Privacy policy

Effective date: 2026-10-22.

LittleReply is operated by RyactApps LLC, a limited liability company (LLC) formed in New York, United States.

RyactApps LLC is responsible for processing needed to manage its service. For customer-form content, the customer determines the purposes and processing instructions; the operator acts on its behalf under those instructions and applicable obligations. Processing terms and relevant safeguards can be requested from the privacy contact.

This policy covers visitors to https://littlereply.com, account holders, administrators, collaborators, and people using our customers’ forms. The service targets businesses and individuals (consumers) in France, United States; the operator is established in New York.

The customer website remains the first contact for data in a form whose purpose it defines.

The service is not limited to visible form fields. Authentication, private files, diagnostics, and support exchanges may also process data.

• —Account, email address, and authentication
• —Form fields, attachments, and recipients
• —Authorized usage events and technical diagnostics
• —Support exchanges
• —Billing identifiers and states supplied by Stripe

Data comes from users and visitors, browsers, forms, hosting logs, configured integrations, and payment and authentication providers. Support collection depends on the message sent to the product contacts.

Account management, requested features and billing rely on performing the contract or taking pre-contractual steps. Security, abuse prevention and necessary diagnostics rely on the legitimate interest in protecting the service and its users, with proportionate measures. Necessary tax and accounting records meet applicable legal obligations. Optional audience measurement relies on your permission, which can be withdrawn without preventing service use. For customer forms, the customer determines the purpose and legal basis; the operator processes data under its instructions and applicable obligations.

• —Provide and administer forms
• —Secure access and limit abuse
• —Provide support
• —Measure the journey with permission
• —Manage subscriptions after activation and meet applicable obligations

Providers act according to their roles, settings, and actual activation. This list alone implies no classification as a sale or advertising sharing, nor any complete absence of disclosure.

Stripe processes payments and subscriptions. The service uses customer identifiers, subscription status, and invoice information needed to manage your account. Card details entered in Checkout are processed by Stripe.

Authentication cookies maintain the session. Optional journey and usage measurement starts only after permission and can be withdrawn through “Audience measurement choices”. PostHog, hosted in the United States, receives allowlisted events. A random session identifier and, after sign-in, a pseudonymous account identifier link the journey. We do not send session recordings, form contents, email addresses, phone numbers or full URLs to PostHog. Withdrawal stops new deliveries and cancels queued events; it does not automatically erase events already received. Contact us to request deletion. Hosting technical logs are separate.

Measurement permission can be changed using the ‘Audience measurement choices’ control.

Messages: 90 days by default, configurable per form. Deletion schedules related file deletion. In our database: navigation events 90 days, plan transitions 365 days. Copies sent to PostHog follow the PostHog project retention. Private exports expire according to their configured duration. Independent backup and purging still need activation.

Messages already sent to an inbox or integration are also subject to that destination’s rules. Provider logs and backups follow their own periods and applicable obligations; immediate deletion of every copy is not promised. Retention exceptions are limited to the data necessary for their purpose.

Acceptance evidence includes the account identifier, accepted versions and text, mechanism and server timestamp. It is retained while the account exists and for 30 days after effective account deletion, then purged by maintenance processing. It contains no card details. This period does not cover invoices, accounting documents, dispute files or data Stripe or another provider must retain for its own legal obligations; those records follow the periods applicable to their purpose and are limited to what is necessary.

The service uses access controls, workspace isolation and private storage. Files and notifications are processed according to their verification and delivery states. Authorized people access data according to their role. No measure guarantees absolute security; personal-data incidents are subject to the notifications and actions required by applicable law. The service does not claim HIPAA or SOC 2 certification.

Contact the operator to request access, correction, erasure, restriction, portability or objection where these rights apply. You can withdraw audience-measurement permission at any time, without retroactively affecting lawful processing. Proportionate identity checks may be needed. GDPR requests are normally answered within one month; a justified extension is notified within that period where permitted. You can complain to the CNIL or the competent authority where you live. For a customer form, first contact the site that determines its purpose; the operator assists under its instructions.

Primary storage is configured in Frankfurt. The CDN, logs, support, notifications, payments and optional AI features may involve processing in other countries, including the United States. A transfer subject to the GDPR must rely on an applicable mechanism, such as an adequacy decision or standard contractual clauses with any necessary measures. The privacy contact can provide information about safeguards applicable to a processing activity. The primary storage region is not a promise of exclusively European residency for the entire service.

Accounts are restricted to people aged at least 18. The product does not target children.

Customers should avoid requesting sensitive data or secrets in an ordinary form. Sector-specific use or use involving minors requires a dedicated analysis; this information claims no HIPAA, SOC 2, or other certification.

The effective date and version identify each approved publication. Important changes will be communicated appropriately. Acceptance evidence retains the text for the relevant version.

RyactApps LLC, operator of LittleReply.

Questions and requests: privacy@formeo.me.

Mailing address: 418 BROADWAY, STE N, ALBANY, NY 12207, USA.