Privacy Policy

This Privacy Policy (the “Privacy Policy”) serves to inform you of our policies and procedures regarding the collection, use and disclosure of the information we receive when you access and use the website (the “Site”), services, software, content, and all other products and services (all of the foregoing collectively, the “Services”) owned, controlled or offered, directly or indirectly, by Alchemy Technologies Incorporated (d/b/a Replo) (together with its subsidiaries and affiliates, “Replo”, “we,” “our” or “us”).

Replo believes that the privacy of its users is paramount and strives to use Personal Information (as defined below) only in ways outlined in this Privacy Policy. The Privacy Policy is incorporated by reference into our Terms of Service, currently available at replo.app/terms (the “Terms of Service”). By using the Services, you hereby warrant and represent that you have read, understand and agree to this Privacy Policy and the Terms of Service and that you are over 18 years of age.

PLEASE DO NOT USE, INSTALL OR ACCESS THE SERVICES IF YOU DO NOT AGREE TO THIS PRIVACY POLICY.

1. What We Mean by Personal Information

For purposes of this Privacy Policy, “Personal Information” means any information from or about a person that either identifies that person directly or that makes that person identifiable when it is combined with other information from or about that person from any source.

This Privacy Policy applies to Replo’s collection of personal data, and it is not intended to apply to the collection or use of personal data by Replo’s customers’ use of our Services. This Privacy Policy also does not apply to third-party websites, applications, or services reachable from our websites or applications.

Replo collects information under the direction of its customers in connection with its provision of the Services. Because a customer’s collection or use of personal data is specific to their use and implementation of the Services, please consult the relevant customer’s privacy policy, privacy notice, or the relevant written contract for the Services for more information. We do not have a direct relationship with our customers’ customers or end-users.

If you are a customer of one of Replo’s customers and would like more information on their use of your data, please contact the customer that you interact with directly. If you have further questions about the application of Replo’s Privacy Policy, please contact our support team at privacy@replo.app.

In addition, Replo provides analytics, page-building, AI, and business operations solutions to businesses and entities in a commercial context and our Services are not intended for consumers. Where Replo processes data on behalf of its customers, such processing is governed by a separate Data Processing Addendum.

2. Information We Collect

Information You Provide To Us

When you use the Services or otherwise communicate with us, we collect information that you provide to us directly. For example, we collect information in the following circumstances: you (i) use our apps or visit the Site, (ii) register for the Services or create an account or profile or accept the creation of an account or profile on your behalf (an “Account”), (iii) access the Services through social networking sites or third party services, (iv) subscribe to newsletters; (v) purchase a product or service on the Site or in our apps; (vi) invite your friends to join the Services, “share” the Services on social networking sites or perform other similar actions; (vii) request technical support; (viii) otherwise use our apps or online Services where Personal Information is required for such use and/or participation, (ix) when you sign up for a newsletter, and (x) when you contact us via the Site or when you otherwise communicate with us. You can choose not to provide information that is requested of you by us; however, this may limit your ability to use or access the Services.

The information you provide to us directly may include, without limitation, the following information that may, alone or in combination with other data, constitute Personal Information:

• Information you provide in connection with completing a transaction or purchase using the Services (including subscribing to Replo products), including your name, e-mail, phone number, financial and billing information, photos and videos uploaded, and any other information you decide to provide;
• Information you provide via email, through the “Contact” section on the Site or by using the contact details listed on various parts of the Site, including your name, company name, company type, e-mail, job title, phone number, inquiry, and any other information you decide to provide;
• Information you provide in order to subscribe to our newsletters and updates, including your email address, the topic for which you wish to receive updates, or any other information you decide to provide us with. You may always unsubscribe from these emails by following the instructions included;
• If you are one of our customers, suppliers or prospects, we may process limited Personal Information in the course of our business relation with you, for example when you place an order, request a demo or vice versa. Such Personal Information may include your name, company, title, e-mail address, telephone number, address, order details, and where applicable and relevant, credit registrations and credit limits;
• Transaction and limited (non-PCI) payment data; and
• Any other information you may want to share with us, such as Personal Information related to recruitment / job applications.

