Privacy & Security – ReplyBox

Security

Data protection & security

• TLS 1.2+ in transit; AES-256 at rest.
• Role-based access, MFA, and least-privilege policies across all environments.
• Annual penetration tests and continuous vulnerability scanning.

International transfers & compliance

• Sub-processor & Transfer-Impact Assessments reviewed at least annually (list published in our Trust Center).

Your rights & controls

• Self-service portal plus email (replyboxai@gmail.com) for access, correction, deletion, restriction.
• Typical response time: <72 hours.

Data retention & deletion

• Default retention: 24h or less for message/voice payloads; logs 90 days.
• Zero-day retention available on enterprise plans.
• Deleted accounts = data purged or irreversibly anonymised within 30 days (billing data retained only for legal compliance).

Incident response & breach notification

• Documented IRP with 24×7 on-call engineer.
• Post-incident root-cause analysis shared with affected customers.
• GDPR-aligned breach notification within 72 hours when required.

Privacy Policy

Table of Contents

1. Introduction
2. Acceptance of This Policy
3. Scope of Services Covered
4. What We Collect & Why
5. Security Measures
6. Use & Transfer of Google and Microsoft Data
7. Sharing Information with Third Parties
8. International Data Transfers
9. Your Privacy Rights
10. Data Storage & Retention
11. Children’s Data
12. Cookies & Similar Technologies
13. Changes to This Policy
14. Questions, Concerns, or Complaints

1. Introduction

ReplyBox (“we”, “our”, “us”) is a productivity tool that helps you manage email communications more efficiently. Protecting your information is central to how we build every feature.

2. Acceptance of This Policy

By installing the extension or using our services, you consent to the practices described here.

3. Scope of Services Covered

• ReplyBox Chrome Extension for Gmail and Outlook Web
• replybox.app website
• Any optional beta features (e.g., desktop companion app)

4. What We Collect & Why

4.1 Use of the ReplyBox Website

We use first-party cookies and GA4 analytics to improve our website experience. This data is never combined with extension data.

4.2 Use of the Chrome Extension

When you click “Reply with ReplyBox” or use our AI features, we process the necessary email content to provide our services. All data is deleted within 24h (shorter on enterprise plans).

4.3 Voice-to-Text

Audio is streamed via HTTPS for transcription purposes. Raw audio is not retained after processing.

5. Security Measures

• Encryption in transit & at rest (TLS 1.2+ / AES-256)
• Principle of least privilege
• OAuth 2.0 (we never store mailbox passwords)
• Annual penetration tests, vulnerability scans
• Bug-bounty programme

6. Use & Transfer of Google and Microsoft Data

Complies with Google API Services User Data Policy (Limited Use) and Microsoft’s equivalent policies. No advertising, no human access unless support is specifically requested.

7. Sharing Information with Third Parties

8. International Data Transfers

Primary servers are located in Google Cloud (Iowa, USA). GDPR transfers use Standard Contractual Clauses plus encryption.

9. Your Privacy Rights

10. Data Storage & Retention

• Email & AI prompts: 24h default, purge on request
• Access tokens: until revoked
• Billing records: 3 years
• Crash & usage logs: 90 days
• Custom schedules available via DPA

11. Children’s Data

Our services are not intended for users under 16. Contact us for deletion if such data has been collected.

12. Cookies & Similar Technologies

We use a single first-party cookie for login persistence. See our separate Cookie Notice for detailed information.

13. Changes to This Policy

Policy revisions are announced in-extension and on our website 14 days before taking effect.