Privacy Policy

1. Introduction

Reploom is operated by Reploom, Inc., a Delaware corporation ("Reploom", "we", "us", or "our"). At Reploom, we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you visit this website (reploom.com) or use our AI-powered Sales QA and productivity service.

For personal data collected through this website and through your Reploom account, Reploom, Inc. is the data controller. For the message and social media data our customers connect from their own accounts (for example, the WhatsApp messages a business receives from its customers), the business customer is the data controller and Reploom processes that data on the customer's behalf as a processor or service provider, as described in Section 6. You can reach us about anything in this policy at aslan@reploom.com.

2. Information We Collect

We collect information to provide and improve our services. The types of information we collect include:

• Account Information: Email address, name, and profile information when you create an account
• Social Media Data: Profile information, comments, direct messages, and engagement data through connected social media APIs, including Instagram and Facebook where available
• WhatsApp Message Data: When you connect WhatsApp through the WhatsApp Business Platform (Cloud API), we receive and store the content of private messages people send to your business number, including text, images, documents, voice notes, location, and other media, together with the sender's WhatsApp phone number, WhatsApp profile name, and message timestamps. Unlike public comments, these are private communications and we treat them with stricter access controls and minimization.
• Usage Data: How you interact with our service, features used, and performance metrics
• Device Information: IP address, browser type, device type, and operating system
• Communication Data: Messages you send us through support channels or feedback forms

3. Data We Collect on This Website

If you only visit reploom.com without a Reploom account, the data we handle is limited to the following:

• Contact and demo request forms: When you submit our contact form or book a demo, we receive the details you enter (name, email address, and optionally your position, a subject line, and a message). We use them solely to respond to your request. They are delivered to our inbox by email and are not added to any marketing list.
• Newsletter: When you subscribe with your email address, we store it with our email service provider together with a record of your consent, and use it to send you product updates. Every email includes an unsubscribe link, and you can withdraw your consent at any time.
• Interactive homepage demo: The homepage lets you type a reply inside an example conversation. The text you type, together with the scripted conversation around it, is sent to Google's Gemini API to generate the demo response. We do not store your demo messages on our servers after the response is returned and we make no attempt to identify you from them. Please do not enter real personal data into the demo.
• Hosting and server logs: The website is hosted on Vercel. Like any web server, our infrastructure processes your IP address and standard request metadata to deliver pages, prevent abuse, and rate-limit the interactive demo. This data is kept only as long as needed for those purposes.
• Analytics: We measure page views and site performance with a cookieless, privacy-first analytics service that does not track you across sites. See Section 14 for details.

4. How We Use Your Information

We use your information for the following purposes:

• Provide AI-powered Sales QA and productivity services for your connected social media and messaging accounts, including conversation review and drafting replies to private WhatsApp messages
• Generate lead intent classification, priority detection, Sales QA summaries, and smart reply suggestions
• Improve our service quality and user experience
• Communicate with you about your account and service updates
• Provide customer support and respond to your inquiries
• Analyze usage patterns to enhance user experience
• Comply with legal obligations and protect against fraud

Important: We do not use your data to train any AI models. Our AI features are powered exclusively by Google's Gemini API, and your data is never used to train generalized AI models.

5. Legal Bases for Processing (GDPR)

Where the EU or UK General Data Protection Regulation applies, we process your personal data only when we have a legal basis to do so:

• Performance of a contract (Art. 6(1)(b)): Providing the Reploom service to you, operating your account, and responding to demo and support requests you make before or during a contract.
• Consent (Art. 6(1)(a)): Sending you our newsletter and processing the text you choose to type into the interactive homepage demo. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legitimate interests (Art. 6(1)(f)): Securing our website and service, preventing fraud and abuse (including rate limiting), measuring site usage with cookieless aggregate analytics, and improving our product. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): Retaining or disclosing data where the law requires it.

Where Reploom processes connected message data as a processor on behalf of a business customer, the customer is responsible for its own legal basis toward the people it communicates with.

