Data Processing Addendum

Last updated: November 1, 2026 · Applies automatically to every customer account; a signed copy is available on request.

This Addendum forms part of the Terms of Service between the customer (“Controller”) and BENYAHIA GROUP (“Processor”) and reflects the parties' agreement with regard to the processing of personal data under the GDPR (EU 2016/679), the UK GDPR and comparable laws.

1. Subject matter & duration

Processing of personal data necessary to provide the ReplyInn service (generating, storing and publishing replies to guest reviews, collecting guest feedback, analytics and billing) for the duration of the customer's account.

2. Nature & purpose

Storage, analysis by AI language models, display to the Controller's users, publication to review platforms on the Controller's instruction, and e-mail notifications.

3. Categories of data & data subjects

Data subjects: the Controller's staff users and the authors of public reviews / private feedback (guests). Data: names or pseudonyms as published on review platforms, review text and ratings, optional guest e-mail addresses provided voluntarily in the feedback form, the Controller's account and billing details.

4. Processor obligations

Process personal data only on documented instructions of the Controller (including via the application's settings).
Ensure persons authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures described on our Security page.
Assist the Controller with data-subject requests (access, rectification, erasure, portability) — self-service export and deletion are built into the product.
Notify the Controller of a personal-data breach without undue delay and no later than 48 hours after becoming aware of it.
Delete or return all personal data at the end of the service (account deletion is immediate; backups expire within 30 days).
Make available all information necessary to demonstrate compliance and allow audits on reasonable notice, at most once a year unless required by a supervisory authority.

5. Sub-processors

The Controller gives general authorisation for the following sub-processors. We will inform the Controller by e-mail at least 14 days before adding or replacing a sub-processor; the Controller may object on reasonable grounds.

Sub-processor	Purpose	Location
Anthropic, PBC	AI generation of reply drafts (zero data retention for training)	USA (SCCs)
Hosting provider of BENYAHIA GROUP	Application servers, database, backups	EU
Stripe, Inc. / Stripe Payments Europe, Ltd.	Payments, subscriptions, invoices	USA / Ireland (SCCs)
Google LLC	Business Profile API (only for customers who connect Google)	USA (SCCs)

6. International transfers

Where data leaves the EEA/UK, transfers rely on the European Commission's Standard Contractual Clauses (2021/914) and the UK Addendum, together with supplementary measures where appropriate.

7. Liability

Liability under this Addendum is subject to the limitations of the Terms of Service.

Contact for data-protection matters: hello@replyinn.com.