Privacy Policy

Waitlist signups

When you join the waitlist we store your email address, which form on the page you used, the page that referred you, your browser’s user-agent string, and the time you signed up. We use this only to tell you when your access is ready and to understand where signups come from.

Account information

When you create an account we store your email address and the name you give us. You sign in with a one-time code we email you, so there is no password to store; accounts created before November 2, 2026 may still hold a hashed password, which Reaplo no longer uses. If you sign in with Google, we receive your Google account email and name from Google and store the email. We never see your Google password.

Workspace data

Everything you put into Reaplo to make it work: your campaigns (name, website, what the product does, who it is for), the keywords, products, and accounts you track, the conversations you save and their status, the reply drafts you generate, and your workspace timezone. This also includes the public posts Reaplo collects for you, described in the next section.

Billing information

Payments are handled by Dodo Payments. We store your plan, your subscription status and renewal dates, and the Dodo Payments customer, subscription, and product identifiers. We do not store card numbers.

Usage information

We keep a first-party log of the actions that count against your plan (scans, reply drafts, keyword suggestions, and similar), the results of each scan, and short-lived request counters keyed by your workspace or IP address to prevent abuse.

Site analytics

Every page of the site and app counts page views with Vercel Web Analytics and measures how fast pages load with Vercel Speed Insights. For each page view, Web Analytics records the page address, the referring page, an approximate location (country, region, and city), and your browser, operating system, and device type. Speed Insights records the page address, loading-time measurements, your network speed, browser, operating system, device type, and country. Both receive the page address without its query string, so nothing a link carries after the path (such as an email address on a checkout return) is recorded. Neither uses cookies. Web Analytics tells visits apart by a hash of the request that Vercel discards after 24 hours, and neither ties the data to you, your account, or your IP address. We see only totals. We use no advertising trackers.

Product analytics

We use PostHog, with data stored in the EU, to understand how Reaplo is used and to fix what breaks. It records the pages you visit, the parts of a page you click (but not what they say), session recordings, errors, and the actions you take in the app, such as finishing a setup step, starting a checkout, changing a lead’s status or drafting a reply. In the app, a recording masks every piece of text and every form field, so it shows the layout and your clicks, never the posts, your campaign or what you type. Once you are signed in, these records are tied to your account and workspace by their internal identifiers; your email address and name are not sent. Page addresses are sent without their query string. We also record how long each AI request took and how many tokens it used, never its content.

If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, PostHog stores nothing on your device until you answer the cookie bar; until you accept, or if you decline, it counts your visit without cookies and records no session, and a decline keeps only your answer, so you are not asked again. Anywhere else, it uses a cookie from your first visit.

The core of Reaplo is reading posts that people have published publicly on social platforms and showing you the ones that matter to your campaign. To do that, and only on your instructions, we collect and store:

• the public post itself: its text, link, platform, publication time, and engagement counts;
• the author’s public handle, display name, profile link, and avatar, as published with the post.

A few boundaries we hold to. Reaplo only stores original posts, never comments or replies. Author details are only those published with the post, and we never guess at, look up, or enrich an identity from other sources. Reaplo never posts, messages, or follows anyone on your behalf. And we never build cross- customer profiles of authors: what one workspace collects is visible only inside that workspace.

We process this content under our legitimate interest, and yours, in helping businesses find and respond to relevant public conversations. If you are the author of a post that Reaplo has stored and you would like it removed, email support@reaplo.ai with a link to the post and we will delete it.

• To create and secure your account and sign you in.
• To run the service: search the platforms you chose, classify and score posts with AI, and draft replies.
• To charge for your subscription and apply the limits of your plan.
• To send you emails you need: sign-in codes, billing receipts, and notice that your waitlist spot is ready. We do not send marketing newsletters.
• To prevent abuse, enforce our Terms of Service, and keep the service reliable.
• To comply with the law.

We do not use your workspace data, or the public content we collect for you, to train AI models. Our AI provider, OpenAI, does not use data sent through its API to train its models by default, and we do not opt in.

We share data only with the providers that run the service. Each one receives what it needs for its job and nothing more.

The search providers listed above act as our intermediaries to the platforms. They receive your search terms and tracked names, not your account or billing details. Beyond these providers, we disclose personal data only when the law requires it or to protect the rights and safety of Reaplo or its users.

We do not sell your personal data, and we do not share it with anyone for their own advertising.

Reaplo uses two kinds of cookie. The session cookie keeps you signed in: it is strictly necessary, it is marked HttpOnly so scripts in the page cannot read it, and it is only ever sent over HTTPS in production. PostHog’s analytics cookie (and the browser storage it keeps beside it) recognises your browser between visits and holds your cookie-bar answer; when it is set is described under Product analytics above.

Your theme preference (light or dark) is kept in your browser’s local storage and never leaves your device.

We do not use advertising cookies; Vercel’s analytics work without cookies. Checkout is provided by Dodo Payments and is covered by their privacy policy.

• Account and workspace data is kept for as long as your account exists.
• Conversations (posts saved as leads) are deleted automatically. One nobody acts on is dismissed after 7 days and deleted 30 days after it was dismissed, by you or automatically. Contacted conversations are deleted after 180 days and converted ones after 365 days, both counted from their last status change; each campaign keeps at most its newest 5,000 converted conversations.
• Other collected posts are deleted 30 days after they were found when they never became a conversation, 90 days for posts about a competitor you track, and 365 days for posts about your own product. A post you remove from a feed is kept until then.
• Aggregate statistics (how many conversations were found, contacted and converted, by date, platform and topic) are kept after the posts behind them are deleted, so your analytics stay accurate. They contain no post text or author details.
• Waitlist signups are kept until we have opened access to you, or until you ask to be removed.
• Product analytics (PostHog) are kept for one year; session recordings for one month.
• Abuse-prevention counters keyed by IP address are short-lived and cleared automatically.
• Billing records are kept for as long as tax and accounting law requires.

There is no self-service account deletion yet. Email support@reaplo.ai from your account address and we will delete your account and all of its workspace data, normally within 30 days.

Wherever you live, you can ask us to access, correct, export, or delete the personal data we hold about you, and to stop processing it, by emailing support@reaplo.ai. We will confirm your identity, usually by replying to the email address on your account, and answer within 30 days. Exercising these rights never costs anything and never changes the service you get.

If you are in the EU, EEA, or UK (GDPR)

Our legal bases are: performance of a contract for running your account, workspace, and subscription; legitimate interests for processing public social media content, securing the service, and preventing abuse; consent for the waitlist and for optional Google sign-in; and legal obligation for billing records. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. You can also complain to your local data protection authority.

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

If you are in South Korea (PIPA)

We are based in Korea and follow the Personal Information Protection Act. You have the same rights of access, correction, deletion, and suspension of processing described above.

Reaplo is operated from South Korea, and the providers listed above are mostly located in the United States. Your data is therefore stored and processed outside the country you live in. Where a transfer out of the EU, EEA, or UK takes place, we rely on our providers’ standard contractual clauses and equivalent safeguards.

All traffic is encrypted in transit. Sign-in is handled by Supabase Auth with one-time email codes or Google, and the session cookie is protected as described above. Every workspace is isolated at the database level so one customer can never read another’s data. No system is perfectly secure, so if you believe your account has been compromised, email support@reaplo.ai right away.

Reaplo is a business tool and is not directed at anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us data, email support@reaplo.ai and we will delete it.

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data, we will email account holders before it takes effect. Continuing to use Reaplo after that date means you accept the updated policy.

Haiyan Zhao, Seoul, South Korea. Email support@reaplo.ai.