Privacy policy

1. Data controller

The data controller is Illith, publisher of ReplayConnect. For any question about your data: contact@illith.com.

2. Data collected

Depending on how you use the service, we may process: account data (email, name, hashed password), organization data (workspace, members, roles), session data (titles, times, participants, recipients), replay content (recordings, transcripts, summaries), technical data (logs, IP address, browser) and payment data handled by our payment provider.

3. Purposes and legal bases

We process this data to provide the service (performance of the contract), to improve reliability and security (legitimate interest), to meet our legal obligations and, where applicable, to send you product-related information with your consent where required.

4. Recipients and subprocessors

Your data is accessible to the authorized members of your organization and to the subprocessors needed for hosting, authentication, email delivery, media storage, AI processing (transcription / summary) and payment. These providers act on our instructions and under appropriate security measures.

5. List of subprocessors

Here are the technical subprocessors we use, with their role and the location of the data. ReplayConnect does not present itself as 100% hosted in Europe.

Convex: database and application functions. Hosted in the European Union, AWS region eu-west-1 (Ireland).

Daily: video conferencing and session recording. United States.

Bunny.net: video hosting and playback.

OpenRouter: AI transcription and summaries, through third-party models. United States.

Resend: email delivery. United States.

Stripe: payment. Ireland and United States.

Hostinger: application server. European Union.

Transfers of data outside the European Union rely on the contractual safeguards of these providers (standard contractual clauses).

6. Retention period

Account and workspace data is kept while the account is active, then archived or deleted according to our operational timelines. Some content or logs may be kept for a limited period (for example up to 90 days for certain logs), unless the law requires otherwise or evidence is needed.

7. Transfers outside the EU

If a subprocessor is located outside the European Economic Area, we put appropriate safeguards in place (standard contractual clauses or an equivalent mechanism) where the regulations require it.

8. Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability, under the conditions set by law. You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority. To exercise your rights: contact@illith.com.

9. Cookies and trackers

We use cookies or local storage that are necessary for the service to work (session, preferences, including your language choice). Any analytics or marketing tools, if enabled, will come with information and consent where required.

10. Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss or alteration. As no system is infallible, we encourage you to use a unique, strong password.

11. Changes

We may update this policy. The date at the top of the page shows the latest version. In case of a significant change, we may inform you through the service or by email.