Privacy Policy

Effective Date: June 7, 2026

This Privacy Policy explains how Replex ("Replex," "we," "us," or "our") collects, uses, stores, and shares information when you visit our website, create an account, or use our web application.

Replex is a B2B SaaS product that helps teams respond to security questionnaires, vendor assessments, RFPs, and similar documents using an approved knowledge base, semantic search, and AI-assisted drafting.

Replex is currently operated as an early-stage product and has not yet been incorporated as a separate legal entity. References to "Replex," "we," "us," and "our" refer to the operator of the Replex service.

If you have questions about this Privacy Policy or how we handle data, contact us at:

• Privacy contact: dpo@replex.online
• General contact: contact@replex.online
• Website: https://replex.online

---

1. Scope of This Policy

This Privacy Policy applies to:

• the Replex website;
• the Replex web application;
• account registration and login;
• uploaded documents and knowledge base content;
• AI-assisted questionnaire workflows;
• billing and subscription-related processing;
• communications with us.

Replex is intended for business users and is not intended for personal, household, medical, or consumer use.

2. Information We Collect

We collect information you provide to us, information generated through your use of Replex, and limited technical information needed to operate the service.

2.1 Account Information

When you create an account or use Replex, we may collect:

• name;
• business email address;
• company or workspace name;
• authentication credentials;
• workspace membership and role information;
• subscription or billing status.

2.2 Customer Content

When you use Replex, you may upload, create, generate, or store content in the product. This may include:

• security questionnaires;
• vendor assessments;
• RFPs;
• spreadsheets, PDFs, DOCX files, CSV files, and similar documents;
• previous questionnaire answers;
• approved answers;
• knowledge base entries;
• extracted questions and answers;
• AI-generated draft answers;
• reviewed or approved answers;
• comments, statuses, review information, and exports.

We refer to this information as "Customer Content."

Customer Content may include confidential business information, security-related information, customer names, vendor names, and limited personal information if that information is included in documents uploaded by users.

2.3 Knowledge Base Data

Replex may process uploaded questionnaires, prior answers, and related documents to build or update a workspace knowledge base.

This knowledge base is used to help match new questionnaire questions with existing approved, previous, or relevant answers.

2.4 Technical and Usage Information

We may collect limited technical information, such as:

• IP address;
• browser type;
• device and operating system information;
• pages viewed;
• login and session activity;
• timestamps;
• error logs;
• security logs;
• product usage events.

We use this information to operate, secure, debug, and improve Replex.

2.5 Payment Information

Replex uses Stripe for payment processing.

We do not store full payment card numbers. Stripe may provide us with limited billing information, such as:

• billing name;
• billing email;
• billing address, if provided;
• subscription status;
• invoice history;
• payment status;
• card brand and last four digits.

Replex currently offers a free trial without requiring a payment card.

2.6 Communications

If you contact us, request support, book a demo, respond to an email, or participate in onboarding, we may collect:

• your name;
• email address;
• company name;
• message content;
• support requests;
• meeting notes;
• files or screenshots you choose to provide.

3. How We Use Information

We use information to:

• provide, operate, and maintain Replex;
• create and manage accounts and workspaces;
• authenticate users;
• process uploaded questionnaires and documents;
• build and maintain workspace knowledge bases;
• match questions against existing answers;
• generate AI-assisted draft responses;
• support review, approval, and export workflows;
• provide customer support and onboarding;
• send transactional emails;
• manage subscriptions and billing;
• monitor performance, reliability, and security;
• prevent misuse, fraud, and unauthorized access;
• improve the product;
• comply with legal, tax, accounting, and contractual obligations.

We do not sell personal information.

We do not use Customer Content to train Replex-owned AI models.

4. AI Processing

Replex uses third-party AI infrastructure to support features such as answer drafting, question matching, semantic search, and knowledge base workflows.

Currently, Replex may use:

• OpenRouter for AI model routing;
• DeepSeek models through OpenRouter;
• OpenAI text-embedding-3-small for embeddings, semantic search, and matching.

When AI features are used, Replex processes Customer Content in chunks. Replex does not intentionally send entire workspaces to AI providers for general processing.

The information sent to AI infrastructure may include selected or chunked portions of:

• questionnaire questions;
• extracted text from uploaded documents;
• previous answers;
• relevant knowledge base entries;
• user-provided instructions;
• limited surrounding context needed for matching or drafting.

Replex may use uploaded questionnaires and related documents to create or update a workspace knowledge base. This knowledge base is used to match new questionnaire questions with existing approved, previous, or relevant answers.

AI-generated answers are drafts. Users are responsible for reviewing and approving AI-generated content before sending it to customers, prospects, vendors, or other third parties.

Replex does not use Customer Content to train its own AI models.

Third-party AI providers may process data according to their own terms, privacy policies, data processing practices, and retention settings. Where available, we aim to use configurations designed to limit training and retention by third-party AI providers.

Replex may later support additional AI provider options, model selection, bring-your-own-key configurations, or non-AI knowledge-base-only workflows.

5. Cookies and Similar Technologies

Replex may use cookies and similar technologies for:

• authentication;
• session management;
• security;
• remembering user preferences;
• operating the website and application.

Replex does not currently use Google Analytics, product analytics tools, session replay tools, or advertising pixels.

We do not currently use:

• Google Analytics;
• PostHog;
• Mixpanel;
• Hotjar;
• Microsoft Clarity;
• LogRocket;
• Meta Pixel;
• LinkedIn Insight Tag;
• Google Ads tracking pixels.

If we add analytics or advertising technologies in the future, we will update this Privacy Policy as appropriate.

You can control cookies through your browser settings, but disabling essential cookies may prevent Replex from working properly.

6. How We Share Information

We may share information with service providers that help us operate Replex.

