When you create, access, or use a ReplyFlux account, we may collect:

• Email address
• Authentication identifiers and session tokens
• Account creation date
• Sign-in activity
• Basic account and profile information you provide

We use Supabase for authentication and account management.

When you initiate a ReplyFlux feature, such as generating or refining an email, asking a question, performing a lookup, or importing contacts, we may process:

• Instructions, prompts, and refinement requests you enter
• Email thread content you choose to analyze, including subject lines, message bodies, and quoted text visible in the relevant compose or reading context
• Names, email addresses, and other recipient or contact information contained in that context
• Preferences you select, such as tone, email type, or mode
• Other content you intentionally provide to the Service

ReplyFlux processes email context when you initiate a relevant feature. We do not continuously scan or create a complete background archive of your mailbox. Draft text and the text of a reply you send may be stored so the product can show that activity. That stored text is deleted about 30 days after it is saved, and also when you delete your account.

If you connect a third-party service, we may store OAuth or similar connection information necessary to maintain the connection, including:

• Access tokens
• Refresh tokens
• Token expiration information
• Connected account identifiers
• Organization, tenant, or instance identifiers where applicable
• Other basic connection metadata required by the provider

Connected integrations may include CRM platforms such as Salesforce, HubSpot, Pipedrive, Zoho CRM, and Attio, calendar services such as Google Calendar and Microsoft Outlook, and scheduling services such as Calendly.

The Salesforce connection uses the provider scope that can read and write records. ReplyFlux uses connected CRM data to match an email thread and to fill a draft. You can disconnect a CRM from Connections in the app.

We do not store passwords for those third-party services.

When you use a feature that requires connected data, ReplyFlux may retrieve permitted CRM, calendar, or other integration data to provide context, perform lookups, and generate requested outputs. The information available to ReplyFlux depends on the services you connect and the permissions you approve.

If you use contact import, lookup, or history features, we may process or store:

• Contact information imported from connected CRMs or provided by you
• Timeline or history events associated with saved contacts
• Search queries you run within ReplyFlux contact features
• Other contact information necessary to provide features you request

We collect limited usage and technical information necessary to operate, secure, troubleshoot, and enforce limits for the Service, such as:

• Daily or plan-based usage counts
• Error and diagnostic information
• IP address
• Browser, extension, application, or device version information
• Request timestamps
• Request and performance metadata

Application-level logs are designed to contain limited metadata and truncated diagnostic information rather than full email or CRM content.

The ReplyFlux Chrome extension and Outlook add-in may store certain information locally in order to operate, including:

• Authentication session information
• User preferences
• Contacts or contact history you choose to save where supported
• Short-lived cached draft, interface, and CRM context information necessary to render or operate the Outlook task pane

ReplyFlux does not intentionally maintain a complete copy of your mailbox or CRM database in browser or task-pane local storage. Locally stored context is limited to information used for recently accessed or generated features.

If you purchase a paid ReplyFlux subscription, Stripe processes payment information on our behalf.

We may receive billing-related information such as:

• Billing email
• Subscription status
• Billing country or address
• Tax information you provide
• Payment status and related transaction metadata

TKH Digital does not store full payment-card numbers.

The ReplyFlux website and web app use cookies or similar browser storage necessary for authentication, security, preferences, and operation of the Service.

We do not use third-party advertising pixels or advertising cookies on replyflux.io.

We use service providers to operate ReplyFlux, including:

• Supabase for authentication, hosting, database functionality, and server-side infrastructure
• Stripe for payment processing and subscription billing
• OpenRouter and underlying AI inference providers for requested AI functionality
• Infrastructure, hosting, security, and logging providers necessary to operate and protect the Service

These providers may process information on our behalf as necessary to perform their services.

When you connect Google, Microsoft, CRM, calendar, or other third-party integrations, information may flow between ReplyFlux and those providers according to the permissions and functionality you authorize.

Your use of those third-party services remains subject to their terms and privacy policies.

We may disclose information where we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Enforce our Terms of Service
• Protect the rights, property, or safety of TKH Digital, our users, or others
• Investigate, detect, prevent, or address fraud, abuse, security incidents, or technical problems

If TKH Digital is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction to the extent permitted by applicable law and applicable platform policies.

Where applicable law or a platform policy requires notice or consent before a transfer, we will provide the required notice or obtain the required consent.

We do not sell or share personal information for cross-context behavioral advertising.

You may:

• Access information associated with your account
• Correct inaccurate account information
• Disconnect third-party integrations
• Delete your account through Settings → Delete Account in the ReplyFlux web app
• Contact us to request assistance with access, correction, or deletion
• Withdraw consent where processing is based on consent, without affecting processing that occurred before withdrawal

The in-product account-deletion process removes connected integrations, cached data, saved contacts, stored draft and sent text, and the applicable authentication record, subject to information we are legally permitted or required to retain. Downgrading a plan does not run that deletion.

For requests not available directly in-product, email support@replyflux.io with the subject “Privacy Request.”

We may take reasonable steps to verify your identity before fulfilling a privacy request.

Where the GDPR, UK GDPR, or similar law applies, you may have rights including:

• Access
• Correction
• Deletion
• Restriction of processing
• Objection to certain processing
• Data portability
• Withdrawal of consent where consent is the applicable legal basis
• The right to lodge a complaint with an applicable supervisory authority

Depending on the activity, our legal bases may include:

• Performance of a contract: to provide functionality you request
• Legitimate interests: to operate, secure, troubleshoot, and improve the Service where those interests are not overridden by your rights
• Consent: where consent is required for an integration or optional feature
• Legal obligations: where processing is necessary to comply with law

ReplyFlux does not make solely automated decisions that produce legal or similarly significant effects about you without appropriate human involvement.

California residents may have rights under applicable California privacy law, including rights to:

• Know or access personal information collected about them
• Request deletion, subject to applicable exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing where applicable
• Limit certain uses of sensitive personal information where applicable
• Receive equal service and pricing when exercising privacy rights

ReplyFlux does not sell personal information or share personal information for cross-context behavioral advertising.

Categories of personal information we may collect include:

• Identifiers, such as email addresses
• Commercial information, such as subscription and payment status
• Internet or network activity information, such as technical logs
• Professional or employment-related information contained in CRM context you connect
• Communications and other content you submit for processing

Sources include you, connected integrations you authorize, payment providers, and automatic technical collection.

We use these categories for the purposes described in this Privacy Policy.

To submit a California privacy request, email support@replyflux.io with the subject “California Privacy Request.”

Where required, we will verify requests. Authorized agents may submit requests where permitted by law and with appropriate authorization.