Privacy Policy

Who we are

Reppl.sh LLC ("Reppl.sh", "we", "us", or "our") is a Site Reliability Engineering and Platform Engineering consultancy registered in the State of Delaware, United States. We operate the website at reppl.sh and related subdomains.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, take our Reliability Scorecard assessment, or submit an inquiry. Please read it carefully. If you disagree with its terms, please stop using the site. Our Terms of Service govern the contractual relationship between you and Reppl.sh; this policy governs our personal-data practices only.

Governing law and venue for disputes are set out in our Terms of Service. The applicable substantive law is that of the State of Delaware, United States.

Data we collect

We collect information in three ways: directly from you when you submit a form, automatically when you browse our site, and through third-party analytics and advertising platforms.

Our forms are not designed to collect, and we do not request, special-category personal data as defined under GDPR Article 9 (e.g. health data, religious beliefs, political opinions) or government-issued identifiers. If you voluntarily include such information in free-text responses or email correspondence, we will limit its use to responding to your inquiry and will delete it as soon as reasonably practicable.

The benchmark figures shown on the Scorecard results page ("Series B–D Average" and "Top Quartile") are currently static illustrative figures, not computed from real submitters' data. If this changes, we will update this policy to disclose that secondary purpose before any such computation takes place.

How we use your data

We use the information we collect for the following purposes:

• Service delivery — to respond to your inquiry, deliver your Scorecard results, and arrange a Diagnostic Call if requested.
• Lead follow-up — to send you your assessment results and, where you have indicated interest, to follow up about our reliability engineering services.
• Marketing communications — with your explicit consent, to send you relevant content such as reliability engineering insights and service updates. You may opt out at any time via the unsubscribe link in any email we send.
• Website improvement — to understand how visitors use our site, identify pages that perform poorly, and improve the user experience (analytics cookies, subject to your consent preferences).
• Advertising measurement — to measure the effectiveness of our LinkedIn advertising campaigns and understand which ads lead to meaningful engagement (advertising cookies, subject to your consent preferences).
• Legal compliance — to comply with applicable law, respond to lawful requests, and protect our legal rights.

Our legal bases for processing under GDPR are: legitimate interests for responding to direct inquiries and operating the website; contract performance when you request our services; and consent for marketing communications and non-essential cookies (analytics and advertising). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Cookies & tracking

We use cookies, pixel tags, and browser localStorage. A cookie consent banner appears on your first visit (and can be reopened at any time via the Your Privacy Choices link in our footer). Non-essential cookies — analytics and advertising — are blocked until you give consent. You can change your preferences at any time.

You can also control cookies through your browser settings. Disabling cookies may affect site functionality. To opt out of Google Analytics across all sites, install the Google Analytics Opt-out Browser Add-on. To opt out of LinkedIn ads, visit LinkedIn's opt-out page.

LinkedIn advertising

We use the LinkedIn Insight Tag on our website to enable in-depth campaign reporting and to unlock aggregate insights about our website visitors. This allows us to:

• Measure conversions from LinkedIn ad campaigns (e.g. form completions, Scorecard starts).
• Retarget visitors with relevant ads on LinkedIn.
• Gain aggregate, anonymised demographic insights (job title, seniority, industry) about our site audience — without identifying individual visitors.

The LinkedIn Insight Tag sets a cookie in your browser. LinkedIn uses data processed through the Tag subject to LinkedIn's Privacy Policy. LinkedIn Ireland Unlimited Company acts as an independent controller for data processed for its own purposes; Reppl.sh acts as a joint controller with LinkedIn only for conversion and retargeting data directly associated with our campaigns.

For EU/EEA/UK/Swiss residents, the LinkedIn Insight Tag is loaded only after you provide consent through our cookie banner, consistent with GDPR Article 6(1)(a) and the ePrivacy Directive. You may withdraw that consent at any time through the Your Privacy Choices link in our footer.

California privacy rights (CCPA / CPRA)

This section applies to residents of California and supplements the rest of this policy. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA), grants California residents specific rights regarding their personal information.

