Privacy Policy

Effective October 18, 2026

This Privacy Policy explains how Replybeat ("Replybeat", "we", "us") collects, uses, stores and shares information when you use our website at replybeat.com and our application at app.replybeat.com (together, the "Service"). Replybeat is an email outreach tool: our customers connect their own mailboxes, import their own contacts, and send email campaigns from those mailboxes.

1. Information we collect

Account information

When you create an account we collect your email address, a password (stored only as a secure hash by our authentication provider), your workspace name, and the team members you invite.

Customer content

Information you put into the Service, such as contact lists you upload or enter (names, email addresses, company, job title, phone, location, consent details and any custom fields), email templates, campaign settings and sending-domain settings. You control this content; we process it on your behalf to provide the Service.

Information from connected Google and Microsoft accounts

When you connect a mailbox, you sign in directly with Google or Microsoft and approve the access below. We never see or store your Google or Microsoft password.

• Google (Gmail): your email address and account identifier (openid, email); permission to send email on your behalf (gmail.send); and read-only access to your mailbox (gmail.readonly).
• Microsoft 365 / Outlook: your basic profile and email address (User.Read, openid, email); permission to send email (Mail.Send); read access to mail (Mail.Read); and continued access while you remain connected (offline_access).

We store the access and refresh tokens these providers issue so the Service can keep sending your scheduled emails. Tokens are encrypted at rest (AES-256-GCM) and are never displayed in the app.

Email engagement data

For emails sent through the Service, we record delivery status and, where tracking is enabled, when an email is opened, which link is clicked, and the device's user-agent string. Each email includes an unsubscribe link; when a recipient unsubscribes we record that so they are never emailed again from that workspace.

Technical information

Our hosting providers keep standard server logs (such as IP address, browser type and request time) for security and troubleshooting. The app uses only the cookies needed to keep you signed in and remember your active workspace. This website does not use advertising or analytics cookies.

2. How we use Google and Microsoft mailbox data

We use mailbox access only to provide features you can see and control in Replybeat:

• Sending: to send the campaign and follow-up emails you create and schedule, from the mailbox you connected.
• Reading: to check new messages in that mailbox's inbox and recognize (a) replies from your contacts, so their sequence stops automatically, (b) bounce notices, so undeliverable addresses are suppressed, and (c) automatic replies such as out-of-office messages, so they don't stop a sequence. We keep only the result (for example "reply from contact X" or "hard bounce for address Y"), the related addresses, and the message and conversation identifiers needed to find that reply again. We do not store the content of messages we read.
• Replies inbox: when you open a reply in Replybeat, we load it directly from your mailbox to show it to you, and send your answer from that mailbox in the same conversation. The message content is displayed but not saved.
• Identity: to know which mailbox you connected and show it in your account.

Google API Services — Limited Use

Replybeat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with your notice.
• We do not use Google user data for advertising, including retargeting or personalized ads.
• We do not sell Google user data, and we do not use it to determine creditworthiness or for lending.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models.
• No person at Replybeat reads your Google user data unless you give us permission for a specific message (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.

We apply the same commitments to data received from Microsoft accounts.

3. How we use other information

• To provide, maintain and secure the Service, including email validation and deliverability safeguards (warmup, sending limits, bounce monitoring).
• To send you service messages such as account confirmations, password resets and important notices.
• To respond to support requests.
• To detect, prevent and investigate spam, abuse, fraud and violations of our Terms of Service.
• To comply with legal obligations.

4. How we share information

We do not sell personal information. We share it only with:

• Service providers that host and operate the Service for us under confidentiality and security obligations: Supabase (database and authentication), Vercel (application hosting), Cloudflare (email sending infrastructure and tracking links), our transactional email provider (account emails), and, if your workspace turns it on, an email-validation provider.
• Google and Microsoft, to send and read mail through the mailbox you connected.
• Your recipients, who receive the emails you send.
• Legal and safety: when required by law, or to protect the rights, safety and security of our users, the public or Replybeat.
• Business transfers: in a merger, acquisition or sale of assets, with notice to you.

5. Data retention and deletion

• Removing a mailbox in Replybeat (Accounts → Delete) permanently deletes its stored tokens. You can also revoke access at any time from your Google account permissions or Microsoft My Apps page; once revoked, we can no longer access that mailbox.
• Contacts, templates and campaign data are kept until you delete them or close your workspace.
• Suppression entries (unsubscribes and hard bounces) are kept for as long as the workspace exists so those people are never emailed again.
• To delete your account and all associated data, email support@replybeat.com. We complete deletion within 30 days, except where we must keep information to meet legal obligations.

6. Security

We use encryption in transit (HTTPS/TLS), encryption of mailbox tokens at rest, row-level access controls that keep each workspace's data separate, and least-privilege access for our team. No system is perfectly secure, but we work to protect your information and will notify affected users of a security incident as required by law.

7. Your rights and choices

You can view, edit or delete your contacts and account information in the app. To get a copy of your data, or to exercise any other rights you have under applicable law, contact us at support@replybeat.com — including rights to access, correct, delete or port your personal information, and to object to or restrict certain processing. We respond within 30 days.

California residents

Under the California Consumer Privacy Act (CCPA), as amended, California residents may request to know the categories and specific pieces of personal information we collect, to correct or delete it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights. Send requests to support@replybeat.com.

People who receive emails sent with Replybeat

If you received an email sent by one of our customers, that customer is responsible for it and for your information in their contact list. Use the unsubscribe link in the email to stop further messages; we will honor it across that customer's workspace. You can also contact us and we will forward your request to the customer.

8. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information.

9. International users

Replybeat is operated from the United States. If you use the Service from outside the United States, your information will be processed in the United States and other countries where our service providers operate.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account owners by email or in the app before they take effect. The effective date above shows when it was last updated.

11. Contact us

Questions or requests about privacy: support@replybeat.com. See also our Terms of Service.