Who is responsible for what
This policy is from [Company legal name] (“we”). For the client communications a business connects to Replyguard, that business (our customer) decides what is monitored and is the controller of that data; we process it on their behalf and on their instructions. For the account details of people who use the product, such as names and sign-in emails, we are the controller.
What we collect
- Account information: your name, work email address, role in your workspace, and multi-factor authentication settings.
- Client communications from connected channels: for messages that involve one of the customer’s registered clients, the sender and recipients (names and addresses), subject, message text, time sent, and the conversation it belongs to.
- Email headers, briefly: to find client mail in a monitored mailbox, we check who each new email is from and to. Subject and body are only fetched when a registered client is on the message. Mail that doesn’t involve a client is not stored.
- Escalation records: which conversations were escalated, to which level, who was notified and when, and how each was resolved.
- Security and audit logs: sign-ins, configuration changes and similar events, kept to protect the service and your workspace.
What we don’t collect
- Mail in mailboxes the customer hasn’t chosen to monitor.
- Any message involving an address or domain on the customer’s never-capture list, even when a client is also on it.
- Attachments. We record message text only.
- Advertising or tracking cookies. We use only the cookies needed to keep you signed in.
How we use it
To provide the service the customer has set up: spotting client messages that are still waiting for a reply, notifying the people on the customer’s escalation levels, showing activity in the console, and keeping the service secure and working. We do not sell personal information or use customer content to train models.
How long we keep it
Client communications and escalation records are kept for as long as the customer’s agreement requires, then deleted. Account information is kept while the account is active and for [retention period] afterwards for legal and security purposes.
How we protect it
Each customer’s data is isolated at the database level, connector credentials are kept in a dedicated secrets store rather than alongside your data, and access is limited by role. Read more on our security page.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to how it is used. If your information is in a customer’s workspace, contact that business first; we will help them respond. You can also write to us at [privacy@yourdomain.com].
International transfers
Data is stored in [hosting region]. Where it moves across borders, we use appropriate safeguards such as standard contractual clauses.
Changes to this policy
We will post updates here and tell customers about material changes before they take effect.
Contact
[Company legal name], [Registered address]. [privacy@yourdomain.com]