Terms of Service

1. Subject matter and scope

1.1 Replefy processes personal data on behalf of the Customer only to provide the service described in the Terms: importing the Customer's Google reviews, drafting replies and posts with AI, and — where the Customer connects its Google Business Profile — publishing replies as the Customer has instructed (approved one by one, or automatically within the limits the Customer has set).

1.2 Details on the categories of data and data subjects are set out in Schedule 1.

1.3 This DPA does not cover data for which Replefy is itself the controller (the Customer's own account data, billing, the public Visibility Report). That is described in our Privacy Policy.

2. Instructions

2.1 Replefy processes the data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and settings of the service (for example choosing which review to answer, editing or approving a draft, or switching on automatic replies) constitute these instructions.

2.2 Replefy will inform the Customer without undue delay if it believes an instruction infringes data protection law.

2.3 Replefy processes data outside these instructions only where required by EU or Member State law, and informs the Customer beforehand unless the law prohibits it.

3. Confidentiality

Replefy is currently operated by one person, who is bound to confidentiality. Anyone Replefy authorises to process the data in future will be bound to confidentiality before getting access.

4. Security

Replefy implements the technical and organisational measures in Schedule 2 and keeps them up to date. Replefy may replace a measure with an equivalent or better one; the overall level of protection must not decrease.

5. Sub-processors

5.1 The Customer gives general authorisation for Replefy to use sub-processors. The sub-processors currently in use are listed in Schedule 3.

5.2 Replefy informs the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may terminate the service; Replefy does not charge for the remaining period.

5.3 Replefy imposes data protection obligations on each sub-processor that are at least as protective as this DPA, and remains responsible to the Customer for them.

5.4 Transfers to countries outside the EU/EEA take place only under Art. 44 et seq. GDPR — an adequacy decision (e.g. the United Kingdom; the EU–U.S. Data Privacy Framework for certified providers) or the EU Standard Contractual Clauses.

6. Assistance

6.1 Taking into account the nature of the processing, Replefy assists the Customer in responding to requests from data subjects (for example a reviewer asking for access or erasure). If a data subject contacts Replefy directly about the Customer's data, Replefy forwards the request to the Customer without undue delay and does not answer it on its own, unless the Customer asks it to.

6.2 Replefy assists the Customer with its obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation), as far as the information available to Replefy allows.

7. Personal data breaches

Replefy notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, by email to the account address, with the information available at the time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed), and updates it as more becomes known.

8. Deletion and return

8.1 The Customer can request an export of its data at support@replefy.com and delete its account at any time (Settings → Account → Delete account). Deleting the account removes all of the Customer's data from the production database immediately.

8.2 Copies in Replefy's encrypted backups are deleted automatically within 7 days; records of automated processing runs within 14 days (see Schedule 2).

8.3 After the end of the service Replefy deletes all remaining personal data processed on behalf of the Customer within the same periods, unless EU or Member State law requires storage.

9. Information and audits

9.1 Replefy makes available all information necessary to demonstrate compliance with Art. 28 GDPR, primarily in writing (this DPA, its Schedules, answers to the Customer's questions).

9.2 Where that is not sufficient, the Customer may carry out an audit or have it carried out by an independent auditor bound to confidentiality, with at least 30 days' notice, during business hours, without disproportionate disruption, and at the Customer's own cost. Supervisory authorities' rights remain unaffected.

10. Term, liability, law

10.1 This DPA runs for as long as Replefy processes personal data on behalf of the Customer.

10.2 Liability is governed by the Terms of Service. This does not limit liability towards data subjects under Art. 82 GDPR.

10.3 This DPA is governed by Spanish law; the jurisdiction clause of the Terms applies.

Schedule 1 — Details of the processing

• Nature and purpose

  Importing Google reviews of the Customer's business; showing them in the app; generating reply and post drafts with AI; publishing replies on Google (only with a connected Google Business Profile: replies the Customer approved or, where the Customer switched on automatic replies, replies within the limits the Customer set); counting scans of review cards.

• Data subjects

  Persons who reviewed the Customer's business on Google; persons named in those reviews (e.g. staff); persons named in the Customer's own example replies, rules or post texts.

• Categories of data

  Reviewer display name, star rating, review text and date, the Customer's existing replies on Google, AI drafts and published replies, example replies and rules (AI Voice), post texts; for review cards: scan time and device type only (no IP address, no identity).

• Special categories (Art. 9 GDPR)

  Not intended. Review texts are written by third parties and could incidentally contain such data; Replefy does not analyse or use them for that.

• Duration

  For the term of the service; deletion as in section 8.

• Location

  Database: Supabase, London (UK). Automation and backups: Hetzner, Germany. AI drafting: see Schedule 3.

Schedule 2 — Technical and organisational measures (Art. 32 GDPR)

Encryption

• All connections to the app, the API and between our systems use TLS (HTTPS).
• The database is encrypted at rest by our database provider.
• Google OAuth refresh tokens are additionally encrypted with a separate key before they are stored.
• Backups are encrypted (AES-256) before they are written to disk; the key is held only by the operator.

Access control and separation

• Each Customer's data is separated in the database by row-level security: an account can only read and write its own business's data.
• Administrative access to the database, servers and provider accounts is limited to the operator.
• Calls between our server functions and the automation server are authenticated with a shared secret.
• Server access (SSH) is possible only with cryptographic keys; the administrator account has no usable password.

Availability and resilience

• Nightly encrypted database backup to a server in Germany, kept for 7 days, verified after each run; failures trigger an email alert.
• Uptime monitoring of the website and of the automation webhooks every 5 minutes with email alerts.

Data minimisation and deletion

• Account deletion removes all Customer data immediately; backups expire after 7 days.
• Records of automated processing runs are deleted after 14 days.
• No web server access logs are kept; error logs contain no IP addresses.
• AI providers are used via their APIs, whose terms do not allow training on the data.

Organisation

• Changes to the system are tracked in version control; database changes are versioned as migrations.
• Data protection incidents are handled as in section 7 of this DPA.

Schedule 3 — Sub-processors

• Supabase (Supabase Pte. Ltd., Singapore; Supabase, Inc., USA)

  Database, authentication, file storage, server functions

  Data stored in London, UK — adequacy decision; operations and support access from the USA and Singapore — SCC

• Hetzner Online GmbH

  Server for website, automation workflows, backups

  Germany (EU)

• OpenAI Ireland Ltd. (with OpenAI OpCo, LLC, USA)

  Drafting replies and posts

  Ireland (EU); onward transfers to the USA — SCC

• Anthropic Ireland, Limited (with Anthropic, PBC, USA)

  Drafting replies and posts (alternative provider)

  Ireland (EU); onward transfers to the USA — SCC

• Google (Google Ireland Ltd. / Google LLC)

  Places API, Business Profile API (reading reviews, publishing replies)

  EU / USA — Data Privacy Framework / SCC

• Resend (Plus Five Five, Inc.)

  Sending service emails

  Sending region Ireland (EU); company in the USA — Data Privacy Framework / SCC