Data processing terms

The controller is the business customer acting through the authenticated Repli account. The accepting person confirms authority to act for the business. The processor is FARMERMARKET spółka z ograniczoną odpowiedzialnością, Aleje Jerozolimskie 109/70, 02-011 Warszawa, Poland, KRS 0001238272, NIP 7011311204; contact: contact@getrepli.app.

These terms cover personal data in reviews, replies, drafts and manager context notes handled on the customer's behalf. They do not govern the provider's own purposes for accounts, billing and security described in the privacy policy. They do not cover Repli using reviews for its own public demo or model training. If the customer itself acts as a processor, processing may start only after confirming its controller's authorisation and appropriate subprocessing terms.

Processing serves only the requested service: importing, organising and assessing reviews, preparing and storing reply drafts, handling customer instructions and securely ending processing. Annex A sets out details and duration. Acceptance of the agreement, configuration of permitted features and authorised customer requests constitute documented instructions. They do not authorise arbitrary new purposes, model training or independent publication of replies.

Repli processes data only on those instructions, including for transfers, unless required by EU or Member State law. In that case it informs the customer beforehand unless prohibited by law. It promptly informs the customer if it considers an instruction to infringe data protection law and suspends the disputed operation pending clarification. The customer is responsible for its purposes, legal bases and transparency obligations. This does not relieve Repli of its own obligations.

Access is limited to people who need it to operate the service and are bound by confidentiality commitments or an appropriate statutory duty. Repli implements measures appropriate to risk under GDPR Article 32, described in Annex B, and regularly assesses their effectiveness. Changes must not materially reduce protection.

The customer gives general written authorisation for subprocessing only by the entities and within the scope listed in Annex C. Repli gives advance email notice of an intended addition or replacement, allowing appropriate time and stating the planned change date. Before that date the customer may raise a reasoned data protection objection. The parties seek a solution; Repli does not disclose that customer's data to the new subprocessor pending agreement. If no solution is available, the customer may end the affected service, with charges and any refund settled under the main agreement and applicable law.

Repli imposes appropriate data protection obligations on subprocessors and remains responsible to the customer for their performance. Transfers outside the EEA require compliance with GDPR Chapter V; recipients, countries and applicable mechanisms are specified in Annex C. Subprocessor authorisation alone is not a transfer mechanism. On request the customer receives information about safeguards and a copy, protecting others' confidential information.

Taking account of the processing and available information, Repli assists the customer with individual rights and obligations under GDPR Articles 32–36, including impact assessments and supervisory consultation. It promptly forwards requests relating to entrusted data to the customer and does not decide them independently unless properly instructed or legally required.

Repli informs the customer of a personal data breach affecting entrusted data without undue delay. It provides available information about its nature, scope, consequences and remedial measures and supplements this as findings develop, without waiting for a completed investigation. It assists with mitigation and required notifications. Operational contacts are contact@getrepli.app and the customer's contact in the agreement.

When processing ends, at the customer's choice Repli returns or deletes entrusted data and deletes existing copies unless EU or Member State law requires retention. The customer may request return through Contact before instructing irreversible deletion. Annex A specifies the operational scope, method and periods. Deletion in Repli does not delete original reviews or the Google Business Profile.

Data temporarily remaining in backups is protected and excluded from routine use until expiry; restored data is deleted again before service resumes. The necessary minimal deletion ledger is subject to purpose, access and retention limits. Data the provider processes as controller for its own legal duties is assessed separately; this does not authorise retaining all review and draft content.

Repli provides information necessary to demonstrate compliance with GDPR Article 28, allows audits including inspections by the customer or its authorised auditor, and contributes to them. The parties arrange proportionate scope, confidentiality and security; documentation may be the first step but does not exclude a necessary inspection or supervisory powers. Ordinary scheduling periods must not obstruct urgent circumstances.

These terms prevail over conflicting main terms concerning entrusted data processing. They do not exclude mandatory rights of either party or data subjects. They are accepted electronically with the main agreement; the confirmation identifies the parties and accepted version.

Individuals: review authors and other people whose necessary data lawfully appears in the content. Data: text, rating, dates, public author name and source identifiers, previous replies; drafts, approvals, style and necessary context. Operations: collection, storage, organisation, assessment, draft creation, access for the authorised customer, return and deletion. Duration: service provision and necessary completion of processing, with earlier source-cache expiry under Google’s rules.

Request data return through Contact before irreversible deletion; following entitlement verification, we provide a readable electronic format via an agreed secure channel. Application deletion starts immediately, targeting 24 hours with retries after failure. Our own regular backups are not configured; provider backups follow documented provider terms. We do not declare an unconditional common 30-day period for all copies. A minimal deletion ledger serves only retries and restoration protection; its 90-day target may need necessary extension for unfinished operations.

Special-category and criminal-conviction data are not the intended service scope. Do not include them in notes. If present in a review, minimise the content and do not request AI processing of that portion without a suitable basis and safeguards established with the controller; contact us for restriction or deletion. A review being public does not establish lawfulness for every piece of data in it.

Account authentication and reauthentication for deletion; owner-based resource authorisation, customer-data isolation and least privilege; encrypted connections and Google tokens; restricted personnel access and confidentiality; request limits and controls; updates and incident handling. AI uses ZDR routing restrictions subject to relevant provider-policy exceptions; this does not guarantee EU-only processing.

A durable deletion ledger is separate from the application database so deletion can be repeated before restored data is exposed. We do not claim configured regular backups of our own or security certifications. Measures are assessed according to risk and we provide information needed for verification under the audit provisions.

The customer authorises: OVHcloud for server hosting in Warsaw; Supabase for database and authentication, with the primary database in Ireland (eu-west-1); Vercel Inc. for AI Gateway and its downstream model providers, including TypeSafe AI and OpenAI, for review assessment and drafts. AI receives necessary text, rating, context, style and prior replies, without passwords or Google tokens. In particular the TypeSafe AI/Jev route involves the US.

Terms and subprocessor lists: OVHcloud at ovhcloud.com/en/personal-data-protection/; Supabase at supabase.com/legal/customer-resources/data-processing-addendum and its linked list; Vercel at vercel.com/legal/dpa and security.vercel.com. Those terms identify the relevant contracting and downstream entities. Transfers outside the EEA require applicable adequacy or standard contractual clauses and any necessary supplementary safeguards; details and copies are available through Contact. List changes do not remove this agreement’s prior-notice and objection obligations.

Google supplies review-source data and separately authorised customer-account functions. Billing, email, consent and analytics providers receive data as described in the privacy policy; this is not general authorisation to send review content to them for arbitrary purposes.