RepEdge.ai

GDPR overview

RepEdge.ai never claims GDPR compliance. The regulation appears once across the pages reviewed, in section 9 of the terms, and it appears as the customer's duty: the customer must comply with PIPEDA, GDPR and CCPA when using call recordings, obtain recording consent, inform every party, and respect one-party and two-party consent laws in its own jurisdiction. On the vendor's side, section 6 of the privacy policy grants access, correction, deletion, portability and marketing opt-out rights, exercised through privacy@repedge.ai, and deleting an account removes the associated data within 30 days. Section 10 acknowledges international transfers under appropriate safeguards but names neither a mechanism nor a country. No Article 27 EU representative is designated, no data protection officer is named, and no DPA is published or offered on request. Governing law is Ontario, Canada.

Who owns the data?

Section 8.2 of the terms leaves ownership of call recordings and other uploaded content with the customer, a point the homepage restates as Your org owns call data. In exchange, RepEdge.ai takes a licence to store, process and analyse that content, to generate transcripts and insights from it, and to use aggregated, anonymised data to improve its own AI models. Section 8.3 splits the outcome: the vendor keeps its models and methodologies, while the customer owns the specific insights produced from its own calls. Export and deletion are offered at any time, and the customer must warrant it holds the rights to everything it uploads.

Reuse rights

The customer can reuse what the platform produces from its own calls without asking permission: section 8.3 of the terms assigns the specific insights generated from customer content to the customer, and the product is built to push transcripts, scores and coaching notes onward into Salesforce and HubSpot records, Slack channels, Notion pages or Asana and Trello tasks. Section 6 of the privacy policy adds a portability right, allowing a copy of the data in a portable format on request. On the vendor's side, use is limited to providing and improving the service, analysing calls, generating AI feedback, CRM integration, service communications, support, security and legal obligations. Personal information is not sold. Sharing is confined to four cases: named service providers such as Supabase, Backblaze B2 and Anthropic, legal requirements, business transfers, and explicit consent. Section 8.2 also reserves the right to use aggregated, anonymised data to improve RepEdge.ai's own models, and no opt-out from that is documented anywhere on the site.

Data retention & training

Hosting summary

The privacy policy names the infrastructure but not the jurisdiction. Data sits in Supabase for the database layer and Backblaze B2 for file storage, encrypted in transit with TLS 1.2 or higher and encrypted at rest with what the vendor describes as industry-standard encryption. Stated controls include secure authentication and authorisation, regular security audits, access controls and monitoring, and authenticated API endpoints. No hosting country and no hosting region are named anywhere on the pages reviewed. Section 10 of the privacy policy acknowledges that information may be transferred to and processed in countries other than the user's country of residence, under appropriate safeguards that are never specified: no standard contractual clauses, no adequacy decision, no country list. The third parties named across the site as handling data are Supabase, Backblaze B2, Anthropic, Deepgram, Zoom, Salesforce and HubSpot. As a separate observation, the marketing site itself resolves to an address geolocated in the United States on Amazon infrastructure, which is a network measurement rather than a vendor statement about where call data lives.