with legal obligations (Article 6(1)(f) and 6(1)(c) GDPR).
• Customer support – to handle your requests, questions and complaints.
  Legal basis: performance of a contract and legitimate interests (Article 6(1)(b) and 6(1)(f) GDPR).
• Legal compliance – to comply with laws, regulations, court orders and requests from public authorities.
  Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR).

5. Service emails

We use your email address to send the emails needed to provide ReplyGuard, such as account verification codes, password reset links, welcome and security notices and other messages about your account or the Service. These emails are sent through Mailgun. ReplyGuard does not send marketing emails or newsletters.

6. Cookies and similar technologies

ReplyGuard uses the following browser storage:

• Authentication cookie – keeps you signed in for up to 30 days, or until you log out.
• Local storage – a random visitor identifier and a session identifier for our first-party analytics (see 'Analytics and browser storage data' in section 3).
• Session storage – temporary values for the current browser tab, such as where to take you after you sign in or the email address waiting for a verification code. They are removed once used or when the tab is closed.

Our analytics are first-party: this information is sent only to ReplyGuard's own servers. It does not include submitted client emails or generated replies, and we do not store your IP address or browser/user-agent details for analytics. We do not use third-party analytics or advertising trackers. You can clear or block cookies and local storage in your browser settings.

Fonts. Our website loads its typeface from Google Fonts. To do this, your browser connects directly to Google's font servers (fonts.googleapis.com and fonts.gstatic.com) and sends the information every web request includes: your IP address, the requested address and browser details such as the user agent and the page you are viewing. Google states that the Google Fonts API does not set or log cookies, and that it does not use information collected by Google Fonts to create profiles of users or for targeted advertising. We do not use Google Fonts to analyse how you use ReplyGuard.

You can control cookies through your browser. However, some features of ReplyGuard may not function properly if certain cookies are disabled.

7. Service providers and data sharing

We do not sell your personal data. We use the following service providers to run ReplyGuard:

• OpenAI (reply generation) – when you generate a reply: the client email, any subject and extra context, and your generation settings. ReplyGuard does not add your name, email address or account details.
• Stripe (payments) – what you enter on the Stripe Checkout page (such as card details, email address and, where needed to calculate tax, your address), and the purchase details we send (the credit pack and an internal account reference).
• Google (optional sign-in) – if you choose to sign in with Google, Google shares your Google account ID, name, email address, whether that email address is verified and your profile picture link with us. We use this only to create and sign in to your ReplyGuard account, and we do not sell it or use it for advertising.
• Google Fonts (font delivery) – the technical request data your browser sends when it loads our fonts (see section 6).
• Netlify (website hosting) – serves the ReplyGuard website, so it processes the requests your browser makes, including your IP address and browser details.
• DigitalOcean (API and database hosting, New York, United States) – runs the server that handles requests from the app and stores ReplyGuard's database and its automatic backups: your account, saved replies and the other data described in this Policy.
• Mailgun (transactional email) – your email address and the content of the service emails we send you, such as verification codes, password-reset links and welcome messages. Mailgun does not receive the client emails you submit for reply generation.

OpenAI, Netlify, DigitalOcean and Mailgun process this data on our behalf under their data processing terms. Stripe processes payment data on our behalf and, for some purposes such as fraud prevention and its own legal obligations, as an independent controller under its own privacy policy. When you sign in with Google or your browser loads Google Fonts, Google also processes data under its own terms and privacy policy.

We may also share personal data with:

• Professional advisers – lawyers, accountants and auditors where necessary.
• Public authorities – where required by law or to protect rights, users or third parties.
• Business transfers – in connection with a merger, acquisition, reorganisation or sale of assets, subject to safeguards.

