Replii Privacy Policy

Effective Date: September 15, 2026

Replii Inc. (“Replii,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information and business data entrusted to our services.

This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use the Replii website, CRM, communications tools, AI-assisted features, integrations, and related services.

By using Replii, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

Depending on how you use Replii, we may collect the following information.

Personal and Business Information

This may include:

• Name

• Email address

• Phone number

• Business or company information

• Customer or lead information entered into the CRM

• Information voluntarily submitted through forms, messages, integrations, or other Replii features

Usage and Technical Information

We may collect information such as:

• IP address

• Browser type and version

• Device information

• Pages, features, and functions used within Replii

• Security, authentication, and system activity necessary to operate and protect the service

Communications and CRM Data

When you use Replii's communications features, we may process information such as:

• Customer and lead communications

• Email messages and email metadata

• SMS messages

• Message sender and recipient information

• Subject lines

• Message bodies

• Timestamps

• Conversation and thread identifiers

• Communication status information, such as unread or reply-needed status

• Files and attachments when supported and explicitly used

Connected Google Account Data

When an authorized user chooses to connect a Google account to Replii, Replii may access Google account and Gmail information necessary to provide the requested CRM email functionality.

Depending on the features enabled, this may include:

• Connected Gmail account identity

• Sender and recipient information

• Email subject lines

• Email message bodies

• Message timestamps

• Gmail thread and message identifiers

• Attachment metadata

• Attachment content when an authorized user requests supported attachment functionality

Replii only accesses a Google account after an authorized user explicitly initiates and completes the Google OAuth authorization process.

2. How We Use Information

We use information to provide and operate Replii, including to:

• Provide CRM and customer communication functionality

• Synchronize authorized customer email conversations into Replii

• Associate communications with the appropriate CRM customer or lead

• Display email conversations and communication history

• Identify unread conversations

• Identify conversations that may require a response

• Allow authorized users to send or reply to email

• Provide customer intelligence, summaries, and relevant CRM context

• Provide AI-assisted drafting and summarization features

• Respond to inquiries and provide support

• Maintain account and business settings

• Monitor service performance and usage

• Detect and prevent misuse, fraud, and unauthorized access

• Maintain security

• Comply with applicable legal obligations

Replii does not use Google Workspace API data to train, develop, or improve generalized or foundation artificial intelligence or machine-learning models.

3. Google Gmail Integration

Replii provides an optional Gmail integration for businesses that choose to connect a Gmail mailbox to their Replii account.

Gmail Read Access

Replii uses Gmail read access to provide a synchronized CRM email inbox.

This allows authorized Replii users to:

• View customer email conversations inside Replii

• View message content necessary to manage customer communications

• Associate incoming email with CRM customers and leads

• Maintain conversation and thread history

• Identify unread customer communications

• Identify conversations that may require a reply

• Use relevant conversation content in authorized customer-intelligence and AI-assisted features

Replii requests read-only Gmail access rather than broader Gmail modification permissions because Replii does not require permission to modify, delete, move, or manage messages in the user's Gmail mailbox for these features.

Gmail Send Access

Replii uses Gmail send access so an authorized user can manually send a new customer email or reply to an existing customer conversation from a Gmail mailbox that the business has explicitly connected.

Email sending is user initiated.

Replii's AI features may generate an editable suggested response, but an AI-generated email draft is not automatically sent. The authorized user reviews the message and chooses whether to send it.

Replii does not request broader Gmail modification permissions solely for sending email.

4. Google API Services User Data — Limited Use

Replii's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace API data is used only to provide or improve user-facing features that are prominent and appropriate within Replii.

Replii does not:

• Sell Google user data

• Use Google user data for advertising

• Transfer Google Workspace data for advertising purposes

• Use Google Workspace API data to determine creditworthiness or for lending purposes

• Use Google Workspace API data to train, develop, or improve generalized or foundation AI or machine-learning models

• Allow humans to read Google user data except where necessary for security purposes, legal obligations, support requested by the user, or other circumstances permitted under Google's applicable policies

5. Artificial Intelligence and Third-Party AI Processing

Replii provides optional AI-assisted functionality, including features such as Draft with AI, customer summaries, and AI Memory.

When these features are used, Replii may send relevant customer conversation text and CRM context to a third-party AI service provider in order to generate the requested user-facing result.

