Privacy Policy

ReplyNorth (“the Service”) is a cold email engine operated by Developios LLC, 30 N Gould St Ste R, Sheridan, Wyoming 82801, USA (“we”, “us”). This policy applies to the web application, its API, and the background jobs that send and read email on your behalf.

Two distinct relationships exist, and they matter:

• Your account information. We act as the controller for the data you give us to operate your account — your name, email address, role and profile picture.
• Your campaign data and mailbox content. Leads you import, sequences generated for them, and the messages sent and received through your connected mailbox are processed on your instruction. You are the controller of that data; we act as a processor. You are responsible for having a lawful basis to contact the people on your lists.

The table below is the application’s actual data inventory, taken from its database schema.

Authentication credentials are held by Supabase Auth, not by us directly. If you sign in with a password, we never see it in plaintext; if you sign in with Google, we receive your email address, name and profile picture from Google.

Connecting a mailbox is separate from signing in. Signing in identifies you to the Service; connecting a mailbox authorises the Service to send and read mail on your behalf. The permissions requested are exactly these:

Reply detection reads message content from your mailbox. For IMAP connections the Service records a high-water mark on first connection and only reads messages that arrive after it — it does not read your historical mailbox. Message subjects and bodies that relate to a lead in your account are stored so the conversation can be shown in the app.

All OAuth tokens and all SMTP and IMAP passwords are encrypted with AES-256-GCM before being written to the database.

ReplyNorth’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Gmail data obtained through these scopes is used only to provide and improve the sending and reply-detection features described above. It is not sold, not used for advertising, and not used to train generalised artificial intelligence models. Human access to Gmail data does not occur except with your explicit consent, to resolve a support issue you have raised, for security purposes, or where required by law.

• To authenticate you and apply your role’s permissions.
• To generate email sequences from your knowledge base and lead details.
• To send email from the inboxes you connect, within the send window, daily limits and ramp-up schedule you configure.
• To detect replies and bounces, stop sequences automatically when a genuine reply arrives, and add hard-bounced addresses to your suppression list.
• To check the deliverability health of your sending domains (SPF, DKIM, DMARC and MX records) and pause inboxes that exceed a bounce threshold.
• To show you dashboards, activity history and inbox health, and to give administrators an audit trail of account changes.
• To operate, secure and troubleshoot the Service.

We do not use tracking pixels or link rewriting, and the Service does not record email opens or link clicks.

When you generate a sequence for a lead, the following is sent to OpenAI: your knowledge base document, and the lead’s name, company, source, project title and project description. The recipient’s email address is not included in the prompt. The model returns a subject line and a three-email sequence, which is stored against the lead for your review.

The default model is gpt-4o-mini, configurable by the operator. If no OpenAI key is configured or the request fails, the Service falls back to a built-in template generator and no data leaves the system.

Generated content is a draft. The first email in a sequence always requires human approval before it is sent.

Before a lead enters a sequence, its email address may be checked against a verification provider — ZeroBounce or MillionVerifier, depending on which is configured. Only the email address is sent. The provider’s response, including its deliverability verdict and supporting details, is stored against the lead.

If neither provider is configured, only a basic format check is performed locally and no data is transmitted.

These are the third parties the application actually transmits data to. Each is used only for the purpose stated.

We do not sell personal information, and we do not share it with advertising networks. The application contains no analytics or advertising integrations.

The Service sets only the cookies required to keep you signed in. These are issued by Supabase Auth, are prefixed sb-, and hold your session and refresh tokens. They are strictly necessary: without them you cannot stay authenticated.

There are no analytics cookies, advertising cookies or third-party trackers in the application. Authenticated pages are served with Cache-Control: no-store so your dashboard is not retained in the browser cache after you sign out.

We disclose information only in these circumstances:

• To the sub-processors listed above, to deliver the features you use.
• To administrators within your own installation. An administrator can view account listings, campaigns, inboxes, the suppression list and activity logs, and can suspend or delete users.
• Where required by law, or to establish, exercise or defend legal claims.
• In connection with a merger, acquisition or asset sale, subject to notice.

• OAuth tokens and SMTP/IMAP passwords are encrypted with AES-256-GCM before storage.
• Database access is governed by row-level security policies, and privileged keys are held server-side only and never exposed to the browser.
• Access is role-scoped and enforced server-side on every request, including the API.
• Suspending an account revokes its sessions, and the check runs on every request rather than only at sign-in.
• Email verification is required before a password account can sign in.
• Background jobs authenticate with a shared secret and are not reachable with a user session.

No system is perfectly secure. If you believe your account has been compromised, contact us at admin@replynorth.developios.com.

Data is retained for as long as your account is active.

What deletion does today, precisely:

• Disconnecting an inbox removes its stored credentials and its message history.
• Deleting a lead removes its generated sequence and its messages.
• Deleting a user account removes their profile and their connected inboxes, together with the messages and generated content attached to those inboxes.
• Leads and campaigns are deliberately preserved when a user is deleted. They are detached from the removed account rather than destroyed, so that outreach history is not lost when a team member leaves. If a data subject requests erasure of a lead record, that lead must be deleted explicitly.
• Administrator audit logs record that a deletion happened, including the removed user’s identity.

Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal information, and to object to certain processing. You can change your name and profile picture, and update your password, in your account settings at any time.

For any other request, contact admin@replynorth.developios.com. We will respond within 30 days.

Emails sent through ReplyNorth come from the sender’s own mailbox and are sent on that sender’s instruction. They are the controller of your data; we process it on their behalf.

To stop receiving messages, reply to the email and ask to be removed. The Service is configured by default to invite exactly that — its standard opt-out line asks recipients to reply with “unsubscribe”. A reply also stops the remaining sequence automatically, and the address can be added to a suppression list that blocks all future sends across every campaign.

You can also contact us at admin@replynorth.developios.com and we will forward your request to the sender responsible.

The Service is operated from the United States. The sub-processors listed above operate internationally, so your information may be processed in the United States and in other countries where those providers run infrastructure.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18 years of age.

We may update this policy as the product changes. The date at the top reflects the most recent revision. Where a change materially affects how your information is handled, we will give notice before it takes effect.

Developios LLC
30 N Gould St Ste R, Sheridan, Wyoming 82801, USA
admin@replynorth.developios.com