Legal information
Privacy policy and GDPR
Last updated: 22 October 2026
In short
Data is stored in the European Union. We don't sell it and don't use it for advertising. This website has no trackers and no analytics cookies.
Two different roles
For our customers' data (accounts, billing, use of the application), Apophisia is the data controller.
For the data our customers import into Replexa (leads, prospects, emails exchanged), the customer is the data controller and Apophisia acts as a processor: we process that data only on the customer's instructions, to provide the service. If you are a prospect contacted through Replexa, please contact the company that wrote to you first; we will help them respond to your request.
Data controller
Apophisia, [address]. Contact for any question about your data: [dedicated email, e.g. privacy@replexa.eu].
Data processed and purposes
| Data | Why | Legal basis |
|---|---|---|
| Email, name, password (hashed), two-factor authentication factor | Create and secure your account | Performance of the contract |
| Workspace, members, roles, login logs | Run the service, security | Performance of the contract, legitimate interest |
| Billing data (via Stripe) | Collect subscription payments, accounting | Performance of the contract, legal obligation |
| Connected mailboxes and their credentials (encrypted) | Send and receive your campaign emails | Performance of the contract |
| Leads, emails sent and received, statuses | Provide the service on the customer's behalf (processing) | The customer's own legal basis |
| AI usage (volume, not content) | Count AI credits | Performance of the contract |
Service providers (processors)
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication | Ireland (AWS eu-west-1) |
| Cloudflare, Inc. | Hosting of the website and the application, network protection | Global network, US company [to check: data localisation options] |
| Anthropic, PBC | AI model (Claude) used to classify replies and draft messages | United States [to check: processing region and transfer safeguards] |
| Stripe | Payments and billing | European Union and United States |
| Resend | Workspace invitation emails (if enabled) | [to check] |
Services you connect yourself (Google Calendar, HubSpot, Pipedrive, Salesforce, Airtable, Zapier, Make, n8n…) receive the data needed for the integration you enabled, under their own terms.
For transfers outside the European Union, we rely on the EU-US Data Privacy Framework when the provider is certified under it, and otherwise on the European Commission's standard contractual clauses [to be confirmed provider by provider].
Artificial intelligence
To classify a reply or draft a response, the relevant text is sent to Anthropic's API. Under its commercial terms, Anthropic does not train its models on data received through its API [to check against the current terms]. Incoming email content is treated as data, never as instructions to the agent.
Security
- Mailbox passwords, integration keys and tokens are encrypted at rest and never returned by the API.
- Two-factor authentication available on every account, and enforceable across a whole workspace.
- Strict data separation between workspaces, with roles and permissions per member.
- Encrypted HTTPS connections between your browser and the application.
Retention periods
- Account and workspace: for the duration of the subscription, then [period] after deletion.
- Data imported by the customer: until the customer deletes it or deletes the workspace.
- Invoices: 10 years [depending on the applicable law].
- Technical logs: [period].
Cookies
The replexa.eu website only sets strictly necessary cookies, with no advertising or analytics: rx_lang remembers the language you picked with the language switcher (one year), and rx_ref keeps the code from a referral link (7 days) so the application can credit the referral when you sign up. Your theme choice is kept in your browser's local storage and never leaves your device.
The app.replexa.eu application only uses cookies needed for it to work: your login session, your chosen theme and the menu state. They are not used for advertising or analytics, so they do not require consent.
Your rights
You can request access to your data, its rectification, erasure, restriction or portability, and object to its processing. A workspace owner can export all of its data as JSON from the application. For any request, write to [dedicated email]; we reply within one month.
You can also lodge a complaint with the supervisory authority: [CNPD in Luxembourg or CNIL in France, depending on where Apophisia is established].