Last updated: 02.07.2026

We take the protection of your personal data seriously. This policy explains what data we process when you use SmartReply, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing is:

Glomastco Ltd
Elia Christodoulou 46, 8510 Kouklia, Paphos, Cyprus
hello@smartreplyassistant.com

2. What data we process

Account data: name, email address, password (hashed), workspace and language settings.
Content data: the messages, email text, chat threads and knowledge-base entries you (or the browser extension) submit so that the assistant can generate summaries, translations and reply drafts. For generic websites, the page host and URL path may also be transmitted.
Connected mailboxes (optional): if you connect an email mailbox, we store its access credentials (IMAP/SMTP host, username, password) encrypted at rest. Incoming emails are fetched to analyze them automatically (priority, summary, suggested reply). You can disconnect a mailbox at any time, which deletes the stored credentials.
Voice recordings (optional): if you use the dictation feature, the audio recording is sent to our transcription provider to convert it to text. The recording is not stored permanently.
Browser extension: the extension sends the content of the message you have open, plus your settings, to our API. Results are cached locally in your browser; your token and settings are stored locally in the browser.
Usage data: number of requests, plan and quota counters, feature settings, log data (IP address, timestamp, browser) for security and operation.
Payment data: for paid plans, billing data is processed by our payment provider Stripe. We do not store full card numbers.

3. Purposes and legal bases

Providing the service (account, assistant, summaries, replies) — Art. 6(1)(b) GDPR (performance of a contract).
AI processing of your content to generate the requested output — Art. 6(1)(b) GDPR. The text you submit is sent to our AI sub-processor solely to produce the result you requested.
Security, abuse prevention, logs — Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).
Billing — Art. 6(1)(b) and Art. 6(1)(c) GDPR (contract and legal accounting obligations).
Optional cookies / consent-based features — Art. 6(1)(a) GDPR (consent), revocable at any time.

4. AI processing and choice of AI provider

The core function of SmartReply sends the message or thread you choose to an AI language-model provider (acting as our processor) to generate a summary, translation or reply. You or your organization can choose where this processing takes place:

Shared AI (US) – default: processing by Anthropic (Claude) or OpenAI in the United States.
Shared AI (EU) – optional: processing by a European provider (Mistral AI, France) or Microsoft Azure OpenAI in an EU region; your content then stays within the EU.
Your own API key: if you use your own key, content is sent directly to the provider you choose; you are the controller for that processing.

We instruct our AI providers contractually not to use your content to train their models. Voice transcription (dictation) is performed by OpenAI (Whisper, US). Do not submit data you are not authorised to share.

5. Processors and recipients

We use carefully selected service providers under data processing agreements (Art. 28 GDPR):

Hosting / infrastructure: Hetzner Online GmbH, Germany (servers, database, email delivery).
AI models (US): Anthropic PBC and OpenAI, L.L.C. (text processing; Whisper transcription via OpenAI).
AI models (EU, optional): Mistral AI SAS, France; Microsoft Ireland Operations Ltd. (Azure OpenAI, EU region).
Payments: Stripe Payments Europe, Ltd., Ireland.

Data is only shared as required to operate the service. Which AI providers are involved depends on the AI option you select (section 4).

6. International transfers

If you use the US AI option or voice transcription, data is transferred to providers in the United States (Anthropic, OpenAI). Such transfers are safeguarded by EU Standard Contractual Clauses (SCC) and, where certified, the EU-US Data Privacy Framework. If you choose the EU AI option, no such third-country transfer takes place for that processing.

7. Cookies

We use strictly necessary cookies only (session, CSRF security token, login persistence, cookie-consent state and language). These do not require consent. Any non-essential cookies are only set with your consent.

8. Retention

Account data is stored for the duration of your account. Content you submit is processed to produce the result and may be cached for performance; you can delete content and your account at any time. Emails fetched from a connected mailbox are stored together with their AI analysis until you disconnect the mailbox or delete your account. Billing records are kept for the statutory retention periods.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact hello@smartreplyassistant.com.

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority — for Glomastco Ltd this is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy) — or the authority of your habitual residence.

11. Changes

We may update this policy to reflect changes to the service or the law. The current version is always available on this page.

Privacy Policy