Skip to content

New feature: Our API is live: Webhook, MCP, or API - you decide. Try it out!Join beta

REPLOYA home

Privacy

Last updated: 2 November 2026

Who is responsible

Tobias Siedersleben, Im Mediapark 5, 50670 Köln, Germany, email support@reploya.com. See the imprint.

Hosting and technical logs

The site and the Reploya application run on servers of Hetzner Online GmbH in Germany, which processes data on our behalf. To protect the forms and the sign in from abuse, the IP address of a request is kept in a rate limit counter for at most about two hours, then deleted. Error logs record technical event codes, not your email address or messages. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Contact form

When you write to us, your name, company, email address and message are sent to us as an email through Resend (Resend, Inc., USA), which delivers our email on our behalf. Nothing is stored on this site. We use the message to answer you and keep the email as long as the conversation needs it. Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering (Art. 6(1)(f) GDPR).

Beta waitlist

When you join the waitlist, we store your email address, the version of the consent text you agreed to, and when you signed up and confirmed. We send one confirmation email through Resend; only after you confirm with the button on the page the link opens is your address on the list (double opt in). Depending on the consent text you agreed to, we then email you once, when the beta opens, or also send you occasional product news. You can unsubscribe at any time with the link in every email. No IP address or name is stored with your entry.

An address that is not confirmed is deleted 7 days after the last confirmation email. A confirmed address is deleted after the beta invitation is sent, at the latest 12 months after you confirmed. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the link in every email, which deletes your address, or by writing to support@reploya.com; this does not affect anything done before you withdrew.

Product news and service mail

We send two kinds of email to the members of Reploya organizations. Service notices tell you about changes that affect your organization or your tenant, such as planned maintenance; they are part of the service and carry no unsubscribe link. Product news tells you about new features and tips; every product news email has an Unsubscribe link, and mail clients that support it offer a one click unsubscribe. Once you unsubscribe we keep your email address on an opt out list, so we never send you product news again unless you subscribe again from the same page. The opt out never stops service notices or the email your account needs, such as sign in codes and invitations. The beta waitlist gets product news only as described above.

Resend (Resend, Inc., USA) delivers these emails on our behalf. For each email we keep a send log with the recipient address and whether it was sent, skipped or failed, for 90 days after the mailing finished; then the log is deleted and only the totals remain. Legal basis: for service notices, the contract with your organization (Art. 6(1)(b) GDPR); for product news to customers, our legitimate interest in telling them about the service they use, with an opt out in every email (Art. 6(1)(f) GDPR); for the beta waitlist, your consent (Art. 6(1)(a) GDPR).

Analytics, only with your consent

Only if you accept in the cookie banner, we use PostHog (PostHog, Inc., EU cloud in Frankfurt) to count visits to the landing page, clicks on "Join the beta", sent contact messages (with their subject only), submitted waitlist forms and which pricing plans were viewed. PostHog records no clicks automatically, no session recordings, and never your name, email address or messages. It sets a cookie to recognise repeat visits. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Withdraw it any time under "Cookie settings" at the bottom of the page; that also deletes the PostHog cookies.

Cookies and local storage

  • reploya_consent stores your cookie choice for one year, so the banner does not ask again.
  • reploya_site_theme in your browser's local storage keeps the light or dark theme, only once you use the theme switch.
  • reploya_site_notices in your browser's local storage remembers which notices at the top of the page you closed for good, only once you close one.
  • reploya_site_notices_session, a cookie deleted when you close the browser, remembers which notices you closed until then, only once you close one.
  • After you sign in, a session cookie keeps you signed in for up to 12 hours.
  • sidebar_state remembers whether the dashboard sidebar is open or collapsed, for one week.
  • sidebar_groups_collapsed remembers which dashboard sidebar groups you folded, for one year, only once you fold one.
  • PostHog's cookies, only after you accept analytics.

The first seven are needed for what you asked for (§ 25(2) TDDDG). None of them tracks you.

Signing in with Microsoft

Customers sign in with Microsoft Entra ID (Microsoft Ireland Operations Ltd.). We receive your name, email address, your Microsoft account and tenant identifiers and, if available, your profile photo, which we store with your account. We use them to run your account and your organization, keep a session, and record sign ins in your organization's audit log. Legal basis: the contract with your organization (Art. 6(1)(b) GDPR) and our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Your profile and contact email address

In your profile you can change the name Reploya shows and add a contact email address. We send a code to that address, and only once you enter it does Reploya send your email there instead of to your sign in address, including sign in codes if you sign in with an email code. Until then the address is kept with the code request, which is deleted after 24 hours. When you change or remove a confirmed address, we send it one short notice, and when you confirm a first contact address we send one to your sign in address. Your organizations' audit logs record that it changed, never the address itself. Invitations you send carry your contact email address as the reply address. The contact address is deleted with your account. Legal basis: the contract with your organization (Art. 6(1)(b) GDPR).

Deleting your organization or account

An owner can delete the organization in Settings. It is locked at once and erased 14 days later: its settings, apps, builds, reports, logs and files, and the accounts of its members who belong to no other organization. Until then an owner can cancel. Apps Reploya already published to your Intune stay in your tenant; you remove them, and Reploya's enterprise application, in Intune and Microsoft Entra yourself.

You can delete your own account in Account settings at once. Your organizations keep what you did, shown as "Deleted user" without your name or address.

After an erasure we keep one record that the organization was erased, with its company name and the dates and no personal data, so we can show that we did it (Art. 5(2) GDPR). Erased data leaves our backups within 30 days. You can also ask us to delete your organization by writing to support@reploya.com.

Transfers outside the EU

Resend is based in the USA. Transfers to it rely on the EU US Data Privacy Framework or the EU standard contractual clauses.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15 to 21 GDPR), and to withdraw a consent at any time. Write to support@reploya.com.

You can also complain to a supervisory authority, for us the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf.