Privacy Policy

1. Introduction

This Privacy Policy explains how Autodeus Technologies Private Limited (“Reepl”, “we”, “us”, or “our”), the operator of reepl.io and app.reepl.io, collects, uses, discloses, and protects personal data when you use our services.

We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and all other applicable data protection legislation.

If you have any questions about this policy or our privacy practices, please contact us at the details in Section 14.

2. Who We Are

For the purposes of applicable data protection law, the data controller is:

Corporate Identity Number (CIN): U72900GJ2017PTC098295
Email: privacy@reepl.io

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Account Data

When you create an account or sign in, we collect:

• Full name and email address
• Profile photograph (where provided)
• Password credentials (stored in encrypted form; we never have access to your plaintext password)
• Account preferences and language settings
• Date of account creation and last login timestamp

3.2 LinkedIn® and Social Media Data

When you connect a LinkedIn® account or other social media platform to Reepl, we collect and process the data you expressly authorise us to access via those platforms’ official APIs, which may include:

• Your public profile information (name, headline, profile image, job title)
• Content you have published, such as posts and articles
• Engagement activity you choose to import (such as comments or reactions), where enabled by you in your privacy settings
• Account identifiers required to authenticate your connection

We only access the specific permissions you grant. You can revoke this access at any time by disconnecting the integration from within Reepl or directly through the respective platform.

3.3 Content Data

Data you create or upload while using Reepl, including:

• Post drafts, templates, and scheduled content
• Carousel designs and media assets
• Comments, notes, and content ideas
• Brand kit settings and voice profile configurations

3.4 Subscription and Billing Data

When you purchase a subscription, we collect:

• Subscription plan and billing cycle
• Payment status and transaction identifiers

We do not store full payment card details. Card processing is handled by our third-party payment processor, which is responsible for the security of your payment information under its own privacy policy and applicable PCI DSS obligations.

3.5 Usage and Technical Data

We collect technical data about how you interact with our services, including:

• IP address and approximate geographic location (country/region level)
• Browser type, version, and operating system
• Pages visited, features used, and actions taken within the application
• Session duration and usage frequency
• Error logs and performance data

3.6 Cookie and Tracking Data

We use cookies and similar technologies as described in Section 10 below.

3.7 Support and Communications Data

When you contact us for support or otherwise communicate with us, we retain records of that correspondence, including your contact details and the content of your messages.

3.8 Browser Extension Data

The Reepl browser extension for Chrome and Edge runs on linkedin.com, x.com and twitter.com. This section explains what it reads on those pages, what it sends to Reepl, and what it keeps in your browser.

When you ask for a draft. The extension reads content only for the draft you request:

• On LinkedIn®: the post you are commenting on (its text, images, and the author’s name, headline and profile link), the comment thread you are replying in, or the message conversation you have open together with the other person’s name and the profile details shown for them (such as headline, location and company).
• On X: the post and the earlier posts in the thread you are replying to (author names, handles and text), or the X chat you have open: up to the last 20 messages as text, with the names shown in the conversation. For links shared in a chat we read the visible title and only the web address up to the end of its path, never anything after a question mark or hash symbol. Images, videos and other media are not read.
• The style or instruction you choose or type for the draft.

We send this content to Reepl’s servers with your sign-in so that we can create the draft. Our servers pass it to an AI language model provider acting on our behalf (see Section 5.1) and stream the draft back to you. We do not store the content the extension read to write a draft, or the draft itself. We keep only a record that a draft was made, such as the date, the feature used and the credits used, to manage your plan and limits. If you have connected your own AI provider key, the content is sent to that provider under your own agreement with it.

