1. Information We Collect

ReplogAI collects the following types of information:

Account information: Name, email address, phone number (when you enable text-message capture), and organization details you provide when registering.
Sales activity data: Email contents, call recordings, meeting transcripts, text (SMS) messages, voice memos, and related metadata from your connected integrations (Gmail, Outlook, Zoom, Google Meet, and SMS).
AI-generated data: Summaries, action items, sentiment and discovery scores, risk flags, deal intelligence, drafted proposals, and weekly reports produced from your sales activities.
CRM data: Contact and deal information synced to and from your connected CRM (HubSpot, Salesforce, Pipedrive).
Usage data: How you interact with the service, including feature usage and activity counts.

2. How We Use Your Information

To provide and improve our CRM auto-logging service.
To generate AI-powered sales intelligence (summaries, action items, discovery scores, deal signals).
To draft proposals and leadership reports from your conversations, for your review and approval.
To sync activity data to your connected CRM platforms.
To send communications on your behalf (such as follow-up emails and proposals) only when you direct us to.
To send transactional emails (login links, invitations, notifications).
To process payments and manage your subscription.

3. Audio Recordings & Transcripts

When you connect Zoom, Google Meet, or submit a voice memo, ReplogAI accesses the audio to generate transcripts. Recordings are:

Downloaded temporarily for transcription processing only.
Sent to OpenAI's Whisper API for transcription. OpenAI's data usage policies apply.
Not stored permanently by ReplogAI — only the text transcript is retained.
Subject to your organization's data retention settings (default: 90 days).

4. Third-Party Services

We use the following third-party services to operate ReplogAI:

OpenAI (Whisper): Audio transcription.
Anthropic (Claude): AI-powered data extraction, summarization, and proposal drafting.
Google & Microsoft: Email and calendar access, and sending email on your behalf, via OAuth.
Twilio: Inbound and outbound text (SMS) messaging.
Stripe: Payment processing.
Resend: Transactional email delivery.
Sentry: Error monitoring and diagnostics.

We only share the data each provider needs to perform its function, and never sell your data.

5. Google & Microsoft User Data — Limited Use

ReplogAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our handling of data received from Microsoft Graph APIs follows the equivalent commitments below.

For data accessed through these APIs (including Gmail and Outlook messages and metadata), we specifically commit that:

We limit our use of the data to providing and improving the user-facing features that are prominent in ReplogAI's interface — auto-logging, transcription, summaries, follow-ups, and CRM sync.
We do not transfer the data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition (with notice to you).
We do not use the data for serving advertising, including personalized or retargeted advertising.
We do not allow humans to read the data, except: (a) with your affirmative consent for specific messages; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized for internal operations.
We do not sell the data under any circumstances.

6. Data Security

OAuth tokens and other secrets are encrypted at rest using AES-256-GCM.
All data is transmitted over HTTPS/TLS.
Access to production data is restricted to authorized personnel, logged, and scoped per organization.
Failed CRM syncs are surfaced to you rather than silently dropped.
We follow recognized application-security practices and assess our controls on an ongoing basis.

7. Data Retention & Deletion

You can configure data retention (30, 90, or 365 days) in your organization settings.
You can delete your account and all associated data at any time from Settings.
Disconnecting a Google or Microsoft integration stops further access immediately; we delete the stored tokens and stop collecting from that source.
Upon account deletion, all personal data is permanently removed within 30 days.

See our Data Deletion page for step-by-step instructions, including how to request deletion if you can't access your account.

8. Your Rights (GDPR/CCPA)

Access: You can export your data at any time from Settings.
Deletion: You can delete your account and all data from Settings.
Portability: Your export is provided in a machine-readable format.
Opt-out: You can disconnect integrations and stop data collection at any time.

9. Contact

For privacy inquiries or data-access and deletion requests, contact us at [email protected].

Privacy Policy