Where your data goes. And who can see it.
Replicate Labs holds what you type, paste and say to a coach. It sends that to OpenAI to answer, stores it in Google Cloud's London region, and keeps your account technically isolated from every other one. This page follows the data through in the order a user asks. The Privacy Policy and the DPA are the binding versions and say the same thing in full.
- Updated 22 July 2026
- SOC 2 Type 2 · clean, no exceptions raised
- UK GDPR
- No model training
Four things, before the detail.
Your name, email and job title. Which coaches you talk to, when, and for how long. Everything you type, paste or say to a coach.
When you paste a deal, a transcript or a draft email, that text goes to OpenAI, the provider that answers the coaches, so the coach can reply. Every other company that touches it is named below, with its country.
No model is fine-tuned on your data, ours or a provider’s. The providers we use commit to the same in their enterprise terms.
Nothing in your account is visible to any other account. We do not sell your data, or any derivative of it, to anyone.
Four categories. It runs the platform, and that is the whole job.
This is the shape of one user's record as it sits in the database, field by field. Nothing outside it is collected. Everything inside it exists for one of four reasons.
- Run the platform. Show you the right coach. Remember your past sessions. Bill you correctly.
- Coach you. Send your message to the provider that powers the coach you are talking to. The answer comes back, we render it, you see it.
- Make the product better. Aggregate, anonymised metrics: retention, feature use, error rates. Never re-identified or sold.
- Support you. When you raise a ticket, we read it. When you book onboarding, we prepare from what you have already done.
- Name
- Job title
- Password (hashed)
- Plan
- Coaches spoken to
- When, and for how long
- Platform performance
- Messages to coaches
- Transcripts pasted in
- Knowledge Base uploads
- Roleplay recordings, if by voice
- Handled by Stripe. We see the invoice, not your card.
Each account is a wall. Each user-and-Coach combo is a window.
Your coaching data cannot be accessed from any other account through the application. Inside your account, a user talks to a coach and that conversation is theirs.
Every coach runs its own prompt and its own method. A conversation between a user and their coach is a window: the user sees it, the coach sees it. Other ordinary users in your account do not.
On Platform, Bryce reads user sessions across the account so leaders get the read on what is working and where the gaps are. His reports stay inside your account.
Your account admins can see coaching activity on the seats they pay for. No user, coach or admin in any other account sees it.
Who can see your coaching depends on the account.
Most of this page is written for the person who bought the platform. This part is for the person using it, so it starts with the account.
- An account you set up yourselfNobody else
There is no Bryce, no admin and no team analytics on an account you set up alone, and nobody else on it to see anything. Your coaching is yours.
- Platform seatsThe account owner
Whoever owns the account gets Bryce and team analytics, so they can see coaching activity across the seats they pay for. That is what Platform is for, and the pricing page says so.
- Platform, with SSOYour organisation
SSO, SCIM and audit logs on top. Your organisation owns the account and decides who administers it.
Your name, email and job title. Which coaches you speak to, when, and for how long. Everything you type or paste into a coach. Your roleplay recordings, if you practise by voice.
If you set the account up yourself, you are our customer and you deal with us directly. If your company bought Platform, they own the account: they are the data controller, we are the processor, and we act on their instructions.
Signed up yourself? Email us and we will handle it. On a company account? Ask them first, because we act on the account owner’s instruction. Either way we delete within 30 business days of the Services ceasing.
Your database is in the UK. Several sub-processors are not.
Every transfer out of the UK runs under standard contractual clauses and the UK Addendum. Where an organisation needs its primary data held in the United States, a US region is available on request.
- UKThe platform and the primary database.
Google Cloud hosts both in the London region. Anam, which powers avatar video, is UK too.
The record lives here. - ATSupport chat.
Gleap runs the in-platform support chat from Austria.
Support tickets only. - USInference, transcription, and the Knowledge Base.
OpenAI answers the coaches. Deepgram transcribes voice. Pinecone stores and searches your Knowledge Base uploads, so that content is stored in the US as well as passing through it for inference. Anthropic handles back-office data processing and usage pattern analysis. Sentry, Mixpanel, Kit, Recall and Pipedream handle errors, analytics, email, optional meeting transcription and automation.
Named in Annex 2 of the DPA, with 14 days' notice before any change.
Twelve, each with a country against its name.
- Google CloudCloud hosting, primary database, data centre servicesUK
- AnamAvatar videoUK
- GleapIn-platform support chatAustria
- OpenAIAI inferenceUS
- AnthropicBack-office data processing and usage pattern analysisUS
- DeepgramVoice transcriptionUS
- PineconeKnowledge Base storage and searchUS
- SentryError monitoringUS
- MixpanelProduct analyticsUS
- KitEmailUS
- RecallMeeting transcription (optional add-on)US
- PipedreamWorkflow automationUS
The authoritative list, with full processing detail, is Annex 2 of the DPA. Stripe handles card payments and is named in the Privacy Policy instead, because billing is our own commercial relationship with you and is processed on nobody's instruction but ours.
Four things we do not do with your data.
Not us, and not the providers we send your coaching through. Their enterprise terms cover it; our DPA codifies it.
Your Knowledge Base is yours. Your transcripts are yours. Nothing in your account is visible to any other account.
Not to advertisers, data brokers or competitors.
You get 14 days’ notice, and you get the right to object.
Want it changed or deleted? Ask. legal@handle.tech, same-day reply on business days.
We delete your data, and instruct our sub-processors to do the same, within 30 business days of the Services ceasing, matching clause 11 of the DPA. Where the law requires us to keep something (billing records, fraud-prevention logs) we say so. Using the platform through your employer? Send the request to them first, since they are the controller and we act on their instruction. Write to us anyway and we will help them answer you.