Last updated: March 13, 2026

1. Data controller

  • Controller: Artsessions SLU
  • Tax ID (NIF/CIF): B64848997
  • Address: Carrer de Llull 240, 08005 Barcelona, Spain
  • Contact email: privacy@replai.net
  • Data Protection Officer or contact: dpo@replai.net

2. Scope of this policy

This policy governs the processing of personal data carried out through the sites, applications, forms, integrations and services offered by REPLAI, including replai.net, app.replai.net, employees.replai.net, as well as the PWA and the mobile applications for employees on iOS and Android.

This policy covers both the processing activities in which Artsessions SLU acts as data controller and those in which it acts as data processor on behalf of its clients.

3. What data we process

Depending on the relationship maintained with REPLAI and the features used, we may process the following categories of data:

  • Identification data: name, surname, username, profile picture, internal identifiers and professional data.
  • Contact data: email, telephone, professional address and data associated with the project or company.
  • Access and authentication data: credentials, login records, tokens, session identifiers and security data.
  • Contractual and billing data: subscriptions, plans, licenses, client data, invoices, payments and consumption.
  • Platform usage data: logs, activity, events, metrics, technical traces, preferences and actions performed within the service.
  • CRM and lead generation data: forms, leads, contacts, companies, business opportunities, notes, communications and marketing data.
  • Communications data: emails sent or received through the platform, templates, confirmations, notifications and operational messages.
  • Document data: uploaded files, documents, metadata, categories, external identifiers and references to storage.
  • Electronic signature data: signatories, signature evidence, traceability of the process, acceptance of consents and, where applicable, biometric data linked to the signing process, always under the configuration and legal basis corresponding to the client.
  • Employment and employee data: time tracking, requests, holidays, absences, schedules, tasks, employment documents, geolocation associated with time tracking when the feature is enabled, and employee profile data.
  • Attendance / Classlife data: classes, sessions, attendance, students, teachers and statuses linked to attendance control when the client has that module enabled.
  • Integration data: identifiers and metadata from Slack, LinkedIn or other services connected by the client or user.
  • Browsing data: IP address, online identifiers, browser, device, language, time zone, cookies and similar technologies.

4. Purposes of processing

We process personal data for the following purposes, depending on the case:

  • Managing web browsing and the security of our sites and applications.
  • Creating and administering user accounts, projects, permissions, roles and access.
  • Providing the services contracted by the client, including chatbot, CRM, electronic signature, employee management, attendance, integrations and social publishing modules.
  • Managing contact forms, information requests, demos and REPLAI's own commercial communications.
  • Sending newsletters, promotional content, news or commercial communications, whether our own or managed by our clients through the CRM, where there is a legitimate basis to do so.
  • Managing tickets, incidents, technical support and customer service.
  • Managing subscriptions, billing, payments, renewals and the contractual relationship.
  • Enabling the use of third-party integrations, external authentications and connected channels.
  • Processing, storing and organizing files, documents, templates, logs and evidence associated with the service.
  • Preventing fraud, maintaining security, auditing events and complying with legal obligations.
  • Obtaining usage metrics, analytics and product improvement, including measurement of web and platform performance.
  • Offering artificial-intelligence-based features for assistance, automation, analysis, enrichment, classification, drafting or content suggestion.

5. Legal basis

The legal bases on which we process personal data may be, depending on the specific purpose:

  • Performance of a contract or implementation of pre-contractual measures.
  • Consent of the data subject, where required.
  • Compliance with legal obligations applicable to Artsessions SLU.
  • Legitimate interest of Artsessions SLU, for example in security, fraud prevention, service improvement, support, reasonable internal analytics or communications with current clients, where appropriate.

When the processing is carried out on behalf of a REPLAI client, the main legal basis vis-à-vis the data subjects shall correspond to the client itself in its capacity as data controller.

6. Processing activities in which REPLAI acts as data processor

In certain modules and features, REPLAI acts on behalf of the client and in accordance with their documented instructions, as data processor. This may include, among others, the following areas:

  • Management of employees, time tracking, requests, holidays, absences and tasks.
  • Attendance recording and synchronization with educational or academic platforms.
  • CRM, forms, leads, contacts, newsletters and commercial actions managed by the client.
  • Electronic signature and associated document processing.
  • Chatbots, conversations, automated customer service and analytics associated with the service configured by the client.
  • Social, messaging or productivity integrations activated by the client.

