Privacy Policy
Last updated: August 1, 2026
ReplyPlex ("ReplyPlex", "we", "us") is an email support platform, a product of Startise LLC, a United States company. It gives support teams shared inboxes: email sent to a team's support addresses becomes conversations that agents read, assign, and reply to. This policy explains what data we process to run the service, how we protect it, and the choices you have. It applies to replyplex.com, the ReplyPlex console at desk.replyplex.com, and our APIs.
ReplyPlex is currently an invite-only service. Questions or requests about anything on this page: support@replyplex.com.
Data we process
Account and workspace data
- Agent accounts: name, email address, optional avatar and job title, sign-in credentials (managed by our authentication provider — we never store your password).
- Workspace configuration: inbox names and addresses, team membership and roles, tags, saved replies, automation rules, and similar settings.
Support conversation data
- Email sent to a workspace's connected support addresses — message content, attachments, sender name and address, and headers — stored so the team can read and answer it.
- Replies and internal notes agents write, and metadata the team adds (status, assignee, tags, custom fields).
- End-customer profiles a workspace maintains: email addresses, name, and any notes or fields the team records.
Technical and usage data
- Server logs and error reports needed to keep the service reliable (see the processor table below).
- Optional, per-inbox: open-tracking for outbound replies, so agents can see whether a reply was viewed. Workspace admins control this per inbox.
How we use data
We use the data above to operate the product: delivering and displaying support conversations, sending the replies your team writes, powering search and reporting inside your workspace, and keeping the service secure and reliable. We do not sell personal data, and we do not use your data for advertising.
Google user data (Gmail-connected mailboxes)
A workspace admin can connect a Gmail or Google Workspace mailbox with "Sign in with Google" so that replies are sent from that mailbox through the Gmail API. Here is exactly what that involves:
- What we request: the Google OAuth scopes
gmail.send(send email on your behalf) andopenid email(the address of the account you connected). We deliberately request no read scope — ReplyPlex cannot read, search, or list anything in the connected mailbox. - What we use it for: sending the support replies and notifications your team composes in ReplyPlex, as the connected mailbox. Nothing else.
- What we store: the connected account's email address and an OAuth refresh token, encrypted at rest (AES-256-GCM). We do not store Gmail message content obtained from Google — the only Gmail-related content we hold is the messages your team writes in ReplyPlex and mail delivered to your support addresses as described above.
- What we share: Google user data is not transferred to third parties, is not used for advertising, and is not used to train AI or machine-learning models. It is sent only to Google's own API to deliver your messages.
- Revoking access: delete the connection in ReplyPlex (Settings → your inbox → Sending), which deletes the stored token — or revoke ReplyPlex from your Google account permissions at any time.
AI features
ReplyPlex includes optional AI assistance (summaries, drafting, classification). These features are dormant until a workspace administrator enables them and supplies their own model-provider key. When an AI feature runs, the relevant conversation content is sent to the model provider the workspace chose (via OpenRouter) to produce the result. Google user data (see above) is never used for AI features. AI usage and spend are visible to workspace admins.
Where data lives — service providers
We use a small set of processors to run ReplyPlex:
| Provider | Purpose |
|---|---|
| Supabase (AWS, Tokyo region) | Primary database, authentication, and attachment storage |
| Cloudflare | Web hosting, inbound email routing, and encrypted off-site backups (R2) |
| Dedicated API server | Application API and background processing |
| Email delivery providers (toSend/AWS SES, Postmark, Mailgun, Resend, Cloudflare Email — per workspace configuration) | Delivering outbound replies; receiving inbound mail |
| Google (Gmail API) | Sending from Gmail-connected mailboxes only (see the Google section) |
| OpenRouter + the workspace's chosen model provider | Optional AI features, only when enabled by the workspace |
| Sentry | Error monitoring |
| Better Stack | Uptime monitoring and status alerts |
Retention and deletion
Workspace data is retained while the workspace is active. Deleting a conversation, a connection, or a workspace removes the corresponding data from the live system; encrypted backups expire on a rolling schedule. To request deletion of your data — including an entire workspace — contact support@replyplex.com.
Security
- All traffic is encrypted in transit (TLS).
- Provider credentials and OAuth tokens are encrypted at rest (AES-256-GCM).
- Database access is protected with row-level security; workspaces are strictly isolated from each other.
- Off-site backups are encrypted before leaving the database host.
- Access to production systems is limited to the small team operating the service.
Your rights
You can request access to, correction of, or deletion of your personal data by emailing support@replyplex.com. If you are an end customer whose email was handled by a team using ReplyPlex, the team you wrote to controls that workspace's data — we will route your request to them or act on their instruction.
Cookies
The ReplyPlex console uses cookies and browser storage strictly for signing you in and keeping your session. We do not use advertising or cross-site tracking cookies.
Changes to this policy
We will update this page when our practices change, and update the date at the top. For material changes affecting Google user data or workspace content, we will notify workspace admins by email.