Do we "sell" or "share" your personal information? Under CPRA, "share" includes disclosing personal information to a third party for cross-context behavioural advertising — even without money changing hands. The LinkedIn Insight Tag, when active, transmits data to LinkedIn for the purpose of delivering targeted ads on LinkedIn's platform. This may constitute "sharing" personal information under CPRA's definition. We therefore treat use of the LinkedIn Insight Tag for advertising purposes as a "share" and provide a mechanism to opt out below.

We do not sell personal information for monetary consideration. We do not share personal information with unrelated third parties for their own independent marketing.

CPRA-specific rights. In addition to the rights listed in §9, California residents have the right to:

• Correct inaccurate personal information we hold about you.
• Limit use of sensitive personal information — we do not collect sensitive personal information as defined under CPRA (e.g. precise geolocation, financial information, health data, biometric data). If this changes, we will update this policy.
• Non-discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights.
• 12-month look-back — upon a verified access request, we will disclose personal information collected about you in the preceding 12 months, including categories of data, sources, business purposes, and third parties with whom it was shared.

To exercise your California rights, email hello@reppl.sh with the subject "CCPA/CPRA Rights Request." We will respond within 45 days, extendable once by a further 45 days with notice to you.

Third-party processors

We share data with the following service providers who process data on our behalf. We select processors that maintain industry-standard security certifications (such as SOC 2 or ISO 27001) appropriate to the data they process, and we use Data Processing Agreements or equivalent contractual mechanisms as required by GDPR Article 28. A full, dated list of our sub-processors is maintained at reppl.sh/subprocessors.

We will update the sub-processor list when we add or change processors. For material changes affecting EU/UK/Swiss personal data, we will provide notice via this policy page at least 30 days in advance where feasible.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Data retention

We retain personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law.

When data is no longer required, we delete it securely or anonymise it. Deletion requests submitted under §9 or §6 will be honoured within 30 days. Note that data present in backup snapshots at the time of a deletion request may persist in those backups for up to 90 days until those backups are overwritten or expired, after which it will no longer be accessible or recoverable.

Your rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, email hello@reppl.sh with the subject line "Privacy Request". We will respond within one month under GDPR (extendable by a further two months for complex or numerous requests, with notice to you), and within 45 days under CCPA/CPRA (extendable once by a further 45 days, with notice). We may need to verify your identity before processing your request.

EU/EEA/UK residents also have the right to lodge a complaint with their local data protection supervisory authority — for example, the Irish Data Protection Commission, the UK Information Commissioner's Office, or your national equivalent.

Security & breach notification

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS encryption in transit for all pages and form submissions.
• Access controls limiting which personnel within Reppl.sh can access contact and lead data.
• Use of third-party processors that maintain industry-standard security certifications appropriate to the data they process — we review processors' compliance posture before onboarding and periodically thereafter.
• Personal data held in our CRM and email systems is protected by strong passwords, multi-factor authentication, and provider-level encryption at rest.
• Regular review of data handling practices and vendor security documentation.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Breach notification. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities as required by applicable law — including GDPR Articles 33 and 34 (72-hour notification to the supervisory authority; without undue delay to affected individuals where the risk is high) and applicable U.S. state breach notification statutes (all 50 states have breach notification laws; we will comply with the law applicable to the affected individuals).

Children's privacy

Our website and services are directed exclusively at business professionals. We do not knowingly collect personal data from individuals under the age of 16. This also means our services are not directed at, and are not intended to be used by, children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA). If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@reppl.sh and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For minor changes (e.g. clarifications, correcting processor details), updating the date is sufficient notice.

For material changes — those that meaningfully expand the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will provide more prominent notice: a banner on the site for a defined period and, where we hold your email address and you have previously given consent, an email notification.

Continued use of our website after changes are posted constitutes your acceptance of those changes. If you object to a material change, you may exercise your data rights under §9 or §6.

Contact us

For any questions about this Privacy Policy, to exercise your data rights, to raise a concern, or to submit a security disclosure, please contact us: