Privacy policy

1. Person responsible for personal information

In accordance with section 8.1 of the Act, we have designated a Person in charge of the protection of personal information (PIPPI). You may contact them for any question, request or complaint related to your information:

Widmaer Telisma, Person in charge of the protection of personal information, Anmaer Software (9550-5582 Québec Inc.) · privacy@langreply.com

2. What personal information we collect

We only collect what we need to provide the service. Depending on how you use LangReply:

• Account and billing: name, email address, company (optional), billing address, payment information (processed by Stripe — we never see your card number).
• Mailbox connection: address of the mailbox you connect and the encrypted credentials required for LangReply to receive and send translated messages on your behalf.
• Message content: the messages we translate transit through our translation engine hosted on our own servers. For rare languages or when the self-hosted engine is unavailable, a partner AI engine (Anthropic) may be used; in that case the text being translated is sent to that provider only for the processing time and is not retained by it. Messages are kept only for the time strictly needed for delivery and short-term diagnostics.
• Technical logs: IP address, browser type, pages viewed, security events. Used only for security, fraud prevention and service reliability.
• Cookies: only strictly necessary cookies by default (language choice, cookie consent, session). Optional cookies (analytics, marketing) require your explicit consent — see the cookie banner.

3. Why we use it (purposes)

• Provide the LangReply service (translate, relay, transcribe, summarize).
• Manage your account, subscription and billing.
• Ensure security, prevent fraud and abuse, keep audit trails required by law.
• Communicate with you about the service (technical notices, updates you asked for).

4. How long we keep it

We keep your personal information only as long as necessary for the purposes above, and never longer than legally required. When a purpose ends, information is deleted or anonymized. Concretely:

• Account & subscription data: kept for as long as the account exists; deletion is carried out on request, from your dashboard or through our person in charge of the protection of personal information.
• Translated messages: no long-term storage — only the transit needed for delivery. Short indexes and logs are kept up to 90 days for diagnostics, then deleted.
• Technical logs (security): 6 months.
• Cookie choices: up to 12 months (you can change them at any time).

5. Who has access

Access is limited to the LangReply staff who strictly need it to operate the service, under written confidentiality obligations. Data is encrypted at rest, protected by role-based access and two-factor authentication. We do not sell your personal information — ever.

6. Third parties who process your data on our behalf

We use a small number of vetted service providers, bound by a written data-processing agreement, or in the process of being contracted for the optional channels. As of the date of this policy:

• Stripe (payment processing) — payment data are processed directly by Stripe, we never see or store your card number.
• Hetzner Online GmbH (server hosting) — data centre in Helsinki, Finland (European Union).
• Cloudflare — DNS management only. Web traffic does not transit through Cloudflare; no message content is transmitted to it.
• Twilio (SMS and phone verification) — the phone number involved is processed by Twilio to send and receive text messages.
• Resend (email delivery) — used to deliver our transactional emails and translated messages.
• Anthropic (translation fallback engine and call summaries) — used only for certain rare languages, when our own engine is unavailable, or to summarize a call; the relevant content is then sent only for the duration of processing and is not retained by it.
• Meta Platforms / WhatsApp (WhatsApp Business messaging) — if the corresponding channel is enabled: the messages exchanged transit through Meta's infrastructure to reach your contact.
• Microsoft (Microsoft Graph, Outlook, Teams) — if the corresponding channel is enabled: access to your mailbox or your Teams conversations goes through the Microsoft APIs.
• Slack Technologies (Slack channel) — if the corresponding channel is enabled: messages from your Slack workspaces transit through the Slack APIs.
• Zoom Video Communications (Zoom channel, meeting summaries) — if the corresponding channel is enabled: meeting transcripts and messages transit through the Zoom APIs.
• GitHub (Microsoft) — encrypted off-site backups, United States. The backup repository excludes OTT/SMS messages and their keys.
• Backblaze B2 — encrypted off-site backups, United States. Backup storage excludes OTT/SMS messages and their keys.

7. Transfers outside Quebec / Canada

Some of our providers are located outside Quebec (Hetzner in Helsinki, Finland — EU/GDPR; Stripe, Cloudflare, GitHub and Backblaze in the United States and worldwide). Before any transfer, we assess the applicable protection framework and ensure your information receives protection equivalent to that provided by Quebec law, through standard contractual clauses and technical safeguards. You may contact us to obtain more details on any specific transfer.

8. Your rights under Law 25

You have the following rights over your personal information, exercisable free of charge by contacting our PIPPI (privacy@langreply.com):

• Right of access — obtain a copy of your personal information.
• Right of rectification — correct inaccurate or incomplete information.
• Right to withdraw consent — at any time, for any optional processing.
• Right to data portability — receive your information in a structured, commonly used technological format.
• Right to cease dissemination and de-indexation — request that we stop publishing information or that a search engine no longer link it to your name, in the circumstances provided by law.
• Right to be informed of automated decisions and to submit observations. LangReply does not use automated decisions that would produce significant effects on you.

We respond within 30 days. If you believe we have not honored your rights, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca.

9. Security measures

Data are encrypted at rest (AES-256-GCM), in transit (TLS 1.2+ minimum), access is protected by strong passwords hashed with scrypt, two-factor authentication (2FA/TOTP), role-based access control, brute-force rate limiting and a full audit log. In the event of a confidentiality incident presenting a serious risk of injury, we notify the CAI and the affected persons in accordance with section 3.5 of the Act.

10. Minors

LangReply is a business service intended for professional users. We do not knowingly collect personal information from children under 14. If you believe this has happened, contact us and we will remove it promptly.

11. Changes to this policy

We may update this policy. Substantial changes are announced on the site and, when required by law, communicated by email. The date at the top always indicates the most recent version.

12. Contact

Anmaer Software (LangReply) · Person in charge of the protection of personal information · privacy@langreply.com · anmaer.com