1. Who is responsible for your data
TETRACTYS DEVELOPMENT LTD (293 Northfield Avenue, London, England W5 4XB) is the controller of personal data processed through SweetReply. For any privacy question or request, contact [email protected].
2. The short version
- Screenshots you upload are processed in memory and are not stored.
- The conversation text extracted from them, and your results, are stored encrypted so you can return to them.
- You can delete a contact, and everything stored about them, at any time. Deleting your account deletes everything.
- Your conversations are not used to train AI models, and we do not sell your data or use it for advertising.
3. What we collect
- Account data: your name, email address and profile image, provided when you sign up through our authentication provider.
- Conversation content: screenshots or text you submit, the conversation text we extract from them (including which messages are yours), any notes or context you add, contact names you choose, and the results we generate.
- Billing data: your plan, purchase history and Stripe customer reference. Card details are collected and stored by Stripe; we never see your full card number.
- Usage and technical data: actions used, credit balance and transactions, request logs, IP address, browser and device information, used to run, secure and troubleshoot the service.
- Support communications: messages you send us.
4. Other people in your conversations
Conversations you upload usually contain messages and names of other people. We process that information only to provide the analysis you asked for, we do not use it to contact or profile those people, and it is deleted when you delete the contact or your account.
When you upload a conversation you confirm you are entitled to share it for your own personal use. Please share only what is needed, crop out unrelated content, and avoid sensitive information such as health details where you can. If someone believes their information has been uploaded to SweetReply, they can contact us and we will help where we can.
5. How we use data and our legal bases
- To provide the service (account, analyses, saved history, credits and billing): performance of our contract with you.
- To process other people's messages within your conversations: our legitimate interest in providing the service you requested, balanced by strict minimisation, encryption and your ability to delete the data at any time.
- To keep the service secure and prevent abuse, including detecting requests that breach our acceptable use rules: our legitimate interests.
- To keep financial records: compliance with legal obligations.
- To send service emails (receipts, account and policy notices): performance of contract. We will only send marketing emails if you have opted in, and you can opt out at any time.
6. Who we share data with
We use a small number of service providers who process data on our behalf under contract:
- Clerk: authentication and account management.
- Stripe: payment processing, subscriptions and fraud prevention.
- Anthropic: the AI model that analyses your conversations and generates results. Under Anthropic's commercial API terms, inputs and outputs are not used to train its models and are retained only for a limited period for trust and safety purposes.
- Hosting and infrastructure providers: servers and the PostgreSQL database where your account and encrypted conversation data are stored.
We may also disclose information if required by law, to protect someone's safety, or as part of a sale or reorganisation of our business (in which case this policy would continue to apply).
7. International transfers
Some of our providers are based in, or process data in, the United States and other countries outside the UK. Where that happens, we rely on recognised safeguards such as the UK International Data Transfer Agreement or Addendum, standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.
8. How long we keep data
- Screenshots: not stored; discarded once the text has been extracted.
- Conversation text and results: until you delete the contact or your account.
- Account data: for as long as your account is open.
- Billing records: up to 6 years after the transaction, to meet tax and accounting obligations.
- Security and request logs: up to 90 days, unless needed to investigate abuse.
When you delete your account, we delete your account data and conversation data, keeping only the billing records we are legally required to keep.
9. Security
Data is encrypted in transit. Conversation text and results are additionally encrypted at rest. Access to production systems is restricted to the people who need it to run the service.
10. Your rights
Under UK data protection law (and the GDPR, if you are in the EU), you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. You can delete contacts and your account yourself in the app; for anything else, email [email protected]. We will respond within one month.
You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We would appreciate the chance to resolve your concern first.
11. Cookies
We use only the cookies needed to sign you in and keep the service secure. We do not use advertising cookies. See our Cookie Policy.
12. Children
SweetReply is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
If we make material changes, we will update the effective date above and tell you by email or in the app before the changes take effect.