If you are one of our customer’s customers, and such data collection is enabled, we may collect certain demographic and interest data including age group and gender estimates, interests and affinity categories.

If you are one of our customers and you use the Replo AI Agent or other AI-powered features within the Services, we may process content and prompts you provide as inputs to such features.

Moreover, if you contact us, a record of such correspondence may be kept.

Additionally, if another user refers you to us by providing us with your e-mail address, we may send you a message. However, we will use your e-mail address only to send such other user’s message unless you otherwise affirmatively provide your information to us.

Automatically Collected Information

Most of the data we collect in and through the Site and the Services is technical in nature and is collected and processed automatically through so-called application programming interfaces, software development kits, cookies and similar software-based technologies. Alone or in combination with other data, such automatically collected data may constitute Personal Information. The data we may collect by automated means may include, without limitation:

• Device data: including, but not limited to, data on device advertising ID’s and similar hardware qualifiers, screen resolution, and similar device identifiers. We do not collect precise geolocation data.
• Engagement data: including, but not limited to, Session duration, frequency of visits, scroll depth (how far users scroll down a page), interactions with elements on the page (e.g., clicks, downloads, video plays).
• Usage data: Pageviews and pages visited, time spent on each page, navigation paths through the site, bounce rate (percentage of users who leave after viewing a single page)
• Network and internet information: including, but not limited to, URLs, Internet Protocol addresses, bounce rates, use of spoofing, active (TCP/IP) ports, number of sessions initiated, click streams, location information and network/Wi-Fi access points. We do not collect IP addresses as part of our analytics platform for our customers’ end-users.
• Traffic sources: Referral source (e.g., direct, search engines, social media), campaign tracking (e.g., UTM parameters from email or ad campaigns), keywords from organic search (limited due to privacy restrictions)
• Information we collect on the use of the Site via cookies: please see the “How We Use Cookies and Other Technologies” section below for more information.

Google Analytics is an element of the Site. By using cookies, Google Analytics collects and stores data such as time of visit, pages visited, time spent on each page of the Site, the Internet Protocol address, and the type of operating system used in the devices used to access the Site. By using a browser plugin available at http://www.google.com/ads/preferences/plugin/ provided by Google, you can opt out of Google Analytics.

Information You Post on the Services

The Services may provide chat, forum, or other customized profile and Account information, including access to a Slack channel for users. Information that you provide through the use of these tools will be available to the public generally. Replo has no obligation to keep private any information that you disclose to other users or the public using these functions. You should exercise caution when deciding to disclose Personal Information through the use of these tools or functions. We strongly recommend that you do not post any information through the Services that allows strangers to identify or locate you or that you otherwise do not want to share with the public.

Information You Share on Third Party Websites or through Social Media Services

The Services may include links to third party websites and social media services where you will be able to post comments, stories, reviews or other information. Your use of these third party websites and social media services may result in the collection or sharing of information about you by these third party websites and social media services. We encourage you to review the privacy policies and settings on the third party websites and social media services with which you interact to make sure you understand the information that may be collected, used, and shared by those third party websites and social media services.

Google User Data

When you connect a Google service, such as Google Drive, to Replo and authorize access, we receive information through Google APIs within the scope of your authorization to complete your requested task. We refer to that information and data derived from it as “Google User Data.”

Replo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This includes information received from Google Workspace APIs and data derived from that information.

We and our service providers process Google User Data, including through AI features, only to complete the task you requested, except for the limited security and legally required disclosures described in Section 4. Neither Replo nor its service providers sell Google User Data, use it for advertising, or use or transfer it to develop, train, or improve non-personalized AI or machine learning models.

