Reply.io

GDPR overview

Reply publishes a Data Processing Agreement and names GDPR, UK GDPR, CCPA/CPRA and CASL as applicable frameworks. It self-certifies to the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework with the U.S. Department of Commerce, and relies on Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers. ReplyApp Inc. submits to Federal Trade Commission enforcement, and unresolved Framework complaints are referred to BBB National Programs. Data subject rights are exercised at dpo@reply.io, while requests about customer-controlled data are redirected to the relevant customer. Two gaps deserve naming: no EU representative under Article 27 is designated although the publisher is US-based, and no SOC 2 or ISO 27001 certification is claimed anywhere on the site.

Who owns the data?

ReplyApp Inc. states the point plainly: you retain ownership of your data. The company acts as a controller for its own records, meaning account and billing details, website usage, support exchanges, marketing activity and its own Reply Database. It acts as a processor for everything the customer drives, including prospect lists, campaign content, CRM records, mailbox data and AI inputs, where a Data Processing Agreement governs the relationship. Internal access is restricted to authorised personnel bound by confidentiality obligations, and Reply says it does not sell personal information. Aggregated, anonymised or de-identified data may still be reused by Reply for analytics, benchmarking, security and product improvement.

Reuse rights

Customers may use, export and reuse their own data without asking Reply for permission; for that content Reply acts on customer instructions rather than on its own account. Reply itself uses the data to run and secure the service, operate campaigns and mailbox infrastructure, power AI features, monitor deliverability and abuse, and improve the product. AI inputs may pass through unnamed third-party AI providers, which are contractually required not to use that content for generalised model training. Reply makes the same commitment for itself, except where expressly agreed in writing. Aggregated and de-identified data may be reused freely by Reply. One point deserves attention: the Reply Database may infer a company email format when no direct address is available.

Data retention & training

Hosting summary

Reply processes and stores data in the United States and in other jurisdictions where the company, its affiliates, subprocessors, service providers, AI providers or infrastructure providers operate. No country other than the United States is named, and no European data residency option is offered. The infrastructure is described only as cloud-based; no hosting provider is identified. Cross-border transfers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks. Data in transit is protected with SSL/TLS, and personal information processed on behalf of customers is encrypted at the database level. One caveat for anyone checking independently: the domain resolves to a Cloudflare anycast address, which reveals nothing about where the origin servers actually sit.