This notice explains what personal data SafeReplies collects, why we process it, how long we keep it, and the rights you have under UK GDPR. We've kept the language plain. If anything is unclear, talk to us.
Safe Replies Ltd ("SafeReplies", "we", "us") is a company registered in England and Wales (company number 17247989). We provide a software service that reviews draft business emails for compliance risk before they are sent. For the personal data described in this notice, SafeReplies is the data controller in respect of our own account, billing and marketing data, and a data processor acting on your organisation's instructions in respect of email content we scan.
We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC184280.
Questions about this notice or your data can be sent to our data protection contact at privacy@safereplies.com.
This notice applies to visitors to our website, people who start a free trial or hold an account, the individuals at customer organisations whose emails are scanned by the service, and the people they correspond with whose messages appear in the email thread being checked. It does not cover third-party websites we link to, which have their own privacy notices.
What we do retain is metadata about the scan — for example which user scanned, how many emails were scanned, and which risk categories were triggered. This metadata is what powers your dashboards, fair-use counting and billing. It includes the short phrase that triggered each flag, but not the rest of the email; full email text is only held for the 14 days described above.
AI processing chain. The compliance scan is performed using automated risk-detection models, including large language models provided by OpenAI and Anthropic. These AI providers act as our sub-processors: they are bound by our Data Processing Agreement, appear on our sub-processor list, receive email content only to return the scan result, and are contractually prohibited from retaining your email content or using it to train their models (processed via their zero-retention API terms). We do not send your email content to any AI provider that has not agreed to these terms.
Complaint Watch. Where an organisation turns on Complaint Watch, SafeReplies also reads the other person's message in the thread being replied to, to spot frustration, escalation or a formal complaint. It records the level (Watch, Escalating or Formal) and a short quote of the line that triggered it, so a manager can follow up. The quote is kept encrypted for 14 days, then deleted; the level and its follow-up record stay as metadata. Your organisation is the controller for that data and we process it as your processor.
| Category | Examples |
|---|---|
| Account data | Name, work email, organisation, role, password (stored hashed), team members you invite. |
| Usage & scan metadata | Number of emails scanned, risk flags triggered, timestamps, plugin/platform used, and the short phrase that triggered a flag. No full email text. |
| Billing data | Plan, number of users, billing contact, invoices. Card payments are handled by our payment processor, Stripe — we don't store card numbers. |
| Support & contact data | Messages you send us, booked-call details, and correspondence with our team. |
| Website data | Limited analytics about how the site is used and, with consent, advertising-related data used by our ad partners (see Cookies below). |
We process personal data under the following legal bases in UK GDPR:
We don't sell personal data. We share it only with service providers ("sub-processors") who help us run SafeReplies — for example cloud hosting, the AI providers that perform the compliance scan (OpenAI and Anthropic), our payment processor (Stripe), our live chat provider (Chatwoot, which stores chat messages in the US), and email/support tools — all bound by contract to protect it. Any AI provider that handles email content is contractually required to use it only to return the result, not to retain it, and not to use it to train models. We may also disclose data where required by law.
On signing a paid contract we enter into a standard Data Processing Agreement (DPA), and can provide our current list of sub-processors on request.
Advertising partners. With your consent, our advertising partners (e.g. Google and Meta; others may be added, always with consent) set cookies on our website, including the Meta Pixel, to measure our campaigns and show SafeReplies ads on other sites. When you sign up or start a trial, we also share a hashed (SHA-256) email address, your IP address and browser details with Meta to measure our ads. For that data they act as their own data controllers under their own privacy policies. They receive website-visit data only — never your email content or scan results.
We use encryption in transit, access controls, and the principle of least privilege. Full email text is deleted after 14 days, so the most sensitive data isn't kept long-term. We review our security practices regularly and notify affected customers and the ICO of any qualifying breach within the timeframes the law requires.
We operate in the UK only and store all personal data in the UK — we don't host your data in the EU or the US. When the compliance scan runs, email content is processed transiently by our AI providers (OpenAI and Anthropic) solely to return a result: under our zero-retention terms they do not store your email content or use it to train their models. Where any processing involves a provider outside the UK, we put appropriate safeguards in place (such as the UK International Data Transfer Agreement / Addendum) so your data stays protected to UK standards.
Under UK GDPR you have the right to:
To exercise any of these, email privacy@safereplies.com. If your emails were scanned as part of your employer's account, your employer is the controller and we will direct your request to them. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Our website uses essential cookies needed for it to work, and — with your consent — Google Analytics 4 (loaded directly, without Google Tag Manager) to understand how the site is used, including which sign-up and trial steps are completed, and advertising cookies set by our advertising partners to measure our campaigns and show relevant SafeReplies ads on other websites (cross-site tracking). When you first visit, a banner lets you accept or reject non-essential cookies; you can change your choice at any time by clearing the site's cookies in your browser, and our Cookie Policy lists exactly what we set.
We may update this notice to reflect changes to the service or the law. Material changes will be communicated to account admins by email. The "last updated" date at the top of this page always reflects the current version.
Contact our data protection team at privacy@safereplies.com or via our contact page. See also our Terms of Service.