6.1 Infrastructure Providers

Replex currently uses:

• Cloudflare for website delivery, DNS, CDN, security, and related infrastructure services;
• Supabase for backend services, database, authentication, and/or storage.

Supabase data is currently hosted in the European Union region.

6.2 AI Providers

Replex may share selected Customer Content with AI infrastructure providers as described in the "AI Processing" section.

This may include:

• OpenRouter;
• DeepSeek models through OpenRouter;
• OpenAI text-embedding-3-small.

6.3 Payment Providers

Replex uses Stripe to process payments, subscriptions, invoices, and billing-related information.

6.4 Email Providers

Replex uses Resend to send transactional emails, such as account, authentication, onboarding, and service-related messages.

6.5 Legal and Safety

We may disclose information if we believe it is necessary to:

• comply with applicable law;
• respond to lawful requests;
• protect the rights, safety, and security of Replex, users, or others;
• investigate abuse, fraud, or security incidents;
• enforce our agreements.

6.6 Business Transfers

If Replex is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

7. Data Storage and International Transfers

Replex uses Supabase infrastructure hosted in the European Union region for core backend, database, authentication, and/or storage services.

However, Replex and its service providers may process information in other countries depending on the service used. For example, Cloudflare, Stripe, Resend, OpenRouter, AI model providers, and other infrastructure providers may process data in countries other than your own.

These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we rely on appropriate safeguards, such as contractual protections, data processing terms, or other lawful transfer mechanisms.

8. Data Retention

We retain information for as long as necessary to provide Replex, maintain security, comply with legal obligations, resolve disputes, and enforce agreements.

In general:

• account information is retained while your account is active;
• Customer Content is retained while it remains in your workspace;
• knowledge base entries are retained while they remain in your workspace;
• billing records may be retained as required for tax, accounting, and legal purposes;
• activity logs may be retained for operational, security, debugging, and audit purposes.

Replex applies the following retention practices:

• soft-deleted accounts are scheduled for permanent deletion after 30 days;
• old files in storage are scheduled for deletion after 90 days;
• activity logs older than 12 months may be archived.

You may request deletion of your account or workspace data by contacting dpo@replex.online.

When an account or workspace is deleted, Replex will make reasonable efforts to delete or anonymize associated Customer Content, subject to legal, billing, security, backup, and legitimate operational requirements.

Backups and infrastructure-level copies may retain deleted information for a limited period before being overwritten or deleted according to provider backup cycles.

9. Security

We use commercially reasonable technical and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards may include:

• HTTPS/TLS encryption in transit;
• encryption at rest where supported by infrastructure providers;
• authentication controls;
• workspace-level data separation;
• access controls;
• infrastructure security provided by Cloudflare and Supabase;
• limited internal access to production systems;
• monitoring and logging for reliability and security.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

10. Customer Responsibilities

Replex is designed for business questionnaire and knowledge base workflows.

Users are responsible for ensuring that they have the right to upload, process, and use Customer Content in Replex.

Users should not upload:

• protected health information or medical records;
• payment card data;
• government identification numbers;
• passwords;
• private keys;
• API keys;
• secrets;
• highly sensitive personal information;
• information they are not authorized to process or share.

Replex is not designed to be used as a system of record for highly sensitive regulated data unless a separate written agreement states otherwise.

11. Your Privacy Rights

Depending on your location, you may have rights regarding your personal information, such as the right to:

• access personal information;
• correct inaccurate personal information;
• request deletion;
• request export or portability;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent.

To exercise privacy rights, contact us at:

dpo@replex.online

We may need to verify your identity before responding to a request.

Some requests may be limited by legal, security, billing, contractual, or technical requirements.

12. California Privacy Notice

We do not sell personal information.

We do not knowingly share personal information for cross-context behavioral advertising.

We do not currently use advertising pixels or targeted advertising tools.

The categories of personal information we may collect include:

• identifiers, such as name, email address, IP address, and account identifiers;
• commercial information, such as subscription and billing status;
• internet or network activity information, such as login activity, device information, and usage logs;
• professional or business information, such as company name, business email, and workspace role;
• user-provided content, where personal information is included in Customer Content or communications.

We collect this information for the purposes described in this Privacy Policy, including providing Replex, maintaining security, processing payments, sending service emails, and improving the product.

California residents may contact dpo@replex.online to exercise applicable privacy rights.

13. EU/EEA and UK Users

If you are located in the European Economic Area, United Kingdom, or another jurisdiction with similar privacy laws, our legal bases for processing personal information may include:

• performance of a contract, such as providing Replex to you;
• legitimate interests, such as securing, operating, and improving the service;
• compliance with legal obligations;
• consent, where required.

You may have rights to access, correct, delete, restrict, object to processing, or request portability of your personal information.

You may contact us at dpo@replex.online to exercise these rights.

If you believe we have not handled your request properly, you may have the right to contact your local data protection authority.

14. Marketing Communications

Replex may send transactional emails related to your account, authentication, product usage, billing, security, and support.

In the future, we may send marketing or product update emails where permitted by law. You will be able to unsubscribe from marketing emails.

Even if you unsubscribe from marketing emails, we may still send service-related or transactional emails.

15. Children's Privacy

Replex is intended for business users and is not directed to children under 18.

We do not knowingly collect personal information from children under 18.

If you believe a child has provided us with personal information, contact us at dpo@replex.online, and we will take appropriate steps to delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify users by:

• updating the effective date;
• posting a notice on the website;
• sending an email;
• providing an in-app notice.

Your continued use of Replex after an updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy.

17. Contact Us

For privacy questions, requests, or concerns, contact us at:

Replex
Privacy contact: dpo@replex.online
General contact: contact@replex.online
Website: https://replex.online