Effective Date: April 2, 2026 · Last Updated: April 2, 2026
Summary: Replia collects only what's needed to provide the service. We don't sell your data. We don't use your content to train AI models. You can delete everything at any time.
The data controller for information processed through Replia is:
Arve Tech FZC - LLC
Free Zone Company — Limited Liability
United Arab Emirates
Email: privacy@replia.net
Data Protection Contact: dpo@replia.net
This Privacy Policy applies to all personal data processed through:
This policy does not apply to third-party services we integrate with (Meta Threads, Anthropic). Please review their respective privacy policies separately.
| Category | Data | Purpose |
|---|---|---|
| Account | Email address, password hash | Authentication |
| Profile | Display name, avatar | Personalization |
| Preferences | Theme, AI voice tone, niches, notification settings | Service configuration |
| Content | Post drafts, custom AI prompts, edited replies | Content creation |
| Source | Data | Purpose |
|---|---|---|
| Meta Threads API | Username, profile picture, follower count, published posts, post metrics (views, likes, replies, reposts), public mentions | Analytics, reply queue, publishing |
| Meta OAuth | Authorization tokens | API access on your behalf |
| Category | Data | Purpose |
|---|---|---|
| Usage | Feature usage, AI generation count, posts/replies sent per day, streak data | Service limits, gamification |
| Device | Device type, OS version, app version, IP address | Technical support, security |
| Performance | Crash reports, API response times | Service reliability |
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Publishing posts and replies on Threads | Contract performance (Art. 6(1)(b)) |
| AI content generation | Contract performance (Art. 6(1)(b)) |
| Analytics and performance tracking | Contract performance (Art. 6(1)(b)) |
| Usage tracking and rate limiting | Legitimate interest (Art. 6(1)(f)) |
| Crash reporting and diagnostics | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
We do not sell, rent, or trade your personal data.
We share data with the following categories of service providers ("sub-processors"), solely to operate the Service:
| Sub-Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Meta Platforms, Inc. | Threads API (publish, read, analytics) | OAuth tokens, post content, API requests | United States |
| Anthropic PBC | AI content generation | Text prompts, tone preferences | United States |
| Supabase, Inc. (AWS) | Database, authentication, file storage | All account and usage data | United States (us-east-1) |
| Stripe, Inc. / Apple / Google | Payment processing | Email, subscription status | United States |
| Cloudflare, Inc. | CDN, DNS, website hosting, DDoS protection | IP address, page views, request metadata | Global (edge network) |
We may also disclose data if required by law, court order, or to protect the safety of our users or the public.
When you connect your Threads account via Meta's OAuth 2.0 flow:
Requested Threads API permissions: threads_basic, threads_content_publish, threads_manage_insights, threads_manage_replies, threads_read_replies, threads_keyword_search
Replia uses Anthropic's Claude API (specifically Claude Haiku) for content generation. Important details:
| Data Category | Retention Period | Deletion Trigger |
|---|---|---|
| Account data (email, password) | Duration of account | Account deletion |
| Threads access token | Duration of connection | Disconnect or account deletion |
| AI generation history | Duration of account | Account deletion |
| Analytics data | Duration of subscription | Account deletion or 12 months after subscription end |
| Daily usage / streaks | Duration of account | Account deletion |
| Payment records | 7 years (legal requirement) | Retained for tax/audit compliance |
| Server logs | 90 days | Automatic rotation |
Upon account deletion, all personal data is permanently removed from our systems within 30 days, except where retention is required by law.
Under the General Data Protection Regulation, you additionally have the right to:
To exercise any right, contact dpo@replia.net. We respond within 30 days.
Under the California Consumer Privacy Act and California Privacy Rights Act:
To submit a verifiable consumer request, email privacy@replia.net.
Under the Lei Geral de Proteção de Dados, you have rights to access, correction, anonymization, portability, deletion, and information about sharing. Contact dpo@replia.net.
Your data is transferred to and processed in the United States (where our infrastructure providers are located). For transfers from the EEA/UK, we rely on:
We implement the following technical and organizational measures:
The Replia website (replia.net) uses:
The Replia mobile app does not use cookies.
Replia is not directed at individuals under 16 years of age (or 13 in jurisdictions where that is the applicable age of digital consent). We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact privacy@replia.net.
We honor Do Not Track (DNT) browser signals. When DNT is enabled, we do not collect website analytics data.
We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or for other operational reasons. For material changes:
For privacy inquiries, data requests, or complaints:
Arve Tech FZC - LLC
United Arab Emirates
General Privacy: privacy@replia.net
Data Protection Officer: dpo@replia.net
Legal: legal@replia.net
We aim to respond to all requests within 30 days.