Repliku Privacy Policy

1. Data controller

The data controller is Giuseppe Cerutti, trading as Repliku, VAT no. IT03365870835. Contact: privacy@repliku.io.

2. Data we process

Repliku processes the data needed to create accounts, connect locations, manage reviews, generate replies and provide support.

• Account data: email, name, interface language, trial or subscription status, any manual access and technical authentication metadata managed through Supabase.
• Business and location data: business name, locations, address, city, category, country, default language and operating preferences.
• Reviews: text, public author name, rating, date, provider metadata and reply status.
• Replies and reports: AI drafts, edited text, publishing status, reputation insights and shareable reports when enabled.
• Communications: support, product feedback, public contact requests and operational emails.
• Billing and payment data: billing details entered by the user and payment data handled by Stripe.
• Technical data: audit logs, rate limits, health checks, internal performance, first-party product usage metrics and hashed IP addresses where applicable.
• Trial abuse prevention: a versioned HMAC of the normalised email and, when a trial starts, the canonical location identity. The register does not retain the plain email or a simple email hash; this data is pseudonymous, not anonymous.

3. Purposes

• Create and protect user accounts.
• Connect authorised locations and synchronise reviews.
• Generate reply drafts, publish authorised replies and create reputation reports.
• Provide support, collect feedback and manage user requests.
• Understand whether users reach product value using only deduplicated first-party technical events, without review or reply text.
• Manage payments, billing, security, abuse prevention and operational monitoring.

4. Roles

Repliku acts as controller for account, billing, security, support and contractual data. When processing reviews and other data to provide features configured by the professional customer, Repliku acts as processor under the DPA.

5. Third-party services

Repliku uses technical providers required to operate the service.

• Supabase for database, authentication, application security and Vault.
• Vercel for hosting, server functions and scheduled jobs.
• Google Business Profile for connecting locations, reading reviews and publishing authorised replies.
• OpenRouter and, where configured, OpenAI or other LLM providers for generating replies and reputation insights.
• Resend for operational and transactional email.
• Stripe for payments, subscriptions, customer portal and checkout-related tax data.

6. Legal bases

• Performance of the contract or pre-contractual steps requested by the user.
• Consent where required for optional features or non-operational communications.
• Legitimate interests in security, abuse prevention, auditing, support and service improvement.
• Legal obligations relating to tax, accounting and other applicable requirements.

7. Retention

• Account and business data: for the life of the account and the technical period needed for closure.
• Trial abuse-prevention register: the minimum pseudonymous record remains after account deletion for as long as needed to prevent repeated use of the free trial; exceptional removal requires a verified privacy request or another legal obligation and an audited owner operation.
• Reviews, replies and reports: to provide the service and retain the reputation history requested by the user.
• Support, feedback and contacts: to handle the request and improve the product.
• Audit logs, rate limits, health checks, performance, product metrics and email outbox: according to operational retention policies configured in the system.
• Tax data: according to applicable legal requirements.

8. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Repliku uses providers with appropriate contractual and technical safeguards, including Standard Contractual Clauses where applicable.

9. Your rights

You may request access, correction, deletion, restriction, objection and data portability by writing to privacy@repliku.io. You may also lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

10. Cookies and similar technologies

Repliku uses technical cookies needed for authentication, security and app operation. It does not use heatmaps or session replay; internal product events are first-party and limited to functional signals. Non-essential marketing tracking will only be introduced with appropriate notice and consent.

11. Changes

Repliku may update this policy. Material changes will be communicated to registered users by email, in the dashboard or on the public page.