Privacy Policy

The controller of personal data is Gabor Grzybek, a natural person conducting business under the name Gabor Grzybek Handel i Usługi, entered in CEIDG, NIP: 6372214433, REGON: 389680743, address: ul. Sosnowa 9/91, 32-310 Klucze, email: hello@replybasis.com (the „Controller").

Service User data: first and last name, email address, password (encrypted), organization name, billing data, the date of acceptance of the terms and consents.

Data processed on the User's behalf: message content and contact data of end customers (e.g. email, phone, platform login, attachments), fetched from connected channels to handle correspondence. In this scope the Controller acts as a processor, and the User as the controller of their customers' data (see § 8, Entrustment of processing).

We process data to: provide the Service and perform the contract (Art. 6(1)(b) GDPR), handle settlements and tax obligations (point c), ensure security, handle complaints and develop the Service under a legitimate interest (point f), and, for marketing communication, on the basis of consent (point a), which can be withdrawn at any time.

Data may be entrusted to trusted processors: the hosting/server provider, the payment operator PayU S.A., the email (SMTP) provider, and providers of connected APIs and AI (including Allegro, Google, Meta, OLX, eBay, Anthropic), solely to the extent necessary for the Service to operate. Channel credentials and keys are stored encrypted (AES-256-GCM). When transferring data outside the EEA we apply standard contractual clauses.

The Service offers an optional AI assistant that suggests reply content. The assistant only supports the User; it does not make decisions toward end customers producing legal effects and does not carry out profiling within the meaning of Art. 22 GDPR. Reply content is always approved by a human.

We keep account and conversation data for the duration of using the Service. After the account is deleted, the Organization's data (users, contacts, conversations, messages, attachments) is deleted promptly, no later than within 30 days. Billing data (invoices, payments) is kept for the period required by tax law (5 years counting from the end of the tax year). Backups are overwritten as part of the backup retention cycle.

You have the right to access your data, rectify it, delete it, restrict processing, port it and object, as well as the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You can exercise the right to data portability and deletion yourself in the panel (Settings, Account, „Export data" / „Delete account"). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

With regard to the data of the User's end customers, the Controller processes it solely on the User's documented instructions, ensures confidentiality, applies security measures (encryption, access control), assists in exercising data subjects' rights, and deletes the data after the service ends. At the User's request we provide a separate data processing agreement (DPA) at hello@replybasis.com.

We use cookies in three categories: essential (maintaining the login session and security, they do not require consent and are always active), analytical (measurement and traffic statistics) and marketing (ad targeting, remarketing).

Analytical and marketing cookies are disabled by default and only activated after consent is given in the banner shown on the first visit. You can change or withdraw your consent at any time using the „Cookie settings" link in the site footer. Withdrawing consent does not affect the lawfulness of processing carried out earlier.

The policy may be updated. The current version is always available in the application at this address; we will inform Users of significant changes by email or in the panel.