01 Introduction
InRepply is a job-application tracking service operated by [COMPANY_LEGAL_NAME], registered in Lublin, Poland. In this policy, 'we', 'us' and 'InRepply' mean that company. 'You' means anyone who uses InRepply on the web, iOS or Android.
This document explains what personal data we collect when you use InRepply, why we collect it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR) and Polish law implementing it.
We try to write this in plain language. If anything is unclear, email us and we'll explain.
02 What data we collect
Account data: your email address, display name, and a hashed and salted version of your password. We never store passwords in plain text.
Job application data you put into InRepply: company names, role titles, salary ranges, application stages and dates, notes, contact details for recruiters, CV / résumé files, cover letters, screenshots of job listings, tags and reminders. This data is yours. We process it to give you the service and for nothing else.
Usage data:
- Pages and screens visited within InRepply and the features you used.
- Device and browser information: OS, browser type and version, screen size, language.
- Your IP address. We anonymize the last octet after 30 days.
Payment data: payments are processed by Apple App Store, Google Play Billing, and Stripe, with subscription management by RevenueCat. We never see or store your card number, CVC or full bank details. We receive only the information we need to fulfil and account for the order.
03 How we use your data
We use your personal data for the following purposes:
- Providing the service: storing and syncing your applications, running AI features you trigger, generating statistics and reminders.
- Improving the product: analysing aggregated, non-identifying usage patterns to decide what to build next, fix bugs, and improve performance.
- Transactional emails: account confirmation, password resets, renewal reminders (sent 7 days before any subscription renewal), invoices, and security alerts.
- Marketing emails: product updates and tips. Only if you've opted in, and only until you opt out.
- Processing payments: billing, refunds, fraud prevention, accounting.
- Complying with the law: keeping accounting records, responding to lawful requests from authorities, defending legal claims.
04 AI processing with Google Gemini
InRepply's AI features (screenshot-to-application, smart suggestions, Gemini integration on Android) are powered by Google's Gemini API.
When you use one of these features, the relevant content (for example, the screenshot of a job listing you paste in, the section of your CV being matched, or the question you ask Gemini) is sent to Google's Gemini API over an encrypted connection to be processed.
Under Google's Gemini API terms, Google does not use API request content to train its models and does not retain your request data beyond the time needed to serve the request (plus short-lived caches for abuse detection).
We do not send your contact list, your full job-search history or any other unrelated data to the Gemini API, only the specific content needed for the feature you triggered. Every AI action is opt-in and can be disabled in your settings.
05 Legal basis for processing (GDPR Article 6)
We process your personal data on one of these legal bases:
- Contract performance (Art. 6(1)(b)): to deliver the service you signed up for: storing your applications, running AI on your request, processing payments, sending account-related emails.
- Legitimate interest (Art. 6(1)(f)): to keep the product secure, prevent abuse, and improve InRepply with aggregated analytics that don't identify you individually. You can object at any time.
- Consent (Art. 6(1)(a)): for marketing emails and for non-essential cookies (analytics, marketing). You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): to keep accounting and tax records as required by Polish law.
07 Data retention
- Account data: kept until you delete your account.
- Application data: kept until you delete it inside InRepply, or until you delete your account.
- Backups: retained for 30 days after deletion, then permanently destroyed.
- Server logs: kept for 90 days for security and debugging.
- Billing and accounting records: kept for 5 years from the end of the relevant tax year, as required by Polish tax law.
- Anonymized analytics: kept indefinitely; cannot be linked back to you.
08 Your rights under GDPR
You have the following rights over your personal data:
- Right of access: get a copy of the data we hold about you.
- Right to rectification: correct anything that's wrong.
- Right to erasure: have your data deleted ('right to be forgotten').
- Right to data portability: receive your data in a machine-readable format and move it elsewhere.
- Right to restriction: ask us to stop using your data while a dispute is sorted out.
- Right to object: object to processing based on legitimate interest, or to direct marketing.
- Right to withdraw consent: for anything that relies on consent, you can take it back at any time.
To exercise any of these, email us from the address on your account. We respond within 30 days.
You also have the right to lodge a complaint with the Polish data protection authority (UODO, uodo.gov.pl) or the supervisory authority in your country of residence.
09 Data transfers outside the EU
Some of our processors are based in the United States (notably Google, Stripe, RevenueCat and Cloudflare). When your data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (and, where applicable, the EU-US Data Privacy Framework) to guarantee an equivalent level of protection.
You can request a copy of the safeguards in place by emailing us.
10 Security measures
- All connections to InRepply use TLS 1.2 or higher.
- Data at rest is encrypted using AES-256.
- Passwords are hashed with a modern key-derivation function (Argon2 / bcrypt).
- Access to production systems is limited to a small number of engineers, secured with hardware-key two-factor authentication, and audit-logged.
- We run automated backups daily and test restores regularly.
- In the event of a personal-data breach likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and notify you without undue delay where required.
11 Children's data
InRepply is not intended for users under the age of 16, and we do not knowingly collect data from anyone in that age group. If you believe a child has created an account, please contact us and we will delete the account and any associated data.
12 Changes to this policy
We may update this Privacy Policy from time to time. For any material change (a new processor, a new purpose for processing, or a significant change to your rights), we will email you at least 30 days before the change takes effect.
Smaller, clarifying edits are reflected by updating the 'Last updated' date at the top of this page.
13 Contact
For any privacy question, complaint, or data-rights request: email our privacy team. We read every message and respond within a few business days.
Controller: [COMPANY_LEGAL_NAME], registered office at [COMPANY_ADDRESS], Lublin, Poland.