Effective date: August 2, 2026 Last updated: August 2, 2026
1. Who We Are
Reppic is a product of The Sales Studios B.V., based in the Netherlands (Chamber of Commerce No. 97393142).
For privacy questions: privacy@reppic.ai
2. Scope of this policy
This policy applies to the entire Reppic platform: the mobile app, the web application (app.reppic.ai), all dashboards (salesperson, sales manager, CCO/executive), and the associated integrations (calendar, CRM, call recording).
3. When We Are a Processor vs. a Controller
Which of the two situations below applies to you depends on how your account was created; it is not a decision Reppic makes for the platform as a whole. Both situations occur at the same time, for different users.
- You use Reppic through an employer or client (you work at a Reppic customer and your account was created or required by your employer). In this case, your employer is the data controller for your conversation data, scores, and performance insights. Sales Studios B.V. acts as the data processor under a data processing agreement with your employer. Requests regarding your rights in this case can also be submitted through your employer; we assist them in handling these requests.
- You have a direct individual account (trial, individual subscription) without an employer-customer involved. In this case, The Sales Studios B.V. is the data controller.
4. What data we collect
Account Information
- Email address, name, role (salesperson / manager / CCO)
- Authentication token (JWT), 2FA status
Conversation data
- Audio recordings that you start yourself (app) or that come in via a connected calling service (Zoom, Microsoft Teams, Google Meet, Recall)
- Transcripts (via AssemblyAI or a comparable service)
- AI-generated analysis: PICA scores (Proposition, Inventory, Persuasion, Conclusion), DMU analysis, rubric scores, summaries
Calendar and CRM data (pre-call briefing)
- Calendar data from connected Google Calendar/Outlook accounts, within a 48-hour window before a scheduled call
- Contact and deal data from connected CRMs (HubSpot, Salesforce, Pipedrive)
Strategic and team data
- Uploaded strategic plans (executive/CCO level)
- Aggregated team and organizational data in manager and CCO dashboards
Technical Data
- IP address, device type, operating system, log files
Local storage on your device
- Drafts, language preference, settings (expo-secure-store / AsyncStorage)
5. Data on conversation participants (non-users)
Reppic processes conversations in which the other party (your customer or prospect) does not have a Reppic account and may not have seen this policy. We address this separately because it requires a different legal basis and disclosure approach than processing our own users’ account data.
- Legal basis: the legitimate interest of the organization conducting the call (quality assurance, coaching, customer insight), provided that it does not disproportionately affect the interests of the person participating in the conversation.
- Disclosure obligation: Reppic customers are responsible for informing the participants in their conversations that the call is being recorded and analyzed (e.g., through a notice at the start of the call).
- Retention and rights: see section 8. Conversation participants can submit requests for access or deletion to privacy@reppic.ai; we forward the request to the relevant customer organization, which acts as the data controller.
6. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Authentication and Account Management | Performance of a Contract |
| Processing Recordings into Transcripts and Analysis | Performance of a contract (or: the controller’s instructions, where we act as a processor) |
| Generating coaching feedback for individual salespeople | Performance of a Contract |
| Generating team and performance insights for managers/CCO | Employer’s legitimate interest, subject to the principle of proportionality — see Section 7 of the AI Act |
| Pre-call letter (calendar/CRM integration) | Performance of a contract, following active connection by the user |
| Improving the Service | Legitimate interest |
| Technical Support | Legitimate interest |
7. AI Use, Transparency, and Your Rights
Reppic uses AI models to transcribe, score, and analyze conversations. Because these analyses are used to assess employee performance and behavior, this system may fall under the EU AI Act as a high-risk AI system (Annex III, category 4(b): monitoring and evaluation of the performance and behavior of workers).
Where applicable, this means:
- Human oversight: AI-generated scores are intended solely as a tool for coaching and personal development. Reppic scores must never be used as a control mechanism and must never be used directly in promotion or termination decisions. Customer organizations using Reppic commit to this, and it is also set forth contractually in the customer terms. Where a score does inform a formal HR assessment, human review is required, and the individual has the right to request a human re-evaluation (see also GDPR Article 22 and the AI Act’s requirements for high-risk AI systems).
- Disclosure: Employees whose conversations are analyzed are informed by their employer when Reppic is introduced, and through this policy.
- Conformity status: We continuously assess whether and to what extent our AI systems qualify as high-risk under the EU AI Act, and what obligations arise from that. The current status of this assessment is available upon request via privacy@reppic.ai.
- Models we use: Anthropic Claude (analysis), AssemblyAI (transcription)
We recommend that customer organizations (employers) consult with their works council when implementing Reppic, given the potential applicability of consent rights for systems that can monitor employee behavior or performance.
8. Retention Periods
| Data type | Retention period |
|---|---|
| Account Information | As long as the account is active, plus 30 days after termination |
| Audio recordings | 7 days after processing, then automatically deleted |
| Transcripts (raw conversation text) | 7 days after processing, then automatically deleted |
| AI analysis, PICA scores, and reports | Remain available in the dashboard as long as the account is active (see also “Account information” above) |
| Calendar/CRM data via pre-call briefing | Deleted after 30 days or when the specified time window expires |
| Local drafts | Stored on the device until deleted by the user |
| Log files | Up to 90 days |
9. Sharing Data – Subprocessors
We never sell personal data to third parties. We share data with:
| Subprocessor | Function | Location |
|---|---|---|
| AssemblyAI | Transcription | Processed in the EU (Dublin, Ireland). DPF-certified. |
| Recall | Capturing/relaying meeting recordings (Zoom, Teams, Google Meet) | U.S. (Hyperdoc Inc.) – According to Recall’s own privacy policy, data is stored on U.S. servers; we found no Recall-confirmed storage option in the EU |
| Anthropic | AI analysis (Claude) | US. Transfers rely on EU Standard Contractual Clauses (SCCs) – no DPF certification claimed. |
| Own infrastructure (The Sales Studios B.V.) | Hosting | Amsterdam, the Netherlands |
| HubSpot | CRM Integration | EU (Frankfurt), DPF-certified |
| Salesforce | CRM Integration | EU (Hyperforce EU zone, including Frankfurt/Paris), DPF-certified |
| Pipedrive | CRM Integration | EU (Frankfurt/Dublin/Stockholm; EU contracting entity in Estonia), DPF-certified |
All subprocessors are bound by a data processing agreement and may use data solely for the agreed-upon purposes.
10. International Transfers
When data is processed outside the EEA, we implement appropriate safeguards under the GDPR. HubSpot, Salesforce, Pipedrive, and AssemblyAI use EU hosting or EU processing, respectively (see section 9), backed by their DPF certification. For Recall and Anthropic, which do process data outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) as the transfer mechanism.
11. Security
- HTTPS encryption for all data transfers
- Secure token storage on the device (expo-secure-store)
- Access security on our servers
- Automatic deletion of audio files after the retention period (Section 8)
12. Your Rights
As a data subject in the EU/EEA, you have the right to: access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interests; and—where applicable to AI-driven assessments—the right to request a human review of an AI-generated score before it is used in a formal decision.
Send your request to privacy@reppic.ai. If your employer is the data controller, we will forward your request to them and assist in processing it. We will respond within 30 days.
You may file a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl
13. Changes
We will notify users of material changes through the app, by email, or—if the employer is the data controller—through the customer organization.
14. Contact
The Sales Studios B.V. St. Geradushof 1, 4744 BC Bosschenhoofd, the Netherlands Email: privacy@reppic.ai Website: https://reppic.ai