Privacy Policy
1. Who we are
Coldrply is an AI cold-email tool operated from Mumbai, Maharashtra, India. We decide how and why your personal data is used, which makes us the data controller (a “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023).
For any privacy question, request or complaint, contact our Grievance Officer at riddhesh@coldrply.com. We respond to grievances within 30 days, as required by India’s Information Technology (Reasonable Security Practices) Rules, 2011.
Coldrply is offered from India and priced in Indian rupees. We do not target our services at people in the European Economic Area or the United Kingdom, and we have not appointed a representative there. Where the EU or UK GDPR nonetheless applies to you, the rights in section 8 are available to you and we will honour them.
2. What we collect
- Account information: your name and email address, obtained when you sign up (including via Google sign-in), and the date you accepted our Terms.
- Content you provide: prospect profile text, product and call-to-action details, and the emails generated for you.
- Payment information: processed by Razorpay. We store only payment and subscription metadata (plan, status, transaction IDs) — never your full card details.
- Gmail metadata (optional): if you connect Gmail for reply tracking via Nylas, we access read-only message metadata (subject, sender, timestamp) to detect replies. We never read your email bodies.
- Email Analyser submissions: if you use the free analyser, the email text you paste plus the name, work email, company and role you enter to receive the report.
- Diagnostics: error and performance data via Sentry, including IP address and browser details, to keep the service reliable.
- Usage analytics (only with your consent): clicks, scrolls and page views, including session replay via Microsoft Clarity. See section 4.
About the people you contact. When you paste a prospect’s details into Coldrply, we process that information on your instructions in order to generate your email. You remain responsible for having a lawful basis to hold and use those details.
3. Why we use it, and our legal basis
Where the GDPR or UK GDPR applies, we rely on the following bases. Under India’s DPDP Act we rely on your consent, or on the legitimate uses that Act permits.
| Purpose | Legal basis |
|---|---|
| Providing the service — generating emails, tracking replies, managing your account | Performance of a contract |
| Taking payment and issuing receipts | Performance of a contract; legal obligation |
| Keeping records for tax and company law | Legal obligation |
| Security, fraud prevention, rate limiting and diagnostics | Legitimate interests — running a service that stays available and is not abused |
| Analytics and session replay | Legitimate interests — understanding and improving how the product is used |
| Newsletter and product marketing | Consent — and only if you ticked the box |
| Service emails you cannot opt out of — receipts, security and password notices | Performance of a contract |
We do not sell your personal data, and we do not use it to train AI models.
4. Cookies, analytics and session recording
Cookies that are strictly necessary — keeping you signed in, processing payments, remembering light or dark mode — are always set, because the service cannot work without them. Analytics cookies are described below.
Microsoft Clarity captures usage data — clicks, scrolls, mouse movement and navigation — and can replay a reconstruction of your session so we can find and fix usability problems. Microsoft may combine this data as described in its own privacy statement.
How to stop it. Clarity currently runs on visits to Coldrply. You can prevent it by using your browser’s tracking-protection settings, by blocking third-party scripts or cookies, or with a content blocker — all of which stop the script loading. You can also ask us to delete analytics data associated with you by emailing riddhesh@coldrply.com.
What is never recorded: text you type into form fields is masked before it leaves your browser, so passwords, payment details and the content you enter are not captured in replays. We never record your Gmail message bodies.
Full detail is in our Cookie Policy, and Microsoft’s handling is described in the Microsoft Privacy Statement.
5. Who we share it with
We share data with infrastructure and processing partners strictly to operate Coldrply. Each acts on our instructions under a contract, and none may use your data for their own purposes except where noted.
- Supabase — database and authentication
- Google (Gemini) — AI email generation and analysis
- Razorpay — payment processing (an independent controller for payment data)
- Nylas — Gmail metadata and reply tracking, if connected
- Resend — transactional email delivery
- Vercel — hosting
- Sentry — error monitoring
- Microsoft Clarity — product analytics and session replay
We may also disclose data where the law requires it, or to establish or defend legal claims. If Coldrply is ever sold or merged, your data may transfer to the buyer, who would remain bound by this policy.
6. Where your data is processed
Coldrply is operated from India, and our providers listed above operate globally — principally in India, the United States and the European Union. Your data will therefore be processed outside your own country.
Where data protected by the EU or UK GDPR is transferred outside those areas, we rely on the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum) in our agreements with those providers. Under India’s DPDP Act, transfers are permitted except to territories the Central Government restricts.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is open, then 30 days after you ask us to delete it |
| Generated emails and inputs | While your account is open; deleted with the account |
| Gmail metadata for reply tracking | Until you disconnect Gmail, then deleted |
| Payment and invoice records | 8 years, as required by Indian tax and company law |
| Email Analyser submissions | 24 months from your last interaction with us |
| Unsubscribe records | Kept indefinitely — deleting them would let us mail you again by mistake |
| Error logs and analytics | Up to 90 days for Sentry; Clarity data per Microsoft’s own retention |
8. Your rights
Whatever law applies to you, you can ask us to:
- Access the personal data we hold about you, and get a copy.
- Correct anything inaccurate or incomplete.
- Delete your data, where we have no overriding obligation to keep it.
- Withdraw consent at any time — for marketing, via the unsubscribe link in any email or from Account settings. Withdrawing does not undo what we did lawfully beforehand.
- Object to or restrict processing we base on legitimate interests.
- Receive your data in a portable, machine-readable format.
- Nominate someone to exercise these rights for you if you die or become incapacitated (DPDP Act).
Email riddhesh@coldrply.com and we will respond within 30 days. We do not charge for this, and we will not treat you differently for asking. You can disconnect Gmail yourself at any time from Account Settings.
If you are unhappy with our response, you can complain to a regulator. In India, that is the Data Protection Board of India. In the EEA or UK, you may complain to your local supervisory authority — in the UK, the Information Commissioner’s Office at ico.org.uk.
9. Security
We encrypt data in transit, restrict database access at the row level so one account cannot read another’s data, hold service credentials server-side only, and monitor for faults. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant regulator of a personal data breach where the law requires it.
10. Children
Coldrply is a business tool for adults. You must be at least 18 to hold an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, email riddhesh@coldrply.com and we will delete it.
11. Changes to this policy
If we change this policy materially we will update the date below and, where the change affects how we use data you have already given us, tell you directly. Continuing to use Coldrply after a change means you accept the updated policy.
Last updated: July 27, 2026 · Coldrply AI Outreach