Replit AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ Our Services are primarily hosted in the United States and may also be hosted in locations abroad (for example, India). If you use the Services from regions of the world with laws governing data processing, you accept that you are transferring your information to the United States and other hosting locations for storage and processing. By providing information to Replit, you agree to such transfer, storage, and processing.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 4. Survival ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Upon termination, your right to use the Service will cease immediately. If you wish to delete your account, you may request account deletion at https://replit.com/account by selecting “Request Account Deletion.” Upon account deletion, we will delete your stored data in accordance with our data retention policy and applicable law.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “we may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “We take measures to delete your information or maintain it in a de-identified form when it is no longer necessary to be kept in identifiable form for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the specific retention period, we take into account various criteria, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by applicable law and any statute of limitations. When you request to delete your account, we delete your data within 30 days.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To facilitate the connection of third-party services or applications, such as social networks;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Replit's use and transfer of information received from Google APIs to any other app is subject to Replit’s Privacy Policy and will adhere to Google's API Services User Data Policy including the Limited Use requirements.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Merger, Sale, or Other Asset Transfers. We may disclose and transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our business or assets.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We share information with the following categories of third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Other third parties. We may receive additional information about you, such as demographic data, from third parties such as data or marketing partners and combine it with other information we have about you.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “As Required by Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe in good faith that doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoenas; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Affiliates. We may share any information we receive with our corporate affiliates under common ownership or control for any of the purposes described in this Privacy Policy. Service Providers. We may share any information we receive with vendors retained in connection with the provision of our Services and that process your information on our behalf. These entities may include analytics, billing, legal support, marketing, security, machine learning, and fraud prevention companies.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Consent. We may also disclose information from or about you with your permission.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third Party App Integrations. If you connect a third-party application to our Services, we may share information such as code with that third party.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers. We may share any information we receive with vendors retained in connection with the provision of our Services and that process your information on our behalf. These entities may include analytics, billing, legal support, marketing, security, machine learning, and fraud prevention companies.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates. We may share any information we receive with our corporate affiliates under common ownership or control for any of the purposes described in this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ To facilitate transactions and payments;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Payment Information . When you add a credit card or payment method to your account a third-party service provider that handles payments on our behalf will receive and process your payment card information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The right to opt out of the sale of your personal information. We do not “sell” personal information as such term is defined in the CCPA.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Sharing Preferences. If you prefer to not have others see your code, you can upgrade to make that code private. If you import code from GitHub and your repository is public, it will remain public by default on Replit. If you wish to import code from GitHub and your repository is private, you can upgrade to ensure that your code will also remain private on Replit.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ For details of current pricing, consult our pricing page , which may be updated from time to time.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | Free | medium | “If you prefer to not have others see your code, you can upgrade to make that code private. If you import code from GitHub and your repository is public, it will remain public by default on Replit. If you wish to import code from GitHub and your repository is private, you can upgrade to ensure that your code will also remain private on Replit.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.