PRIVACY POLICY
Last updated: May 2026
Who we are
ReplyPath is an AI-powered email automation service for trade businesses, operated by David Mitchell. For all privacy matters, contact us at hello@replypath.co.uk.
What data we collect
Client data (businesses using ReplyPath):
- Business name, contact name, phone number, and website
- Two email addresses: one monitored inbox and one notification address
- OAuth credentials (Google or Microsoft) to access and send from your monitored inbox
- Subscription and billing information (payment data is handled entirely by Stripe and is never stored on our servers)
Lead data (enquiries received through your connected inbox):
- Name, email address, phone number, and postcode
- Project details provided in email enquiries (e.g. loft height, conversion type)
- Email content relevant to the enquiry
How we use your data
We use client data to:
- Provide and operate the ReplyPath service
- Send notifications when leads are ready to quote
- Manage your subscription and account
We use lead data to:
- Extract and store enquiry information on your behalf
- Generate automated replies to your leads
- Present lead details in your dashboard
We do not sell, rent, or share your data with third parties for marketing purposes.
Where your data is stored
All data is stored on secure servers provided by Hetzner, located in Helsinki, Finland (European Union). This means your data is protected under EU data protection law (GDPR).
Third parties we work with
- Google / Microsoft — OAuth access to read and send emails on your behalf. Governed by their respective privacy policies.
- Stripe — Payment processing. ReplyPath never stores card or banking details. Stripe's privacy policy applies to all payment data.
- Vercel — Hosts our public landing page only. No client or lead data passes through Vercel.
Data retention
- Active client accounts: data is retained for the duration of your subscription
- Cancelled accounts: all client and associated lead data is permanently deleted within 90 days of account closure
- Backups: purged within 30 days of the deletion of the primary data
You may request early deletion of your data at any time by emailing hello@replypath.co.uk.
Your rights under GDPR
As a data subject, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict processing of your data
- Data portability
To exercise any of these rights, email hello@replypath.co.uk. We will respond within 30 days.
Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), OAuth token storage, and access controls on our servers.
Changes to this policy
We may update this policy from time to time. We will notify active clients of any significant changes by email.
Contact
For any privacy-related questions or requests:
Email: hello@replypath.co.uk