Privacy Policy

Replenysh, Inc. (“Replenysh,” “we,” “us,” or “our”) operates a business-to-business platform for managing material transfers, facility operations, and supply chain logistics (the “Platform”). This Privacy Policy describes how we collect, use, share, and protect information when you use the Platform or visit our website at replenysh.com (collectively, the “Services”).

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services.

How We Handle Roles

Depending on how you use the Services, Replenysh may act as a business or controller for account administration, website analytics, security, billing, and our own operations. When an enterprise customer uses the Platform to manage material flows, that customer is generally the controller (or business) of operational data about its facilities, personnel, and counterparties, and Replenysh processes that data as a processor (or service provider) on the customer’s instructions. Processor obligations for enterprise customers are defined in their written agreement with Replenysh.

1. Information We Collect

Information You Provide

• Account Information. When you or your employer registers an account, we collect your name, email address, phone number, password (stored in hashed form), role or title, and company affiliation.
• Facility and Location Data. Addresses, facility names, and designated contact persons for general, logistics, billing, and weights & measures purposes.
• Transfer and Order Data. Materials, quantities, weights, dates, carrier information, pricing, and related logistics details.
• Documents. Weight tickets, bills of lading (BOLs), certificates, photographs, and other files you upload. Documents are stored in encrypted cloud storage (AWS S3, us-west-2 region, with server-side encryption).
• Communications. Messages, emails, and other correspondence you send to us, including through our contact and demo request forms (which collect your name, email, company, phone number, and message content).

Information Collected Automatically

When you use the Services, we automatically collect:

• IP address, browser type and version, device type, and operating system
• Usage logs, including pages viewed, features accessed, and timestamps
• Referring URLs and general location data derived from IP address

On our public marketing website (replenysh.com pages outside the logged-in Platform), we limit automatic collection to privacy-oriented website analytics. See Website Analytics, Cookies, and Similar Technologies below.

Information from Third Parties

We may receive information from third-party carrier and logistics integrations connected to your account, including shipment status, tracking data, and delivery confirmations.

Website Analytics, Cookies, and Similar Technologies

Our marketing website uses PostHog for website analytics so we can understand aggregate traffic, page performance, and how visitors find our content. We do not use advertising cookies, retargeting pixels, or cross-site tracking technologies on this marketing site.

On the marketing website, we configure PostHog to:

• Operate in cookieless mode, without storing analytics identifiers in browser cookies or local storage
• Avoid creating individual marketing profiles or calling identify() for anonymous visitors
• Disable session replay, autocapture of page interactions, and exception capture that could include personal data
• Honor browser Do Not Track signals where applicable

PostHog may process technical data such as browser type, operating system, page URLs, referrer, and a privacy-preserving daily visitor hash calculated on PostHog’s servers. We treat that hash as non-identifying aggregate analytics data rather than a persistent personal identifier.

We store a single local preference if you opt out of website analytics through our Privacy choices control. That preference is used only to honor your choice and is not used for advertising.

Contact and demo forms on the marketing site are handled by Formspree. Submitting a form is a separate, intentional action governed by the information you choose to provide.

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Services, including processing material transfers, generating documents, and coordinating logistics
• Communicate with you about your account, orders, and service updates, including via email and SMS
• Improve the Platform through analytics, usage trends, and feature development
• Ensure security by detecting and preventing fraud, unauthorized access, and other harmful activity
• Comply with legal obligations, including record-keeping and regulatory requirements
• Enforce our Terms of Use and protect our rights

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Service Providers

We use third-party vendors to help operate the Services:

Partner Companies

When you initiate or participate in a material transfer, relevant transfer data (materials, quantities, dates, facility information) is shared with the counterparty as necessary to fulfill the transaction.

Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

If Replenysh is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

• Encryption at rest for stored documents (AWS S3 server-side encryption)
• Encryption in transit via HTTPS/TLS for all data transmission
• Token-based authentication (JWT) for platform access
• Audit trails to track data access and modifications
• Soft deletion to prevent accidental permanent data loss

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

When an account is terminated, data is soft-deleted and remains available for export for 30 days. After that period, data may be permanently removed, subject to the following retention schedule:

6. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you, and to object to or restrict certain processing. You may submit a request by contacting privacy@replenysh.com. We will verify your request and respond within the timeframe required by applicable law, and in any event within 30 days unless an extension is permitted.

Website Analytics Choices

You can opt out of marketing-site analytics at any time using the Privacy choices link in the site footer. When you opt out, we stop loading analytics on future visits. Because our marketing analytics are cookieless and do not build advertising profiles, no cookie consent banner is shown.

To re-enable analytics, open Privacy choices again and turn website analytics back on.

European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, UK, or Switzerland, our legal bases for processing include:

• Contract when processing is necessary to provide the Platform or respond to your requests
• Legitimate interests to operate, secure, and improve our Services, including privacy-oriented website analytics on replenysh.com that do not use advertising cookies
• Legal obligation where we must retain or disclose information under applicable law
• Consent where required, such as for certain marketing communications

Where we rely on legitimate interests for website analytics, you may object by using Privacy choices or contacting us. We balance those interests against your rights and offer lightweight analytics without session replay or advertising trackers.

PostHog processes marketing-site analytics data in the United States. We rely on appropriate safeguards for international transfers, including vendor contractual protections. You may contact us for more information about transfer mechanisms that apply to your data.

Please note that certain data may be retained as required by law or for legitimate business purposes (for example, completed transfer records for regulatory compliance). If you are an employee or contact of an enterprise customer, we may direct your request to that customer when it controls the relevant data.

United States State Privacy Rights

Residents of California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have additional rights, including:

• Right to know what personal information we collect, use, disclose, and retain
• Right to access and receive a portable copy of certain personal information
• Right to correct inaccurate personal information
• Right to delete personal information, subject to legal exceptions
• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Right to non-discrimination for exercising privacy rights

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising in a manner that would constitute a “sale” or “share” under California law. Our marketing website does not use ad pixels or data brokers. If our practices change, we will update this policy and provide a clear opt-out mechanism.

California residents may use Privacy choices or email privacy@replenysh.com with the subject line “California Privacy Request” to exercise applicable rights.

Authorized agents may submit requests on your behalf where permitted by law. We may require proof of authorization and verification of your identity before fulfilling a request.

7. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and, where required, relevant authorities within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, the data involved, and steps we are taking in response.

8. Right to Audit

Enterprise partners may request information about our security practices, data handling procedures, and technical safeguards. Requests should be directed to privacy@replenysh.com.

9. SMS Communications

By providing your phone number, you consent to receive transactional and service-related SMS messages from Replenysh. Message frequency varies. Message and data rates may apply.

To opt out of SMS messages, reply STOP to any message or contact us at privacy@replenysh.com. Opting out of SMS will not affect other communications from us.

10. Age Requirements

The Services are business-to-business offerings directed to adults. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. If you believe someone under 18 has provided us with personal information, please contact us at privacy@replenysh.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the “Last Updated” date above. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Replenysh, Inc.
A Delaware corporation
Email: privacy@replenysh.com
Mailing address: 3198 Airport Loop Ste C, Costa Mesa, CA 92626