Privacy policy

No data protection officer has been appointed, as the conditions of Art. 37 GDPR are not met. For any privacy question, an informal email to the address below is sufficient.

Controller

Timon Faux

Address

Brunhildengasse 28, 3424 Zeiselmauer, Austria

Email

info@replai.at

Phone

+43 670 657 6274

Only data required for the respective purpose is processed. Data is neither sold nor passed on to third parties for advertising purposes. All service providers process data solely on our instructions under a data processing agreement pursuant to Art. 28 GDPR.

When the website is accessed, your browser transmits technically necessary data, which the hosting provider processes in server log files.

• IP address of the requesting device
• date and time of access
• address requested and volume of data transferred
• browser type, browser version and operating system
• where applicable, the previously visited page (referrer)

The purpose is the technical provision, stability and security of the website. The legal basis is our legitimate interest in secure and uninterrupted operation pursuant to Art. 6 (1) (f) GDPR. This data is not merged with other data sources.

When you join the waitlist, your email address is stored. A message containing a confirmation link is then sent. Consent is only deemed given once you click that link (double opt-in). The sole purpose is to put you on the waitlist and to contact you when the test phase starts. We do not send a newsletter or advertising beyond that.

The following is stored:

• first and last name
• company or property name
• property management system in use (free text possible)
• phone number, where voluntarily provided
• email address
• selected language version
• time of consent and the wording of the consent text (record-keeping obligation under Art. 7(1) GDPR)
• time of confirmation
• origin of the entry and, where applicable, campaign parameters and the referring page
• two randomly generated identifiers for the survey and for unsubscribing

First and last name as well as company or property name are mandatory: the first beta wave is supported personally. The phone number is voluntary; signing up works just as well without it.

The legal basis is consent pursuant to Art. 6 (1) (a) GDPR. Consent may be withdrawn at any time with effect for the future — via the unsubscribe link in every email or informally by message to info@replai.at. The lawfulness of processing carried out until withdrawal remains unaffected.

If confirmation does not take place within the validity period of the link, the entry is deleted.

After signing up you may answer a few questions about your rental situation. Participation is voluntary and can be stopped at any time; your waitlist entry is unaffected.

Processed are the selected answer options, the free text entered for them, the voluntary indication of the exact number of properties, and the progress status. Answers are linked to the waitlist entry via a randomly generated identifier.

The legal basis is consent pursuant to Art. 6 (1) (a) GDPR. The purpose is prioritising product development.

Messages can be sent via the contact form on the contact page and below the frequently asked questions. Processed are first and last name (where provided), email address, subject and the content of the message.

The legal basis is Art. 6 (1) (b) GDPR where the enquiry is aimed at concluding a contract, otherwise our legitimate interest in responding to enquiries pursuant to Art. 6 (1) (f) GDPR.

On the integrations page you can also indicate which channels and which system you use in order to be informed about a future connection. Processed are the selection made and the email address. The legal basis is consent under Art. 6(1)(a) GDPR.

To prevent automated bulk sign-ups, the IP address is briefly evaluated in memory when forms are submitted and compared against a frequency limit. The IP address is not stored permanently for this purpose.

The legal basis is our legitimate interest in protection against abusive use pursuant to Art. 6 (1) (f) GDPR.

Without consent: Plausible Analytics, operated by Plausible Insights OÜ, Estonia, is used to evaluate page views. Plausible sets no cookies and builds no cross-device profiles. No personal data is stored; the evaluation is aggregated only. Processing takes place on servers within the European Union. The legal basis is the legitimate interest in a data-minimising evaluation of website use under Art. 6(1)(f) GDPR. Since no device information is stored or read, no consent is required.

With consent only: Google Analytics 4 is additionally used, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies on the device, assigns a random identifier and evaluates, among other things, pages viewed, time on page, traffic source and device information. The “granular location and device data collection” setting is enabled: this also captures the approximate location at city level and more detailed device information such as device model, browser version and screen resolution. The IP address is truncated by Google before storage; according to the provider, the full IP address is not transmitted to Google.

The random identifier stays within Google Analytics and is not merged with a Google account: Google signals are disabled for this property. There is therefore no cross-device attribution to a person, and no demographic or interest profiles are evaluated.

No user-provided data is transmitted to Google Analytics either. No customer data is sent, and automatic detection of form fields is switched off. Email addresses from the waitlist, the survey and the contact form do not reach Google Analytics.

Google Analytics is loaded only after prior, active consent. As long as no consent has been given, no script is requested from Google and no connection to Google is established. The legal basis is consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act 2021.

Contentsquare (formerly Hotjar), operated by Content Square SAS, 7 rue de Madrid, 75008 Paris, France, is likewise used only with consent. The service builds heatmaps and records the course of individual visits: mouse movement, clicks, scrolling and page changes. This shows where visitors drop off.

Form entries are not recorded. The fields concerned are explicitly marked for masking in the page source; name, company, email address, phone number and free text appear obscured in any recording. Here too: no Contentsquare script is loaded without prior consent.

The legal basis is consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act 2021. It can be withdrawn at any time via “Cookie settings” in the footer.

Consent is voluntary and can be withdrawn at any time with effect for the future — via the “Cookie settings” entry in the footer of every page. On withdrawal, the cookies set by Google are deleted. Advertising features are not enabled: the property is not linked to any Google Ads account, and no remarketing audiences are built. The website is fully usable without consent.

Without consent, only the following strictly necessary entries are set. They are essential for functions the user has expressly requested and are therefore exempt from consent under § 165(3) of the Austrian Telecommunications Act 2021.

Only after consent are the Google Analytics cookies added:

These cookies are set only after consent to the use of Google Analytics has been given. If consent is declined or withdrawn, they are not set or are deleted.

The following processors are involved. Agreements pursuant to Art. 28 GDPR are in place with all of them.

Processing takes place in data centres within the European Union. Vercel, Supabase and Resend are companies based in the United States. Access from a third country — for example during maintenance or support — can therefore not be entirely ruled out.

In that case the transfer is based on the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR or on certification under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR.

For Google Analytics, the contracting party is Google Ireland Limited, based in Ireland. Access by Google LLC in the United States cannot be ruled out. The transfer is based on Google LLC's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, additionally, on the Standard Contractual Clauses. Anyone who does not want this transfer simply declines consent — the website is fully usable without Google Analytics.

As a data subject you have the following rights against the controller:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal message to info@replai.at is sufficient. Requests are handled free of charge and within one month.

If you have concerns about the processing, you have the right to lodge a complaint with the supervisory authority:

Authority

Austrian Data Protection Authority

Address

Barichgasse 40–42, 1030 Vienna, Austria

Email

dsb@dsb.gv.at

Web

dsb.gv.at

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

This policy will be adapted as soon as processing changes — for example when the closed testing phase starts. The version published on this page at the time applies.