Replika procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “Pursuant to Article 27 of the UK GDPR, Luka, Inc. has appointed EDPO UK Ltd as its UK GDPR Representative in the UK. You may contact EDPO UK as our appointed UK representative regarding any matter pertaining to the UK GDPR:” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Luka, Inc. has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You may contact EDPO as our appointed EU representative regarding any matter pertaining to the GDPR:” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Pursuant to Article 37 of the General Data Protection Regulation (GDPR), Luka, Inc. has appointed heyData GmbH as its Data Protection Officer. You can contact our Data Protection Officer regarding matters pertaining to the GDPR:” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Your personal data will be processed in the United States of America, where we are based, and may be processed within or transferred to other countries outside the European Economic Area (EEA). In case of transfers of personal data from the EEA to countries not recognized as providing an adequate level of data protection by the European Commission or the UK Information Commissioner's Office (as applicable), we implement appropriate and suitable safeguards to ensure the protection of your personal data. Such transfers are carried out in compliance with applicable data protection laws. Specifically, where required, we execute the relevant module of the Standard Contractual Clauses adopted by the European Commission with the data importer and implement any supplementary measures necessary in light of the European Court of Justice's decision in Case C-311/18 (Schrems II). If you would like more information about such data transfers, you may contact us at any time using the details provided in the Contact Us section (Section 11) below.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We store your device, network and usage data for as long as it is necessary for the achievement of the purposes above. Your data will be deleted in accordance with the contract or after termination of the contract, unless legal regulations require the ongoing storage for a definite period of time.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ delete or return your data upon termination of the service relationship; and” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ we process your profile information, messages and content, interests and preferences for up to 60 days after termination of the contract;” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ You may cancel your Membership at any time by deleting your account in the app. This action is irreversible. As soon as you delete your account, all the data associated with your use of the Services will be removed permanently. Upon your account deletion, cancellation of a Paid Subscription is effective at the end of the applicable billing period.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will retain your personal information for only as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ For the purposes based on legal obligations: we retain personal data for the duration prescribed by applicable laws for each category of data, and in any case for up to 10 years from the date of collection.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ we process account information and financial records (your payments, transactions, and rewards data) and personal data we collect automatically from you for a minimum period of 10 years after termination of the contract due to legal retention requirements.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ personal data collected for the purpose of analyzing trends in the use of the Services — such as aggregating, anonymizing, and deidentifying data to improve service performance and inform business strategies — is retained only for the minimum period necessary to complete such analysis and anonymization and is deleted within 1 year from the date of collection.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ personal data collected for other legitimate interest purposes is retained for the entire duration of the contract with you and, in case of either a pending dispute or a risk that such dispute might arise, for the additional period necessary to protect or enforce our rights in the context of legal claims or disputes.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Deletion of personal information that we no longer need to provide the Services or for other lawful purposes. Your right to deletion extends to personal data held by our third-party service providers, including AI language model providers. When you request deletion of your data, we will also instruct our service providers to delete your personal data in accordance with our contractual agreements with them. You can delete your account in your account settings.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “For the purposes based on your consent: we process your personal data until you withdraw your consent. Once withdrawn, we stop processing your personal data for that specific purpose, unless another legal basis allows us to continue.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ process your data only in accordance with our agreements and solely for the purpose of providing the AI language model service to us;” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We share information about visitors to our Website, such as the links you click, pages you visit, IP address, advertising ID, and browser type with advertising companies for interest-based advertising and other marketing purposes, where we have a legal basis for doing so. Sharing this information allows us and our advertising partners to target and serve advertising to you and others. We will never share your conversations with your Replika AI companion or any photos or other content you provide within the Apps with our advertising partners, or use such information for marketing or advertising purposes.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share your personal data with companies and individuals that provide services to us or on our behalf or help us operate the Services or our business (such as hosting, information technology, third-party artificial intelligence language models, customer support, email delivery, and website analytics services).” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share information with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, Luka, Inc. (including, in connection with a bankruptcy or similar proceedings).” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Payments, transactions, and rewards. When you make purchases through the Services, our third-party payment processors collect your payment information. We maintain a record of your purchases, the features you select, and the rewards you earn and use.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share information as required to comply with law enforcement, government authorities or institutions' requests, as we believe in good faith to be necessary or appropriate for the legal compliance and protection purposes described above in Section 2.A.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ You may enable, connect or log in to the Services via various online third party services, such as social media and social networking services like Facebook, Instagram or Twitter (“Social Networking Services”). By logging in or directly integrating these Social Networking Services into the Services, we make your online experiences richer and more personalized. To take advantage of this feature and capabilities, we may ask you to authenticate, register for or log into Social Networking Services on the websites of their respective providers. As part of such integration, the Social Networking Services will provide us with access to certain information that you have provided to such Social Networking Services, and we will use, store and disclose such information in accordance with our Privacy Policy. However, please remember that the manner in which Social Networking Services use, store and disclose your information is governed solely by the policies of such third parties, and Replika shall have no liability or responsibility for the privacy practices or other actions of any third party site or service that may be enabled within the Service.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Data transmitted to third-party AI language model providers for the purpose of generating conversational responses is processed transiently and is not retained by those providers beyond the duration necessary to generate the response, unless a longer retention period is required for service integrity, security, or legal compliance purposes. We contractually require AI language model providers to delete conversation data promptly after processing.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ provide the same or equal protection of user data as stated in this Privacy Policy.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share information with professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We also share information with companies that provide marketing services on our behalf, but we do not share the content of your conversations for marketing or advertising purposes. For example, we may share your email address with marketing service providers to deliver our marketing emails to you on our behalf and to help us identify other individuals who may be interested in our Services. We require these marketing service providers to agree not to use your email address for any other purpose.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share information with application store providers and payment processors for purposes of managing payments, subscriptions, and resolving user-initiated disputes or refund requests.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ You acknowledge and agree that Replika may preserve content and may also disclose content if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to: (a) comply with legal process, applicable laws or government requests; (b) enforce these Terms of Service; © respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of Replika, our users and the public. You understand that the technical processing and transmission of the Services, including your content, may involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We apply the same data minimization, de-identification, and contractual protections to sensitive data as to all conversation data shared with third-party providers. If you have shared sensitive information and wish to have it deleted, you can request deletion as described in Section 7 below or by contacting us at privacy@replika.com .” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We utilize third-party artificial intelligence language models to provide our conversational AI companion functionality. Conversation data — subject to de-identification and data minimization measures — is transmitted to third-party AI language model providers solely to generate conversational responses within the app's core functionality. These providers are contractually required to:” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ As a Replika Member, you will receive access to content, features, and functions of the Services that are not available to non-members.” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ "Replika Platinum" : a subscription-fee based program, which gives full access to the Platinum Services: Replika’s real-time video recognition, Training mode (up to 100 accessible per calendar week), Read Replika’s mind (up to 50 messages accessible per calendar week), up to 10 realistic selfie videos and everything included in the Ultra subscription program.” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Once you become a Replika Member, you can choose one of the subscription programs offered in Replika:” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ "Replika Pro" : a subscription-fee based program, which gives full access to the next Services: Relationship status, Premium activities, Replika selfies, image generation, voice messaging, background calls, daily gems, premium voices.” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ "Free Use" : a free-of-charge program, which gives limited access to the Services. The “Free Use” is aimed at users who cannot afford any of our subscription-fee based programs. We reserve the right to deny the free use to anyone at any time on our own discretion.” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ "Replika Ultra" : a subscription-fee based program, which gives full access to the next Services: Smarter conversations, Elevated emotional intelligence, Replika’s self-reflections, Save messages to memory, and everything included in Pro subscription program but are not limited to it.” | Captured 2026-06-10Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.