The permissions elsewhere in this Privacy Policy to use or share anonymized or aggregated data for AI training, product development, industry benchmarking, or marketing do not apply to Google User Data, including anonymized or aggregated data derived from it. The Google User Data restrictions in this Privacy Policy control over any inconsistent general provisions, including the general use, sharing, and retention provisions.

How We Use Cookies and Other Technologies

Some of the features on the Site and the Services require the use of “cookies” - small text files that are stored on your device’s hard drive. We use cookies to measure which pages are being accessed, and which features are most frequently used. This enables us to continuously improve the Site to meet the needs of our visitors.

The following sets out how we may use different categories of cookies and your options for managing cookie settings:

We and our service providers may also use “pixel tags,” “web beacons,” “clear GIFs,” or similar means in connection with the Services and HTML-formatted email messages to, among other things, track the actions of users, to determine the success of marketing campaigns and to compile aggregate statistics about Site usage and response rates. Our advertisement partners may use a “pixel tag” to collect anonymous information about your visits to the Site and to other websites, and they may use that information to target advertisements for goods and services. This information is collected anonymously, in a manner that does not personally identify you.

3. Use of Collected Information

We use the information you provide to us for the following purposes: (i) to further our legitimate interests in providing the Services, including without limitation to collect and remit payment for paid features, (ii) to administer your use of the Services and any Accounts you may have with us, (iii) to personalize your experience, (iv) to develop new content and promotions, (v) to provide to you Service announcements or inform you of new releases and features, (vi) to provide you with further information and offers from us or third parties that we believe you may find useful or interesting, such as newsletters, marketing or promotional materials, (vii) to perform tasks on behalf of and according to instructions of a third party, such as payment processors, third party-service providers or our advertising partners, (viii) to enforce our Terms of Service, (ix) to resolve any disputes between users of the Site or between such users and us, (x) comply with a legal requirement or process, including, but not limited to, civil and criminal subpoenas, court orders or other compulsory disclosures; (xi) to further our legitimate interest in protecting our rights, property, or safety and the rights, property and safety of the Services, our users or the public, and (xii) to contact you to obtain feedback from you regarding the Site and the Services, and (xiii) to train, improve, or develop Replo’s products and services, including AI features, using anonymized or aggregated data derived from your use of the Services, except where you have opted out or where prohibited by applicable law, and (xiv) to compile anonymized or aggregated industry benchmarks, metrics, or insights derived from data collected across our customer base (for example, aggregate performance metrics by industry or geography), and to use or share such anonymized or aggregated data for marketing and product development purposes, provided that such data does not identify any individual user or customer.

Notwithstanding the foregoing, Google User Data and data derived from it are excluded from the AI training, benchmarking, and marketing uses described above. All uses of Google User Data are limited to those described in the “Google User Data” subsection of Section 2 and Section 4.

In addition to the purposes described above, we use the information collected automatically to (i) to further our legitimate interests in monitoring and analyzing the use of the Services and for the technical administration of the Site, (ii) improve the Site and the Services, (iii) generate and derive useful data and information concerning the interests, characteristics and website use behavior of our users, and (iv) verify that users of the Services meet the criteria required to process their requests. We and or our advertising partners may use demographic and geo-location, as well as information logged from your hardware or device, including data such as IP address, device model and ID, MAC address, operating system, application usage data, device time zone, region and language, and click ID, to ensure relevant advertising is presented within the Services.

4. Third Parties We Share Personal Information With

We may disclose Personal Information you provide to us or that we collect automatically on the Site and in and through the Services with the following categories of third parties:

• Service providers, such as payment processors, web hosting and data storage service providers, and others helping us deliver and develop the Services, including marketing service providers, communications service providers, and AI/LLM providers (e.g. Stripe, Meta, TikTok, LinkedIn, Pylon, Anthropic, OpenAI, Groq, AWS, Heroku, Cloudflare, Segment, PostHog, Sentry, Braintrust, Nango, ClickHouse and similar subprocessors, as updated from time to time and available upon request at privacy@replo.app);
• Channel partners, including resellers and distributors, in connection with their delivery of the Services to end customers, subject to appropriate confidentiality obligations;
• Our advertising partners in compliance with applicable law;
• Public authorities, such as law enforcement, if we are legally required to do so or if we need to protect our rights or the rights of third parties; and
• Our subsidiaries and affiliates; or a subsequent owner, co-owner or operator of the Site and/or the Services and their advisors in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of our stock and/or assets, or in connection with bankruptcy proceedings, or other corporate reorganization, in accordance with this Privacy Policy.

Notwithstanding the general sharing provisions above, we share Google User Data with service providers only with your authorization and as necessary to complete the task you requested. These providers may include hosting, integration, and AI-processing providers. Their processing of Google User Data is limited to completing your requested task; they do not sell the data, use it for advertising, or use or transfer it to develop, train, or improve non-personalized AI or machine learning models.

Access to Google User Data is restricted to authorized Replo and service-provider personnel on a need-to-know basis. Replo and service-provider personnel may not read Google User Data unless (a) you have provided explicit consent to view specific data and that consent has been documented, (b) access is necessary for security purposes, such as investigating abuse or a security incident, or (c) access is required to comply with applicable law or regulation. Access for these purposes is limited to the minimum necessary.

We may disclose Google User Data for security purposes or when required by applicable law or regulation, only to the extent necessary. The general sharing provisions elsewhere in this Privacy Policy do not otherwise authorize sharing Google User Data for purposes unrelated to completing your requested task.

5. Links to Other Websites

We frequently make content or services from other websites available to you from links located on the Site. We may present links in a format that enables us to keep track of whether these links have been followed. In addition, you may opt to link your Account to your social media account or other accounts, such as Google, in accordance with your Account settings (which you may change at any time) and respective policies of these third parties. This Privacy Policy applies only to the Site and the Services. We do not exercise control over third party services or other websites that provide information, or over banners, other advertisements or links from within the Site or the Services. Your interactions with these third party services are governed by the privacy policy of the company providing it. These other sites and services may place their own cookies or other files on your computer’s browser, collect data or solicit Personal Information from you. Other websites and services follow different rules regarding the use or disclosure of the Personal Information that you submit, and the collection and use of such information and access of any third party websites are subject to such third party’s privacy policy. We encourage you to read the privacy policies and other terms of such third parties before using their services.

6. Security

We understand the importance of privacy and security of Personal Information to our users and have made them a priority. Replo uses industry-standard security technologies and procedures to help protect Personal Information about you from unauthorized access, use, or disclosure, including encryption of data in transit using TLS/HTTPHTTPS and encryption of sensitive credentials at rest (e.g., API keys). Access to production systems is restricted to authorized personnel. Replo restricts access to personal data to employees and contractors on a need-to-know basis consistent with their role. However, we cannot guarantee that unauthorized third parties will never be able to overcome those measures or use your Personal Information for improper purposes, and we do not promise that Personal Information about you or private communications will be protected from unauthorized disclosure or use.

Google User Data is encrypted in transit and at rest. Access controls apply to Google User Data, including data in logs, backups, exports, and systems operated by service providers on our behalf. Access is restricted as described in Section 4.

7. Do Not Track Signals and Similar Mechanisms

Some web browsers transmit “do-not-track” signals to websites. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not take action in response to these signals.

8. Managing Your Privacy

We keep your data on your behalf and for your benefit. You can correct or terminate and delete your Account information by following the instructions on the Services or by e-mail at privacy@replo.app, which you may also access for further assistance and questions regarding the Privacy Policy or for a copy of your Account data. If you cancel your Account or request us to delete your information, Replo will limit its access to Personal Information to perform what is requested by you and will delete information accessible to Replo promptly upon request, and in any event within 30 days.

The deletion process and 30-day deadline described above also apply to retained Google User Data. You may request deletion by contacting privacy@replo.app or cancelling your Account. We will delete retained Google User Data promptly, and in any event within 30 days, except to the minimum extent that retention is required by applicable law or regulation. Any data retained for that reason is used only for that purpose and deleted when the requirement ends.

9. Your Rights

We take steps to help ensure that you are able to exercise your rights regarding Personal Information about you in accordance with applicable law. If you would like to access, review, erase, withdraw your consent, or object to, or restrict the processing of Personal Data we collect about you, you may submit a request to privacy@replo.app. We will promptly review all such requests in accordance with applicable laws. Depending on where you live, you may also have a right to lodge a complaint with a supervisory authority or other regulatory agency if you believe that we have violated any of the rights concerning Personal Information about you. We encourage you to first reach out to us at privacy@replo.app, so we have an opportunity to address your concerns directly before you do so.

In addition to the foregoing, if you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, you may also have the right to: (a) receive a copy of your Personal Information in a structured, commonly used, and machine-readable format and to transmit it to another controller (right to data portability); (b) withdraw your consent to processing at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; (c) object to our processing of your Personal Information based on our legitimate interests, including for direct marketing purposes; (d) request restriction of processing of your Personal Information under certain circumstances; and (e) not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where such processing is necessary for the performance of a contract, permitted by applicable law, or based on your explicit consent. Please contact us at privacy@replo.app to exercise any of these rights.

10. California Residents

California Civil Code Section 1798.83 requires certain businesses that share customer Personal Information with third parties for the third parties’ direct marketing purposes to respond to requests from California customers asking about the businesses’ practices related to such information-sharing. We currently do not share or disclose your Personal Information to third parties for the third parties’ direct marketing purposes. If we change our practices in the future, we will implement an opt-out policy as required under California laws.

Furthermore, subject to certain exemptions, California residents have the following rights with respect to Personal Information we may have collected about them:

Requests to Know

You have the right to request that we disclose:

• The categories of Personal Information we have collected about you;
• The categories of Personal Information about you we have sold or disclosed for a business purpose;
• The categories of sources from which we have collected Personal Information about you;
• The business or commercial purposes for selling or collecting Personal Information about you;
• The categories of Personal Information sold or shared, if any, about you, as well as the categories of third parties to whom the Personal Information was sold, by category of Personal Information for each party to whom Personal Information was sold; and
• The specific pieces of Personal Information collected.

You may submit a request to know via https://replo.app/contact. The delivery of our response may take place electronically or by mail. We are not required to respond to requests to know more than twice in a 12-month period.

Requests to Delete

You have the right to request that we delete any Personal Information about you that we have collected. Upon receiving a verified request to delete Personal Information, we will do so unless otherwise required or authorized by law. You may submit a request to delete Personal Information via https://replo.app/contact.

Replo does not sell Personal Information, as that term is defined under the CCPA, and has not done so in the preceding 12 months. Replo may share anonymized, aggregated data (such as industry benchmark metrics) that does not identify any individual or customer; such sharing does not constitute a sale of Personal Information under the CCPA.

Authorized Agents

You may designate an authorized agent to make requests on your behalf. You must provide an authorized agent written permission to submit a request on your behalf, and we may require that you verify your identity directly with us. Alternatively, an authorized agent that has been provided power of attorney pursuant to Probate Code sections 4000-4465 may submit a request on your behalf.

Methods for Submitting Consumer Requests and Our Response to Requests

You may submit a request for access and requests to delete Personal Information about you via:

• https://replo.app/contact, or
• via email at privacy@replo.app

Upon receipt of a request, we may ask you for additional information to verify your identity. Any additional information you provide will be used only to verify your identity and not for any other purpose.