When you send something on LinkedIn®. When you click Comment, Send or Post on LinkedIn®, or press Enter to send a message, the extension sends the text you are sending to Reepl. This happens whether or not Reepl helped write it. It is sent together with who it is for: the post author’s or message recipient’s name and LinkedIn® profile ID, and for messages their photo link. We use it to count your activity for your streak and statistics, to show your activity with a contact in Reepl, and to save the posts you publish or schedule from the LinkedIn® post box in your Reepl account. The text of comments and messages you send is kept in your Reepl account for as long as the account exists. If you have connected an integration that uses this activity, such as a CRM, the comment or message text and the contact’s details may be passed to that integration for the workflows you set up.

LinkedIn® statistics. While you are signed in and have your LinkedIn® home feed open, the extension reads the two numbers LinkedIn® shows for profile viewers and post impressions and sends them to Reepl, at most about once a day or when they change, to show your statistics.

While you type. To offer the “/” menu, the extension checks, in your browser, whether what you type in LinkedIn® message and comment boxes and in X reply and chat boxes starts with “/”. Nothing is sent to Reepl unless you pick a menu item.

The Reepl assistant and other sidebar tools. Messages you send to the Reepl assistant in the sidebar, and files you attach, are sent to Reepl and processed by AI providers to answer you. The assistant keeps a short-term record of each request while it works, for up to seven days, and may save short facts you tell it so it can help in later chats. Posts you write in the sidebar editor are saved as drafts in your Reepl account and published or scheduled to LinkedIn® through the connection you set up. If you open the Post Grader in the Reepl tools site, the text you are scoring (up to 2,000 characters) is passed to that site in the web address. Voice dictation uses your browser’s speech recognition service; Reepl receives only the resulting text.

What stays in your browser. The extension stores in your browser: your sign-in tokens (in the extension’s synced storage, which your browser may sync across your devices), your account details (name, email, plan and LinkedIn® link), your settings and prompt library, your recent assistant chats (up to 50), short-term records of the instruction and last generated comment for each comment or message box (kept up to seven days), and your post drafts. Signing out clears your sign-in tokens, account details and preferences. Removing the extension clears everything it stored.

If you uninstall. When you uninstall the extension, your browser opens a Reepl web page whose address contains your email and your Reepl user ID, so that we can recognise your account on that page.

Your control. Reepl never sends a comment, reply or message for you: drafts appear in the box on the page and you decide whether to edit and send them. You can stop the extension at any time by disabling or removing it in your browser’s extension settings (chrome://extensions or edge://extensions), and you can delete your Reepl account as described in Section 8.

4. How We Use Your Data

We use personal data for the following purposes, each grounded in a lawful basis under Article 6 GDPR:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests. You may object to processing based on legitimate interests at any time (see Section 9).

Where we rely on consent (for example, for analytics cookies and session recording), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. You can manage your consent preferences in Settings > Data and Privacy within the app, or via our cookie consent banner.

5. Sharing Your Data

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

5.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process data strictly on our behalf and under our instructions, under written data processing agreements. These include providers of:

• Cloud infrastructure and hosting services
• Authentication and identity management
• Payment processing
• Transactional and marketing email delivery
• Analytics and session recording (subject to your consent)
• Artificial intelligence and language model services (for AI-assisted features)
• Customer support tooling

For the browser extension, the content described in Section 3.8 is processed by AI language model providers acting on our behalf. We currently use Microsoft Azure OpenAI as our main provider, and Cloudflare Workers AI as a fallback for LinkedIn® comment and message drafts. If you choose another model or connect your own key, the content goes to that provider instead (for example OpenAI, Anthropic or Google).

We maintain an up-to-date list of our sub-processors. If you would like to request this list, please contact us at the address in Section 14.

5.2 Social Media Platforms

Where you connect a third-party platform (such as X/Twitter), data is transmitted to and from that platform in accordance with the permissions you have granted and the platform’s own terms and privacy policy.

5.3 Legal and Regulatory Disclosure

We may disclose personal data if required to do so by law, court order, or at the request of a competent regulatory authority, or where we reasonably believe such disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a material portion of our assets, personal data may be transferred to the acquirer, subject to the same protections described in this policy.

