Privacy Policy

The data controller is ReplyMama, [To be confirmed before launch: legal entity name and registered address]. Contact for any privacy question or request: hello@replymama.com.

• Account data. Your name, email address, and, if you sign in with Google, the basic profile Google returns for that scope. We store a hashed password if you use email sign-in. Lawful basis: performance of our contract with you.
• Workspace and billing data. Workspace name, plan, subscription status, and period dates, and identifiers issued by our payment processor. We do not receive or store your full card number; Dodo Payments handles payment details.
• Outreach data. Campaigns, sequences, message templates, and the lead records you import: names, job titles, companies, profile URLs and any notes or tags you add. This is the working data of the Service.
• LinkedIn conversation content. When the desktop application syncs your inbox, the message bodies, the other participant’s name and headline, and the timestamps are stored in our database so the dashboard can show your inbox and so replies can stop a sequence.
• Action logs. Records of what the Service attempted and what happened (for example “connection request sent”, “failed”), which we use for the analytics page, for diagnosing failures, and for safety pacing.
• Desktop pairing data. An API key stored as a hash, not the key itself, plus a device label and last-seen time.
• Error reports. If the desktop application reports a failure, we store the error detail, the app version and the platform to fix the bug.

We do not buy contact lists, we do not enrich your data from third-party brokers, and we do not use your outreach data to train machine-learning models.

The browser interactions with LinkedIn are performed locally by the desktop application using a session you created. Your LinkedIn password is never sent to us, and the browser profile (cookies and session state) lives on your machine. We never receive your LinkedIn credentials.

The dashboard itself is served from our infrastructure, so the data listed in section 2 is stored on our servers rather than only on your Mac.

• Dodo Payments: payment processing and merchant of record. Receives your billing details directly.
• Google: only if you choose to sign in with Google, for authentication.
• OpenAI: the AI reply drafting feature sends the relevant conversation messages and lead context to an OpenAI-compatible API to generate a suggested draft. That content leaves our infrastructure for this purpose. If you never use AI drafting, no content is sent. AI drafting is a paid-plan feature.
• Hosting and database providers: the infrastructure that runs the dashboard and stores the database. [To be confirmed before launch: the specific hosting and database providers and their regions]

We do not sell your personal data, and we do not share it for advertising.

• Outreach data, conversations and action logs: for as long as your account is active.
• After you delete your account: removed from the live database, then cleared from encrypted backups on our normal backup rotation.
• Billing records: kept as long as tax and accounting law requires, even after account deletion.
• Error reports: kept for a limited period for debugging, then deleted.

You can delete leads, conversations and campaigns yourself at any time from the dashboard. Deleting your workspace removes the associated outreach data.

Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your personal data, and to object to processing or withdraw consent. To exercise any of these, email hello@replymama.com. We will respond within the period required by applicable law.

You can export your contacts as CSV from the dashboard. If you need a fuller export, ask us and we will provide one.

If you are in the EU or UK, you also have the right to complain to your local data protection authority. If you are in California, you have rights under the CCPA/CPRA including the right to know and the right to delete; we do not sell personal information as defined by that law.

Our providers may process data outside your country, including in the United States. Where we transfer personal data out of the UK, EEA or Switzerland, we rely on appropriate safeguards such as the standard contractual clauses offered by those providers. [To be confirmed before launch: the exact transfer mechanism and data residency]

Passwords are hashed, desktop API keys are stored only as hashes, and access to workspace data is scoped to the signed-in user’s workspace on every request. No system is perfectly secure; we cannot guarantee absolute security, and you should use a unique password and protect your Mac.

The Service is for business use by adults. It is not directed at anyone under 18 and we do not knowingly collect their data.

If we make a material change we will update the date at the top and, where the change is significant, tell you by email or in the dashboard before it takes effect.

Privacy questions and requests: hello@replymama.com. See also our Terms of Service.