6. Social Media Platform Data and APIs

Our service integrates with Instagram, Facebook, and WhatsApp through their official APIs. WhatsApp is accessed through the WhatsApp Business Platform (Cloud API), which is provided and hosted by Meta. Important points about these integrations:

• We connect to your Instagram, Facebook, and WhatsApp accounts securely via their official login systems
• We only access data necessary to provide our Sales QA and AI-assisted services
• We do not store your social media passwords or login credentials
• We comply with Instagram's, Facebook's, and WhatsApp's Platform Policies and Data Use Policies; your use of WhatsApp through Reploom is also subject to the WhatsApp Business Terms of Service and the WhatsApp Business Messaging Policy (WhatsApp is a Meta company and the Cloud API is operated by Meta)
• You can revoke our access to your social media and WhatsApp accounts at any time
• Data accessed through these APIs is subject to Instagram's, Facebook's, and WhatsApp's own privacy policies
• Private WhatsApp messages: For WhatsApp we access the content of private one-to-one and group messages, which is more sensitive than public comments. WhatsApp protects messages in transit using encryption, but once a message is delivered to the WhatsApp Business Platform it is no longer end-to-end encrypted, and Reploom is responsible for securing it. We encrypt this data in transit and at rest and restrict access to authorized personnel and systems
• Your consent responsibility: You are responsible for obtaining valid opt-in consent from individuals before messaging them on WhatsApp, as required by the WhatsApp Business Messaging Policy. For WhatsApp message data you act as the data controller and Reploom processes it on your behalf and at your instruction as a processor/service provider
• Conversation isolation: We keep each individual's WhatsApp conversation isolated and do not share the content of one person's chat with another contact or customer, consistent with the WhatsApp Business Messaging Policy. Where automated handling is used, Reploom supports prompt escalation to a human agent

7. AI Features and Google Gemini API

Our AI-powered features, such as conversation review, summaries, and smart reply suggestions, are powered exclusively by Google's Gemini API. Important information about our AI integration:

• No third-party AI services: We use only Google's Gemini API for AI functionality: no third-party AI services are used
• No AI model training: Your data is never used to train any AI models, neither by Reploom nor by Google (per Gemini API terms)
• Data stays within Google's ecosystem: Data processed through Gemini API remains within Google's infrastructure with their data protection guarantees
• User-facing features only: AI is used solely to provide productivity-enhancing features visible to you, such as Sales QA summaries, lead classification, reply suggestions, and routing for your own comments and your private WhatsApp messages. We do not use the content of your customers' private WhatsApp messages to train any AI models
• Compliant with Google's Limited Use policy: Our use of Google API data complies with Google API Services User Data Policy, including Limited Use requirements
• The website demo uses the same setup: The interactive demo on our homepage sends the text you type to the same Gemini API to generate its responses, as described in Section 3

8. Regulated Health Data

The Reploom Service is not designed or offered as a HIPAA-eligible service, and Reploom does not enter into Business Associate Agreements ("BAAs") for the Service. Customers must not use the Service to create, receive, maintain, transmit, or otherwise process protected health information ("PHI") subject to HIPAA, or other personal or consumer health information subject to heightened privacy or security requirements under applicable law (collectively, "Regulated Health Data").

We do not proactively inspect every conversation specifically for compliance with this restriction. Because Reploom automatically processes content from accounts that customers choose to connect, prohibited data may be received if a customer violates our Terms and Conditions. If we reasonably suspect or become aware that Regulated Health Data has been submitted, we will take steps required by applicable law, which may include suspending further collection and AI processing, restricting access, and working with the customer to securely return or delete the affected data. We may preserve non-content or deidentified audit records of our response and may retain affected data only as permitted or required by applicable law.

Contact details alone are not automatically PHI in every context. However, identity or contact data linked to health status, treatment, payment, a patient-provider relationship, or seeking health services may be PHI or other Regulated Health Data.

9. Data Sharing and Service Providers

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your consent: When you explicitly agree to share information
• Service providers: Third-party services that help us operate our platform (hosting, analytics, etc.)
• Legal requirements: When required by law, court order, or government request
• Business transfers: In case of merger, acquisition, or sale of assets
• Safety and security: To protect the rights, property, or safety of Reploom, our users, or others

The service providers that process personal data on our behalf, under data processing agreements that restrict what they may do with it, are:

• Vercel Inc. (United States): website hosting, content delivery, and cookieless site analytics
• Google LLC / Google Cloud (United States): Gemini API processing for the AI features described in Section 7 and the homepage demo
• Klaviyo, Inc. (United States): newsletter subscriptions and email delivery, including the record of your subscription consent
• Our transactional email provider: delivery of form submissions and service emails to our inbox
• Meta Platforms, Inc. (United States): operates the Instagram, Facebook, and WhatsApp Business Platform APIs that customers connect to the product, as described in Section 6

10. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Secure servers and infrastructure
• Employee training on data protection practices

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

11. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this policy:

• Account information is retained while your account is active
• Social media data (public profile, comment, and engagement data) is processed in real-time and stored temporarily for service delivery
• Private WhatsApp message content and attachments are retained only for as long as your account is active and needed to provide conversation review, Sales QA, inbox, and conversation history features, after which we delete or anonymize them. You may request deletion of specific conversations or all WhatsApp data, and we delete WhatsApp data upon termination except where retention is required by law. This content is used only to generate replies, summaries, routing, and Sales QA insights for your account and is never used for training or sold
• Contact and demo form submissions are kept in our inbox for as long as needed to handle your request and for a reasonable follow-up period
• Newsletter email addresses are kept until you unsubscribe or ask us to delete them
• Text typed into the homepage demo is not stored on our servers after the response is generated
• Usage data may be retained for analytics and service improvement
• Communication records are kept for customer support purposes
• We may retain certain information for legal compliance or legitimate business purposes
• We handle content identified as prohibited Regulated Health Data as described in Section 8

12. Your Rights and Choices

You have the following rights regarding your personal information. If you are in the European Economic Area, the United Kingdom, or Switzerland, these rights are guaranteed by the GDPR and its UK and Swiss equivalents:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal limitations)
• Restriction: Request that we limit how we process your information while a dispute or verification is resolved
• Portability: Request transfer of your data to another service provider
• Objection: Object to processing of your information for certain purposes, including processing based on legitimate interests
• Withdrawal: Withdraw consent for data processing where applicable, at any time
• Disconnect: Disconnect your Instagram, Facebook, and WhatsApp accounts from our service at any time

To exercise any of these rights, email us at aslan@reploom.com. We respond within one month, we do not charge a fee, and we may ask you to verify your identity so we do not act on someone else's request. If we hold data about you as a processor for one of our business customers, we will refer your request to that customer and assist them in fulfilling it.

If you believe we have not resolved your concern, you have the right to lodge a complaint with your local data protection supervisory authority in the EEA, with the Information Commissioner's Office in the UK, or with the Federal Data Protection and Information Commissioner in Switzerland.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you additional rights:

• Right to know: What categories of personal information we collect, the purposes, and who we share it with. The categories we collect are identifiers (name, email, IP address), professional information (position, company), internet activity (usage of our website and service), and the content of communications you send us, as described in Sections 2 and 3
• Right to delete and right to correct: Request deletion or correction of your personal information, subject to legal exceptions
• Right to non-discrimination: We will never treat you differently for exercising your privacy rights
• Right to opt out of sale or sharing: We do not sell your personal information and we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. Because there is no sale or sharing, there is nothing to opt out of, and browser opt-out signals such as Global Privacy Control require no further action from us

You can exercise these rights, yourself or through an authorized agent, by emailing aslan@reploom.com.

14. Cookies and Tracking

This website is built to work without tracking. We do not use advertising cookies, cross-site tracking, or fingerprinting, and we do not show a cookie consent banner because there is nothing non-essential to consent to:

• No marketing or advertising cookies: The website sets no cookies for marketing, retargeting, or profiling
• Cookieless analytics: We use Vercel Web Analytics and Speed Insights, which do not use cookies or persistent device identifiers. Page views are aggregated using a short-lived anonymized hash that cannot follow you to other websites and is not linked to your identity
• Strictly necessary storage only: The Reploom application (for signed-in customers) uses cookies that are strictly necessary to keep you securely signed in and to protect your session. These do not require consent under the ePrivacy rules

If we ever introduce non-essential cookies or trackers, we will ask for your consent first and update this policy before doing so.

15. Children's Privacy

Our service is directed at businesses and is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information.

16. International Data Transfers

We are a US company and your information is primarily processed in the United States, where our service providers listed in Section 9 operate. When we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we protect it with recognized safeguards: where a provider is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) we rely on that certification, and otherwise we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with additional technical and organizational measures. You can request a copy of the relevant safeguards by contacting us.

17. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Providing notice through our service

Your continued use of our service after any changes indicates your acceptance of the updated policy.

18. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us through:

• Our support channels available on the website
• The feedback form on our platform
• Email: aslan@reploom.com

We will respond to your inquiries promptly and work to address any concerns you may have.