OpenAI

Replii currently uses the OpenAI API for certain AI-assisted CRM functions.

Depending on the feature being used, information sent to OpenAI may include:

• Email subject

• Relevant email message body text

• Relevant customer conversation history

• CRM context associated with that customer

This processing is used to provide user-facing functionality such as suggested email drafts and customer conversation summaries.

Replii does not use Google Workspace data to train generalized or foundation AI models.

Email attachment files, attachment binary data, and attachment contents are not provided to Replii's AI email-drafting functionality.

AI-generated email drafts remain subject to user review and are not automatically sent.

Replii may update the AI service providers used by the platform. Material changes affecting the handling of personal information or Google Workspace data will be reflected in this Privacy Policy as appropriate.

6. Data Sharing and Disclosure

Replii does not sell personal information or Google user data.

Information may be disclosed to:

• Cloud infrastructure and service providers necessary to operate Replii

• Authorized third-party processors necessary to provide user-requested functionality

• AI service providers when an authorized AI-assisted feature requires processing

• Legal authorities when required by applicable law, court order, or lawful legal process

• Other parties when explicitly authorized by the user or business

Third-party processors receive information only as necessary to provide the applicable service and are subject to applicable contractual, privacy, and security obligations.

7. Data Security

Replii uses administrative, technical, and organizational safeguards designed to protect information.

These measures include, where applicable:

• Encrypted HTTPS connections

• Server-side OAuth processing

• Encryption of connected email provider credentials

• Role-based access controls

• Business and account isolation

• Controlled access to communication data

• Secure cloud infrastructure

• Authentication and authorization controls

OAuth access and refresh credentials are handled server-side and are not intentionally exposed to users through the Replii browser interface.

No system can guarantee absolute security, but Replii takes reasonable measures designed to protect information against unauthorized access, use, disclosure, alteration, or destruction.

8. Data Retention and Deletion

Replii retains personal information, CRM information, and connected-service data only for as long as reasonably necessary to provide the service, satisfy legitimate business and security requirements, comply with legal obligations, and resolve disputes.

Authorized users or businesses may request deletion of applicable personal information by contacting:

privacy@replii.ca

Where legally and technically applicable, Replii will delete or de-identify information following a valid deletion request, subject to necessary legal, security, backup, fraud-prevention, and recordkeeping requirements.

9. Disconnecting Google and Revoking Access

Users may disconnect a connected Google mailbox from Replii through the applicable Replii integration settings when that functionality is available to their account.

Users may also revoke Replii's Google account access directly through their Google Account security settings.

Revoking Google authorization prevents Replii from obtaining new Google Workspace data using that authorization.

If you would also like previously stored applicable Google-derived data deleted from Replii, contact:

privacy@replii.ca

Revoking Google authorization and requesting deletion of previously stored Replii data are separate actions.

10. Your Privacy Rights

Depending on your location, you may have rights concerning your personal information.

For users in Canada, applicable privacy rights may include rights provided under PIPEDA and other applicable federal or provincial privacy laws.

Subject to applicable law, you may request to:

• Access personal information Replii holds about you

• Correct inaccurate or outdated information

• Withdraw consent where processing is based on consent

• Request deletion of applicable personal information

• Ask questions about how your information is handled

Requests may be sent to:

privacy@replii.ca

11. Cookies and Similar Technologies

Replii may use cookies and similar technologies for authentication, security, site functionality, preferences, and service analytics.

Users may manage certain cookie settings through their browser. Disabling necessary cookies may prevent some Replii functionality from operating correctly.

12. Children's Privacy

Replii is a business-oriented service and is not intended for children under the age of 13.

We do not knowingly collect personal information directly from children under 13 through the Replii service.

13. Third-Party Services

Replii may integrate with third-party platforms and services.

Use of those third-party services may also be governed by their respective privacy policies and terms.

Connecting an integration is optional unless otherwise required for a specific Replii feature.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to Replii, applicable laws, integrations, security practices, or data-processing activities.

When we make changes, we will update the Effective Date at the top of this policy.

Material changes may also be communicated through Replii or other appropriate means.

15. Contact Us

For questions, privacy requests, deletion requests, or concerns about this Privacy Policy or Replii's handling of information, contact:

Replii Inc.
Email: privacy@replii.ca
Website: https://www.replii.ca