Privacy Policy
Last updated: 2026-09-22
1. Data controller
Dapeng Liu, Lerchenstr 10B, 85586 Poing, Germany, an individual trading as "Top Generation" / "Smart Email Reply", is the data controller for the data described below, collected via this website and the "Smart Email Reply" Chrome extension.
2. What we collect
- Sign-in identity: your Google account email and account id, via OAuth — never your password.
- Usage: credit balance and consumption (each drafted reply/rephrase suggestion).
- Checkout email: the email you enter on this pricing page, used to identify which account to credit after payment.
- Payment details: collected and processed entirely by Paddle; we never receive or store your card details.
3. Why we process this data
To authenticate you, operate the credit system, fulfil purchases, and provide the drafting/rephrasing feature (which sends the relevant email text to our AI provider to generate a response). The legal basis for each of these is performance of the contract with you (GDPR Art. 6(1)(b)) — each is necessary to provide the service you signed up for and actively use.
4. Third parties we share data with
- Google LLC (USA) — sign-in only.
- Paddle.com Market Limited (United Kingdom) — payment processing. The UK has an EU adequacy decision, so this transfer does not require additional safeguards.
- Mistral AI (France) — processes your email/reply text to generate drafts and suggestions. Mistral is an EU company processing data within the EU, so this does not raise an international-transfer question.
- Cloudflare, Inc. (USA) — hosting infrastructure.
5. Data retention
Account data (your email address and credit balance) is retained for as long as your account exists. We currently have no automatic deletion process — deletion happens only on request (see "Your rights" below). Payment records are retained indefinitely for accounting and dispute-resolution purposes. The content of email threads or text you generate replies from is not stored — it's processed only to generate a response and is not written to any database.
6. Your rights
Subject to applicable law (including GDPR for EU/EEA users), you may have rights to access, correct, delete, or export your data, and to object to certain processing. To exercise any of these rights, contact us at the email below. We will respond within one month of a verified request, as required by GDPR Art. 12(3).