Privacy policy
Last updated October 8, 2026
This policy explains what ReplySetter (“we”) collects when you visit replysetter.com or use the ReplySetter app, why, who we share it with, and the choices you have. Questions or requests: [email protected].
Two roles
For your account, billing, and visits to our website and app, we decide how data is used (we are the controller). For the conversations your agents handle (your contacts' emails, messages and chats), you decide, and we process them on your behalf (we are your processor). If you are one of our customers' contacts, please contact that business first; we help them answer you.
What we collect
- Account: name, email, password (stored only as a hash) or the Google, Microsoft, Facebook or GitHub account you sign in with, and what you tell us in onboarding (industry, role, website).
- Workspace content: the inboxes and tools you connect, your agents, knowledge bases, and the conversations they read and answer.
- Billing: your plan, invoices and payment status from Stripe. Card details stay with Stripe.
- Sign-ins: when and from which IP address, browser and approximate location you sign in, so you can see and end sessions.
- Website and app usage: the pages you open, how long they're on screen and how far you scroll, the links you click to sign up, the site that referred you and campaign tags in the link (utm_*), your country (from our network provider), browser, operating system, device type, screen width, language and time zone.
- Device fingerprint: see below.
Device fingerprint
Our website and app compute a fingerprint of your device in your browser with the open-source library ThumbmarkJS: a hash of technical characteristics such as the browser, screen, fonts and graphics capabilities. It is not your name or email, and the library sends nothing to its makers (we turned that off).
We use it, together with the browser id and IP address, for two things:
- Preventing abuse: recognising when one person opens several accounts to get more than one free trial or to get around limits. When an account is linked this way to one that already had a free trial, its checkout comes without a free trial; it can still subscribe.
- Understanding visits: keeping the visits of one device together when cookies were cleared, so we know which pages led to a signup.
Our legal basis is our legitimate interest in protecting our free plan and trials from abuse and in understanding how people find us. You can object at any time (see Your rights); identical devices can share a fingerprint, so a person reviews any account that's flagged before acting on it beyond the trial.
Cookies and browser storage
We use only first-party cookies. No advertising cookies, no third-party trackers, and we don't sell or share data for advertising.
| Name | Where | Purpose | Kept for |
|---|---|---|---|
ia_session | App | Keeps you signed in | 30 days |
ia_ws | App | Remembers which workspace you picked | 1 year |
rs_vid | Website and app | A random id for this browser: counts visits and ties the visit that brought you to the account you make | 400 days |
rs_sid | Website and app | Groups the pages of one visit | 30 minutes after your last page |
rs_fp (session storage) | Website and app | The device fingerprint, kept for this tab so it isn't computed again | Until the tab closes |
theme (local storage) | Website and app | Light or dark mode | Until you clear it |
Blocking or clearing cookies won't stop the website working; the app needs its sign-in cookie.
How we use it
- To provide the service: run your agents, sync your inboxes, send replies, keep you signed in (contract).
- To bill you and keep records the law requires (contract, legal obligation).
- To send account emails (password resets, billing) and product emails such as onboarding tips, which you can unsubscribe from (contract, legitimate interest).
- To understand which pages, sources and campaigns bring people who sign up and stay, and to improve the product (legitimate interest).
- To keep the service secure and prevent fraud and abuse, including several free accounts or trials by one person (legitimate interest).
We don't use your workspace content or your contacts' conversations to train AI models.
Who we share it with
Only with the providers who run parts of the service for us, under data-processing terms, and with integrations you connect yourself (your CRM, calendar, inbox provider):
| Provider | What for | Where |
|---|---|---|
| Hetzner Online (Germany) | Servers and databases that run the app | EU |
| Cloudflare | Network, security and file storage (R2) | Global |
| Stripe | Payments and invoices: we never see or store full card numbers | US / EU |
| Resend | Account and product emails | US |
| AI model providers you or we connect (e.g. OpenAI, Anthropic, OpenRouter) | Writing your agents' replies from the conversation and your knowledge | US |
| Sentry (when enabled) | Error reports from the app, without message contents | US / EU |
| Vercel | Hosting this website | Global |
Transfers outside the EU rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. We disclose data to authorities only when the law requires it.
How long we keep it
- Account and workspace data: while your account exists; deleted when you or we delete it.
- Website and app visits (pages, clicks, browser id, fingerprint): 25 months, then deleted.
- Devices and sign-ins linked to an account: while the account exists.
- Invoices and payment records: as long as tax law requires (usually up to 10 years).
- Conversation messages: as set for your workspace, and deleted with it.
Your rights
Depending on where you live (including under the GDPR, UK GDPR and California law), you can ask to access, correct, delete or export your data, to restrict or object to how we use it (including the fingerprint and visit analytics), and to withdraw consent you gave. Email [email protected]; we answer within 30 days. You can also complain to your data protection authority. We don't sell personal information.
Security
Data is encrypted in transit; secrets such as connected-account tokens and API keys are encrypted at rest; access is limited to the people who run the service. Each browser can hold one signed-in session per account.
Children
ReplySetter is a business tool and isn't meant for anyone under 16.
Changes
We'll update this page when what we do changes and change the date above; for significant changes we'll tell account holders by email. Back to the home page.