8. International data transfers

Akrinum OÜ is based in Estonia, but not all ReplyGuard data stays in the European Economic Area (“EEA”). ReplyGuard's API and database are hosted by DigitalOcean in New York, United States, and our other service providers may also process data outside the EEA. These transfers rely on the safeguards in each provider's data processing terms:

• DigitalOcean, Netlify, Stripe and Mailgun – the EU–U.S. Data Privacy Framework (and its UK extension where relevant) and/or the European Commission's Standard Contractual Clauses, as set out in each provider's terms.
• OpenAI – the European Commission's Standard Contractual Clauses or an adequacy decision, under OpenAI's data processing addendum.
• Google – data processed for Google sign-in and Google Fonts is handled under Google's own terms and privacy policy.

You can contact us for more information about international transfers and the safeguards used.

9. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law.

• Account data: stored for the lifetime of your account, subject to legal retention obligations.
• Saved replies: a successful reply, including the client email, subject and context you submitted and the generated content, stays in your account until you delete it or your account is deleted. Its scope signals are deleted with it.
• Failed generations: when a generation fails, the submitted content and anything generated from it are removed from the record. The record keeps only its status, failure reason, time and credit details.
• Generations in progress: the client email, subject and context are written to your account only when a generation succeeds.
• Analytics data: kept without a fixed expiry so we can understand how ReplyGuard is used over time. If your account is deleted, analytics records are no longer linked to it, but the pseudonymous records (random identifiers and events) may remain.
• Billing and payment data: retained as required by accounting and tax laws. Payment records are kept even if your account is deleted, without a link to the account.
• Support and communication data: retained as needed to resolve requests and for a reasonable period for reference and dispute resolution.
• Logs and security data: application and infrastructure logs, which can include IP addresses and technical request details, may be retained for operational, security and troubleshooting purposes. How long they are kept depends on the applicable application, hosting and infrastructure configuration.
• Backups: the server and database that run ReplyGuard are backed up automatically by DigitalOcean. Data deleted from the live service, including deleted replies and accounts, does not disappear from existing backups immediately: it can remain in them until those backups are deleted under the backup schedule. Backups are kept for recovery and are not available through ReplyGuard.

Our service providers keep data under their own retention terms; for example, see section 10 for what OpenAI states about its API.

10. AI processing

To generate a reply, ReplyGuard sends the client email you submit and, when you provide them, the subject and extra context, together with your generation settings (default tone and scope concern), to the OpenAI API. ReplyGuard does not add your name, email address or account details to that request.

ReplyGuard itself does not train or fine-tune AI models on your content.

ReplyGuard uses OpenAI's standard API. OpenAI states that data sent to its API is not used to train or improve its models unless the API customer explicitly opts in, and that by default it keeps API data in abuse-monitoring logs for up to 30 days, unless a longer period is required by law. ReplyGuard has not enabled OpenAI's optional setting for sharing API data with OpenAI.

11. Your rights under GDPR

If you are in the EEA, the UK, or another jurisdiction with similar rights, you may have rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

In ReplyGuard you can currently:

• delete individual replies in My replies;
• correct your name and language in Settings;
• edit your saved billing details in Billing.

Account deletion, data export and changing your account email address are not currently available in the product. To request any of these, or to exercise any other right, contact us at contact@akrinum.com.

When we delete an account at your request, we delete the account together with the replies and scope signals stored in it. We keep records we must keep by law, such as payment and accounting records, without a link to the deleted account, and pseudonymous analytics records may remain as described in section 9. Deleted data can also remain in infrastructure backups until those backups are deleted under their schedule (see section 9).

We may need to verify your identity before responding.

12. Complaints and supervisory authority

If you believe we process personal data in violation of applicable law, you may lodge a complaint with your local supervisory authority. In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

13. Security

We take appropriate technical and organisational measures to protect personal data. However, no online service can be completely secure, and we cannot guarantee absolute security.

14. Children

ReplyGuard is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can take appropriate steps.

15. Automated decision-making

ReplyGuard uses AI systems to generate reply suggestions based on your inputs. We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you as defined in Article 22 GDPR.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and may provide additional notice.

Your continued use of ReplyGuard after changes become effective constitutes acknowledgment of the updated Policy.

17. Contact

If you have questions about this Privacy Policy or our data practices, contact:

Email: contact@akrinum.com