Privacy policy

Last updated 2026-09-28

GroundedReply (NETBEARS TEAM SRL) processes personal data to run the service described here. GroundedReply drafts client email replies citing the client's own QuickBooks/Xero ledger line and the firm's written procedure, for one-click owner approval.

1. Data controller

NETBEARS TEAM SRL, VAT ID RO37261366, Corneliu Baba 8, Iași, Romania, is the data controller for the personal data we collect to run GroundedReply (groundedreply.com) for you: your account, billing, support and technical data described below.

For personal data about other people contained in the content you submit for processing (for example names or contact details inside your documents), your organisation is the controller and we act as its processor, processing that data only on your instructions and only to provide the service. A data processing agreement is available on request at hello@groundedreply.com.

2. What personal data we collect

• Account data: email address, and password (Amazon Cognito, our identity provider, stores a salted hash — we never see or store your password in plain text). If you sign in with a federated provider we configure, we also receive the identifier and verified-email status that provider sends us.
• Content you submit for processing: Client email question (pasted text); Firm's written procedures / engagement-letter text; Client QuickBooks Online / Xero ledger export or category totals.
• Billing data: purchases and credit balance are recorded in our own ledger. Card details are collected and processed by Creem, our payment processor and merchant of record — we never see or store your card number.
• Usage and support data: messages you send us through the contact form or by email, and API keys you create (we store only the last 4 characters and metadata; we never store the full key in our database).
• Technical logs: the IP address and request details API Gateway, Lambda and Step Functions record for every request, for security and abuse investigation.

3. Purposes of processing

• Providing the service described above.
• Account authentication and access control.
• Processing payments and maintaining the credit ledger.
• Sending you the notifications this product describes: Job finished email with the drafted reply and its citations, and replying to messages you send us.
• Keeping the service secure and investigating abuse.

4. Legal basis for processing

We process your data under the following legal bases (GDPR Article 6): performance of a contract (providing the service you signed up for and processing payment for it), legitimate interest (service security, abuse prevention), and legal obligation (retaining financial records, responding to lawful requests from ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) or ANPC (the Romanian National Authority for Consumer Protection)).

5. Data sharing

We share personal data only with the processors needed to run the service, each under its own data processing terms:

• Amazon Web Services (AWS) — hosting and storage, all in the eu-central-1 (Frankfurt) region.
• Amazon Bedrock, an AWS service — documents you submit are processed by the Claude model running on Bedrock's EU cross-region inference profile, entirely within AWS's infrastructure. AWS is the processor for this call; Anthropic, the model's developer, does not receive your data, and the call is not used to train any model.
• Creem — our payment processor and merchant of record for credit-pack purchases. Creem is an independent data controller for the payment data it collects: it handles your card data, applicable sales tax/VAT, and issues your invoice/receipt under its own privacy policy.
• Amazon SES — sends this product's own notifications to you (see purposes of processing above).

We do not sell personal data, and we do not share it for advertising.

6. Data storage and security

Your data is stored in AWS's eu-central-1 (Frankfurt, Germany) region: encrypted at rest, encrypted in transit (TLS), with access limited to what the service needs to run.

6a. International data transfers

AWS processes your data exclusively in the EU for this service (eu-central-1 hosting, the EU Bedrock inference profile); Anthropic does not receive your data (see data sharing above). Creem, as an independent controller for payment data, may process billing data outside the EU under its own compliance framework (including Standard Contractual Clauses where applicable); see Creem's own privacy policy for details.

7. Retention

• Uploads never used in a job: deleted after 72 hours.
• Failed, rejected or unpaid jobs: their files are deleted after 14 days.
• Paid work: kept for 365 days from when the job started, so you can re-download results; you can delete a job at any time before that.
• Credit ledger: kept as a financial record, as long as the law requires — currently up to 10 years in Romania — a legal obligation, not deleted when a job or account is deleted.
• Contact form / email messages: kept 365 days, so we can find the history of a conversation with you.
• Technical logs: API Gateway, Lambda and Step Functions logs are kept 30 days. The contact form's rate limiter keeps the submitting IP address for about 1 hour, purely to block bursts of spam.
• You can delete a job, or your whole account, from the dashboard at any time; account deletion removes your stored content and rows at once (the ledger is kept, per above).

8. Automated processing and the use of artificial intelligence

Claude, running on Amazon Bedrock, drafts results from the content you submit. How a draft is checked before it is ready is specific to this product. The firm's own reviewer verifies the two named cited sources and clicks approve before any reply is sent.

9. Your rights

Under the GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ("right to be forgotten"); request restriction of processing; data portability; and object to processing based on legitimate interest. To exercise any of these, email hello@groundedreply.com. You also have the right to lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) (see complaints below).

9a. Minors

GroundedReply is a business tool for companies and the people who work for them. It is not directed at, and we do not knowingly collect data from, individuals under 18.

9b. Data Protection Officer (DPO)

NETBEARS TEAM SRL has not appointed a statutory Data Protection Officer, as our processing does not meet the GDPR's mandatory-DPO thresholds. Data protection questions can be sent to hello@groundedreply.com.

10. Complaints

If you believe we have not handled your personal data properly, please contact us first at hello@groundedreply.com. You may also lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing): https://www.dataprotection.ro/.

11. Changes to this policy

We may update this policy as the service changes. The date at the top of this page is when it was last updated; material changes will also be noted on this page.

12. Contact