We will acknowledge the receipt of your request within 10 days of receipt Subject to our ability to verify your identity, we will respond to your request within 45 days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. In order to protect your privacy and the security of Personal Information about you, we verify your request by email and phone as necessary.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

The Right to Non-Discrimination

You have the right not to be discriminated against for the exercise of your California privacy rights described above. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

11. European Economic Area, United Kingdom, and Swiss Residents

If you are located in the EEA, the UK, or Switzerland, the following additional provisions apply.

Lawful Basis for Processing. We process your Personal Information on one or more of the following legal bases as required by applicable data protection law:

• Performance of a contract: to provide the Services and perform our obligations to you under our Terms of Service;
• Legitimate interests: to improve and develop our Services, prevent fraud, ensure security, send service communications, and pursue other legitimate business interests, where such interests are not overridden by your fundamental rights and freedoms;
• Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject; and
• Consent: where you have provided us with your consent to process your Personal Information for a specific purpose (such as marketing communications), which you may withdraw at any time by contacting us at privacy@replo.app.

Replo’s Role. When Replo processes Personal Information about its direct customers (registered users and workspace members), Replo acts as a data controller. When Replo processes Personal Information about the end-users of its customers (for example, visitors to a merchant’s storefront on which Replo’s analytics script is deployed), Replo acts as a data processor on behalf of the relevant customer (the controller). In such cases, the relevant customer’s privacy policy governs the processing of end-user data, and inquiries regarding such data should be directed to the relevant customer.

Supervisory Authorities. You have the right to lodge a complaint with a supervisory authority. For EEA residents, this is the data protection authority in your EU member state. For UK residents, this is the Information Commissioner’s Office (ICO) at https://ico.org.uk. For Swiss residents, this is the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch.

12. International Transfers of Personal Information

Replo is based in the United States. As a result, Personal Information that we collect in and through the Services and on the Site may be transferred to our U.S. offices. In addition, we may work with third-party service providers in the U.S. and in other countries to support our business activities. Thus, Personal Information may be transferred to, stored on servers in, and accessed from the United States and countries other than the country in which the Personal Information was initially collected. In all such instances, we use, transfer, and disclose Personal Information solely for the purposes described in this Privacy Notice and in compliance with applicable laws. Where Replo processes personal data of individuals located in the European Economic Area or United Kingdom on behalf of its customers, such transfers are governed by Standard Contractual Clauses as described in Replo’s Data Processing Addendum, available upon request at privacy@replo.app.

13. Data Retention

We keep Personal Information related to your Account for as long as it is needed to fulfill the purposes for which it was collected, to provide our services, to deal with possible legal claims, to comply with our business interests and/or to abide by all applicable laws. Thereafter, we either delete Personal Information about you or de-identify it. Please note that even if you request the deletion of Personal Information about you, we may be required (by law or otherwise) to retain the Personal Information and not delete it. However, once those requirements are removed, we will delete Personal Information about you in accordance with your request.

Notwithstanding the foregoing, Google User Data is retained only as necessary for the limited purposes described in Sections 2 and 4 and is subject to the deletion process and 30-day deadline in Section 8. The general business-interest retention and de-identification provisions above do not authorize retention or use of Google User Data for other purposes.

14. Changes to the Privacy Policy

Our security and Privacy Policy are periodically reviewed and enhanced as necessary. This Privacy Policy might change as we update and expand the Services. You can tell when this Privacy Policy was last updated by reviewing the Last Updated-legend on top of this page. We will endeavor to notify you of these changes by email, but will not be liable for any failure to do so. We also encourage you to review this Privacy Policy periodically. If you do not understand any of the terms or conditions of any of our policies, you may inquire regarding the same via email at privacy@replo.app. Your continued use of the Services after any change in this Privacy Policy will constitute your acceptance of such change.

15. Contacting Us

If you have any concerns or questions about this Privacy Policy, please contact us at privacy@replo.app for privacy-related inquiries, or support@replo.app for general support inquiries.