ReplyChef privacy policy
This page explains how ReplyChef handles personal data and consent choices on the marketing site.
Last updated: July 2026
1. Controller and scope
NEXAVA, operating the ReplyChef brand, is controller for site, prospect, account, subscription, security and support data. For certain restaurant business data processed on the restaurant’s instructions, ReplyChef may act as processor.
2. Data processed
Depending on use, data may include:
- Identity and contact details: name, email, restaurant and requests sent to ReplyChef.
- Account, subscription and technical data needed for authentication and security.
- Restaurant business data: reviews, replies, tone settings, invoices or uploaded documents where a feature provides for them.
- Browsing and consent data, according to the tools and choices described in the Cookies section.
3. Product features and business data
Guest Pulse may process reviews and reputation signals. Profit Maestro may process cost data or uploaded documents when enabled. Le Chef and The Oracle may use restaurant information and module results to produce recommendations. Features marked “coming soon” are not described as active processing.
4. Purposes and legal bases
Processing is used to provide the service, manage accounts and subscriptions, answer requests, secure the platform, deliver requested features and improve the service. The legal basis may be contract performance, legal obligation, legitimate interest or consent depending on the processing.
5. Artificial intelligence
Some analyses and proposals are generated with an AI provider, including Anthropic server-side when the relevant configuration is active. Necessary data is sent for the requested feature; ReplyChef does not publish or decide on the restaurateur’s behalf. Outputs may be wrong and must be reviewed.
6. Google, Gmail and Smart Inbox
ReplyChef offers an optional feature, Smart Inbox, which lets a restaurant owner connect their own Gmail account so that supplier invoices and accounting documents received by email can be identified and imported into Profit Maestro. The feature is strictly opt-in: unless you connect a Gmail account, ReplyChef accesses no Gmail data at all. The scopes requested are openid, userinfo.email and https://www.googleapis.com/auth/gmail.readonly, and no others.
The gmail.readonly scope is required because an invoice cannot be identified from message headers alone: ReplyChef must read the relevant message content and download the supported attachment (PDF, JPG, PNG) in order to extract the supplier, invoice number, amount and currency. It is the narrowest scope Google offers that permits this. ReplyChef never sends, modifies, deletes, moves, archives or marks email: no write scope is requested, and the code contains no Gmail write operation. The search is further bounded by an allow-list of subjects and senders: ReplyChef does not scan your entire mailbox.
What is retained is limited to derived data:
- The Gmail message identifier, the subject, the sender label and the attachment filename.
- A content fingerprint, which prevents importing the same invoice twice.
- The fields extracted from the invoice: supplier, number, total amount, currency and a confidence score.
- OAuth access and refresh tokens, encrypted with AES-256-GCM. The key is held as a server-side environment variable and is never stored in the database, so a copy of the database alone yields no usable token.
- Never stored: the body of your emails, read only to locate the attachment and then discarded; the bytes of your attachments, held in memory only for the time it takes to extract the fields and then dropped, with no binary column and no storage bucket; your Google contacts, which no requested scope covers; messages outside the bounded search; and your Google password, which ReplyChef never sees at any point.
7. Gmail: Limited Use, disconnection and deletion
ReplyChef’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide and improve the user-facing Smart Inbox and Profit Maestro features; it is not sold; it is not used for advertising of any kind; it is not used to train or improve generalised models; and it is not transferred to others except as needed to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with prior notice. Human access to Gmail data is not permitted except with your explicit consent, where necessary for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.
The only subprocessors receiving Gmail-derived data are Vercel (application hosting and serverless execution), Supabase (database hosting, eu-central-1 region, European Union) and Anthropic (extraction of invoice fields from the attachment, called server-to-server over TLS, with no general model training). All traffic is encrypted in transit with TLS.
OAuth tokens and Gmail-derived documents are retained only while the connection is active. You can disconnect at any time from the product, and you may also revoke ReplyChef’s access from your Google account settings. Disconnection performs, in this order: revocation of the token with Google; erasure from the database of the encrypted access token, the encrypted refresh token, the key version and the granted scopes, leaving only a revocation timestamp that records the disconnection without retaining any means of reopening it; then deletion of every Gmail-derived document row for the restaurant, including message identifiers, subjects, senders, filenames, fingerprints and extracted fields. If that deletion fails, the operation returns an error rather than reporting a deletion that did not happen.
One category is deliberately retained: accounting records already created. Once an invoice has become an expense entry, it is the owner’s accounting document, the same as one photographed or typed in by hand, and may be subject to statutory retention periods. Disconnecting an import channel is not an instruction to erase a set of accounts. Deleting the restaurant account removes the Gmail-derived documents entirely.
8. Providers and international transfers
Technical providers may include Supabase for database and hosting services, Vercel for web deployment, Stripe for payments, Resend for email, Loops for lifecycle communications, Sentry for monitoring, PostHog for analytics after consent and an AI provider when used. Processing locations and contractual safeguards must be verified against the applicable contracts; no blanket EU-localisation claim is made.
9. Retention and deletion
Data is retained for as long as needed to provide the service, manage the relationship and comply with legal obligations. The repository does not prove a uniform deletion deadline or a complete public account-deletion procedure; those periods must be set in the processing register and internal procedures.
10. Security
ReplyChef implements reasonable and appropriate technical and organisational measures intended to protect data against unauthorised access, alteration, loss or disclosure. The code redacts certain secrets in diagnostics; no certification, specific encryption claim or log-retention period is asserted without evidence.
11. Rights and supervisory authority
You may request access, correction, deletion, restriction, objection, portability or withdrawal of consent where applicable. Write to bonjour@replychef.fr. You may also complain to the CNIL. For future Google access, revocation must be available in the product when implemented and in the Google account.
12. Cookies and similar technologies
Consent is stored in the replychef_consent_v3 cookie and local storage key. Analytics, marketing and monitoring are disabled by default. PostHog and Sentry are initialised according to consent; non-essential analytics are not loaded before a choice. The choice can be changed or withdrawn in the cookie preferences centre.
13. Changes and contact
This policy may be updated to reflect changes to the service, providers or legal requirements. The date at the top identifies the published version. Contact: bonjour@replychef.fr.