Privacy Policy

1. Who we are and scope

ReplyDuck provides a research and drafting tool that helps you find relevant Reddit conversations and draft comments. For the purposes of the EU General Data Protection Regulation (GDPR) and Spanish data protection law, ReplyDuck is the “controller” of the personal data described in this Policy. This Policy applies to personal data we process about visitors, account holders, and their authorized users.

2. Information we collect

Information you provide. This includes:

• account details such as your name, email address, and password;
• product information you add, such as your website URL, product descriptions, competitors, and monitoring keywords or topics;
• content you create or edit in the Service, including draft and posted comments;
• billing details processed by our payment provider (we do not store full card numbers);
• the contact details of the notification channels you connect, such as Telegram, Slack, email, or webhook endpoints; and
• any messages you send us for support or feedback.

Information we collect automatically. When you use the Service we collect usage and device data such as IP address, browser and device type, pages viewed, actions taken, and timestamps, using cookies and similar technologies (see Section 8).

Information from third parties. When you connect a Reddit account or another third-party service, we receive data from that service as permitted by you and by that service, such as account identifiers and the public Reddit content relevant to your topics. We also analyze publicly available Reddit posts and comments to score them for relevance and intent, and we read publicly available pages of the website and competitors you specify.

3. How we use your information

We use personal data to:

• provide, operate, and maintain the Service, including finding relevant conversations and generating draft comments;
• create and manage your account and authenticate you;
• process payments and manage subscriptions;
• send you notifications about opportunities and Service-related messages through the channels you choose;
• verify whether comments you have posted remain visible and alert you to account issues;
• provide support, respond to your requests, and improve and develop the Service;
• monitor for, prevent, and address security issues, abuse, and violations of our Terms; and
• comply with legal obligations.

4. Legal bases (GDPR)

We rely on the following legal bases to process your personal data:

• Performance of a contract — to provide the Service you have signed up for, manage your account, and process payments;
• Legitimate interests — to secure, maintain, and improve the Service, prevent abuse, and communicate with you, provided these interests are not overridden by your rights;
• Consent — where required, for example for certain cookies or optional communications; you may withdraw consent at any time; and
• Legal obligation — to comply with laws that apply to us, such as accounting and tax rules.

5. AI processing

To generate draft comments and analyze conversations, the Service sends relevant content — such as your product information and the public Reddit posts you are engaging with — to third-party AI model providers acting as our processors. These providers process the content to return AI output to you and are contractually restricted from using it to train their models except as permitted under our agreements with them. We do not use the content of your draft or posted comments to sell advertising.

6. Reddit and connected accounts

ReplyDuck is not affiliated with, endorsed by, or connected to Reddit, Inc. When you connect a Reddit account, we process the credentials or tokens needed to provide the features you enable, such as reviewing conversations and verifying comment visibility. We access Reddit data as permitted by you and by Reddit, and your use of Reddit remains governed by Reddit’s own terms and privacy policy. You can disconnect a connected account at any time from your settings; doing so may limit certain features.

7. How we share information

We do not sell your personal data. We share it only as follows:

• Service providers (processors) — such as hosting, payment processing, AI model providers, analytics, and notification delivery (Telegram, Slack, email), who process data on our behalf under appropriate agreements;
• Within your workspace — with other authorized members of your ReplyDuck team, according to the access you configure;
• Legal and safety — where required to comply with law, enforce our Terms, or protect the rights, safety, and security of ReplyDuck, our users, or the public; and
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

8. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, understand how the Service is used, and improve it. Essential cookies are necessary for the Service to function; other cookies are used only where permitted, and where required by law we ask for your consent. You can control cookies through your browser settings, though disabling some may affect functionality. For details on the specific cookies we use, see ourCookie Policy.

9. International data transfers

We and our service providers may process personal data in countries outside your own, including outside the European Economic Area. Where we transfer personal data internationally, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, to ensure your data receives an equivalent level of protection.

10. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, and thereafter only as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. You can request deletion of your account and associated data as described in Section 12.

11. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including encryption in transit and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

12. Your rights

Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. To exercise these rights, contact us at [email protected]. We will respond within the time required by law. You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

13. Children

The Service is not directed to children and is intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

Questions about this Policy or your personal data? Contact us at [email protected].