6. International Data Transfers

Our primary infrastructure is located within the European Economic Area (EEA). Where we engage service providers established outside the EEA, including in the United States, we rely on one or more of the following transfer mechanisms to ensure an adequate level of protection:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules where applicable

If you would like further information about the specific safeguards in place for any particular transfer, please contact us.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

When you request deletion of your account, we initiate a soft deletion immediately and complete permanent deletion of your personal data within 30 days of the request, subject to any legal hold obligations. Once permanently deleted, your data cannot be recovered.

8. Account Deletion and the Right to Erasure

You may delete your account at any time from Settings > Account > Delete Account.

Please be aware that upon submitting a deletion request:

• Your account will be immediately deactivated. You will not be able to log back in once the request is submitted.
• You will not be able to create a new account using the same email address. This restriction exists to protect the integrity of our free trial programme.
• All personal data will be permanently deleted within 30 days of your request.
• If you have an active paid subscription, it will be cancelled at the end of the current billing period. You will retain access to paid features until the period ends.

If you believe your deletion request was submitted in error, please contact our support team as soon as possible. Recovery may be possible during the initial period before permanent deletion is executed.

9. Your Rights Under GDPR

Subject to applicable law and certain exceptions, you have the following rights in respect of your personal data:

• Right of access (Article 15): You may request a copy of the personal data we hold about you and information about how we use it.
• Right to rectification (Article 16): You may request that we correct any inaccurate or incomplete personal data we hold about you. Most account data can be updated directly within the app.
• Right to erasure (Article 17): You may request the deletion of your personal data where there is no compelling reason for us to continue processing it. You can exercise this right directly through the account deletion feature described in Section 8, or by contacting us.
• Right to restriction of processing (Article 18): You may request that we restrict processing of your personal data in certain circumstances, for example while you contest its accuracy.
• Right to data portability (Article 20): You may request that we provide your personal data in a structured, commonly used, machine-readable format, or transmit it to another controller where technically feasible.
• Right to object (Article 21): You may object at any time to processing of your personal data based on legitimate interests, including profiling. You may also object to processing for direct marketing purposes at any time.
• Right to withdraw consent (Article 7(3)): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights related to automated decision-making (Article 22): We do not make solely automated decisions that produce legal or similarly significant effects on you. AI-assisted features generate suggestions only; all publishing and content decisions remain with you.

To exercise any of these rights, please contact us at the address in Section 14. We will respond within one calendar month of receiving a verifiable request. In complex cases, we may extend this period by a further two months and will inform you accordingly.

We may need to verify your identity before processing a request. We will not charge a fee for reasonable requests.

10. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens and security cookies. These cannot be declined.
• Analytics and performance cookies: Help us understand how users interact with the service, which features are most used, and where improvements are needed. These include session recording tools. These are only activated with your consent.
• Marketing cookies: Help us measure the effectiveness of our campaigns and show relevant content across the web. These are only activated with your consent.

For a full list of the individual cookies we and our providers set, their purpose, and how long they last, see our Cookie Policy.

You can manage your cookie preferences through the cookie consent banner displayed on your first visit to the platform, or at any time via Settings > Data and Privacy in the app.

For information on how to control cookies at the browser level, please refer to your browser’s help documentation.

11. Children’s Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

12. Security

We implement technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption of data in transit and at rest, access controls, and regular security reviews.

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, affected individuals without undue delay.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and notify you by email or through a prominent in-app notification.

Your continued use of Reepl after the effective date of an updated policy constitutes acceptance of the revised terms.

14. Contact Us and Complaints

Data protection enquiries and rights requests:
Email: privacy@reepl.io

Postal address:

We aim to respond to all requests within 30 days.

Complaints:
If you are not satisfied with how we handle your personal data or respond to your request, you have the right to lodge a complaint with your local data protection supervisory authority. In the European Union, you may find your national authority at edpb.europa.eu. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO) at ico.org.uk.

This policy was prepared in accordance with the requirements of Regulation (EU) 2016/679 (GDPR) and the UK GDPR.