In these cases, responsibility for the legitimacy of the processing, the uploaded content and the information provided to the data subjects lies with the client using REPLAI as a tool.

7. Recipients and categories of recipients

We may disclose or grant access to personal data to:

  • Authorized staff of Artsessions SLU.
  • Clients or authorized users within each contracted project or environment.
  • Technology providers and sub-processors that provide services necessary for the operation of REPLAI, such as cloud infrastructure, email delivery, authentication, storage, embedded video, AI, social networks, business messaging or security tools.
  • Administrative, judicial or competent authorities when there is a legal obligation.

REPLAI does not sell personal data to third parties.

8. International transfers

As a general rule, REPLAI prioritizes hosting and infrastructure within the European Economic Area. However, certain third-party providers or integrations may involve access, storage, support or processing from outside the EEA.

When an international data transfer takes place, it will be carried out with the appropriate safeguards required by applicable regulations, such as adequacy decisions, standard contractual clauses or other mechanisms valid at any given time.

9. Retention periods

Data will be retained:

  • For the time necessary to fulfill the purpose for which it was collected.
  • As long as the contractual or service relationship is maintained.
  • For the legally required periods in commercial, tax, accounting, employment, evidentiary or security matters.
  • Until consent is withdrawn, when the processing depends on it, without prejudice to processing already carried out.
  • In the case of platform clients, while the subscription or contractual relationship remains in force and subsequently during the legally required blocking or retention periods.

10. Browsing data, cookies and similar technologies

REPLAI uses cookies and similar technologies, including technical, analytics and, where applicable, personalization or measurement cookies, as well as solutions such as Google Analytics / GA4, Google Tag Manager, anti-spam or anti-fraud mechanisms such as CAPTCHA, embedded players or content, and the chatbot embedded on client websites.

Detailed information about these technologies, their purposes and consent management is available in the Cookie Policy.

11. Artificial intelligence and automations

REPLAI may incorporate features based on artificial intelligence and automation to assist with tasks such as drafting, classification, data enrichment, automated responses, summary generation, information analysis or command interpretation.

These features may rely on specialized technology providers. When the client enables such tools to process third-party data, they must ensure that they have a sufficient legal basis and that they do not enter information they are not entitled to process.

REPLAI recommends human supervision of the results when they may produce relevant legal, employment, commercial or reputational effects.

12. Security

REPLAI applies reasonable technical and organizational measures to protect personal data against loss, alteration, unauthorized access, improper disclosure or unlawful processing, taking into account the nature of the data, the state of the art, the existing risks and the context of the processing.

However, no system is completely invulnerable, so absolute security cannot be guaranteed.

13. Rights of data subjects

Data subjects may exercise, where applicable, their rights of:

  • Access
  • Rectification
  • Erasure
  • Objection
  • Restriction of processing
  • Portability
  • Withdrawal of consent

To do so, they may write to privacy@replai.net or dpo@replai.net, indicating their request, the data necessary to identify them and, where applicable, providing proof of identity.

If the processing is carried out by REPLAI on behalf of a client, the request may be redirected or must be exercised before the client acting as data controller.

Likewise, if data subjects consider that their rights have not been properly addressed, they may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

14. Minors

REPLAI does not offer its services directly to minors nor does it direct its sites or applications to children. When REPLAI clients use the platform in educational, employment or training contexts involving third-party data, those clients shall be responsible for ensuring proper legitimacy and compliance with their information duties.

15. Commercial communications

REPLAI may send its own commercial communications when there is consent or a prior relationship that allows such sending in accordance with applicable regulations.

Likewise, certain clients may use CRM, form or newsletter modules to manage their own commercial communications, with REPLAI acting in that case as technology provider or data processor.

Each commercial communication will provide, where applicable, a mechanism to object or unsubscribe.

16. Changes to the privacy policy

REPLAI may update this privacy policy to adapt it to legal, technical, operational or product changes. When the changes are significant, the updated version will be published through the appropriate channels.