Privacy Policy

Replicants, operated by Replicants.ai · Last updated: 24 September 2026

This Privacy Policy explains how Replicants.ai ("Replicants", "we", "us") collects, uses, stores, and shares information when you use Replicants (formerly called Coachbot) and its associated services at app.replicants.ai and coach.replicants.ai (the "Service"). It includes specific disclosures about our use of Google user data, as required by the Google API Services User Data Policy, and about our use of YouTube API Services.

1. Who we are

Replicants is a business software platform that helps businesses engage their customers and run marketing, including the optional ability to create and manage advertising campaigns on connected advertising accounts (such as Google Ads) on the business's behalf, the optional ability to connect a calendar (such as Google Calendar) so that clients can book sessions, and the optional ability to connect social accounts (such as a YouTube channel) so that the business can publish its own posts and videos and answer the comments on them.

2. Information we collect

Account information

When you create an account we collect information such as your name, email address, business details, and authentication credentials. We also collect content you create in the Service and operational data (log data, device/browser information, and usage events) needed to run and secure the platform.

Google account data (advertising features)

If you choose to connect a Google Ads account, we ask your permission through Google's OAuth consent screen for the following scopes:

https://www.googleapis.com/auth/adwords — manage your Google Ads campaigns.

https://www.googleapis.com/auth/datamanager — upload an audience list you choose to your own Google Ads account (Customer Match).

With your authorization, and only for the Google Ads account you explicitly select, we access:

The list of Google Ads accounts your Google login can access, so you can choose which one to connect;
Account details (name, currency) for the account you select;
Campaigns, ad groups, conversion actions, and performance metrics, in order to create, read, and manage advertising on your behalf;
The ability to create conversion-tracking configuration and campaigns (always created paused, so nothing spends until you activate it);
Only when you ask for it, the upload of one of your own subscriber segments to your Google Ads account as a Customer Match audience. Only contacts who are subscribed and have not opted out are included, and their email addresses and phone numbers are SHA-256 hashed on our servers first, so Google receives hashes, never the addresses themselves.

We receive an OAuth refresh token from Google that lets the Service perform these actions on your behalf until you disconnect. We do not receive your Google password.

Google account data (calendar features)

If you choose to connect a Google Calendar so that your clients can book sessions with you, we ask your permission through Google's OAuth consent screen for the following scopes:

https://www.googleapis.com/auth/calendar.freebusy — read only whether you are busy or free at a given time.

https://www.googleapis.com/auth/calendar.calendarlist.readonly — read the list of your calendars, so you can choose which one we check.

https://www.googleapis.com/auth/calendar.app.created — create and manage events in a calendar that this application creates.

With your authorization, and only for the calendar you explicitly select, we access:

Free/busy times only — the times you are already committed, so a client cannot book a session on top of an existing appointment. We do not read the titles, descriptions, locations, attendees, or any other content of your existing events;
The names of your calendars, so you can choose which one we check;
Events in a separate calendar that this application creates, so that sessions booked through the Service appear in your diary and are removed if a session is cancelled.

The calendar.app.created scope is deliberately the narrowest write permission Google offers: it allows us to create and manage events only in a calendar our own application created. We cannot read, modify, or delete any of your existing calendars or their events.

As with advertising, we receive an OAuth refresh token that lets the Service perform these actions until you disconnect, and we do not receive your Google password. Refresh tokens are encrypted at rest.

Google account data (YouTube features)

Replicants uses YouTube API Services. If you choose to connect a YouTube channel, we ask your permission through Google's OAuth consent screen for the following scopes:

https://www.googleapis.com/auth/youtube.upload — upload videos to your channel.

https://www.googleapis.com/auth/youtube.readonly — read your channel's name and your recent uploads.

https://www.googleapis.com/auth/youtube.force-ssl — read the comments on your videos, post the replies you approve, and hold or publish a comment when you choose to.

With your authorization, and only for the channel you connect, we access and store:

Your channel's ID and name, so you can see which channel is connected;
Your most recent uploads (their IDs, titles, publish times and links), and their like and comment counts;
The comments and replies on those videos, including held-for-review comments: the text, the time, the like count, and the commenter's public display name and channel ID, so that you can read and answer them in the Service;
The videos you choose to publish from the Service, together with the title, description and visibility you set. We upload only the videos you ask us to.

We use this data only to publish the videos you choose and to show you, and let you answer, the comments on your own channel. A reply is posted, and a comment held or published, only when you press the button that does it. We keep YouTube data for no longer than 30 days unless it is refreshed from YouTube: every time we read your channel we update what we hold, and anything we have not refreshed for 30 days is deleted. When you disconnect your channel in the Service, the YouTube data we stored for it is deleted straight away.

By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

3. How we use information

To provide, operate, and improve the Service you requested;
To create and manage advertising campaigns, conversion tracking, and reporting on the connected advertising account you selected;
To show your clients when you are available, and to place booked sessions into a calendar this application creates;
To publish the posts and videos you choose to your connected social accounts, and to show you and let you answer the comments on them;
To authenticate you, secure the platform, prevent abuse, and provide support;
To communicate with you about the Service.

We do not use Google user data for advertising to you, and we do not sell Google user data.

Limited Use disclosure (Google API Services User Data Policy)

Replicants' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google Ads API scopes is used solely to provide and improve the advertising features you request, data obtained through Google Calendar API scopes is used solely to provide the scheduling and booking features you request, and data obtained through YouTube API scopes is used solely to publish the videos you choose and to manage the comments on your channel; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; and no humans read this data except where required for security, to comply with applicable law, with your explicit consent, or in aggregated/anonymized form for internal operations.

4. How we share information

We share information only as needed to run the Service:

With Google's APIs, to perform the advertising, calendar and YouTube operations you authorized;
With service providers (sub-processors) such as cloud hosting and infrastructure vendors that process data on our behalf under contract;
To comply with law or protect the rights, safety, and security of our users and the Service;
In a business transfer, such as a merger or acquisition, subject to this policy.

We do not sell your personal information or your Google user data.

5. Storage, security, and retention

Data is transmitted over encrypted connections (TLS). OAuth refresh tokens are stored encrypted at rest using AES-256-GCM. Access to production systems is restricted and audit-logged. We retain information for as long as your account is active or as needed to provide the Service, and thereafter as required for legitimate business or legal purposes, except YouTube data, which is kept for no longer than 30 days unless refreshed (see section 2).

The Service uses cookies and your browser's local storage to keep you signed in and to remember your settings. We do not allow third parties to serve advertisements in the Service.

6. Your choices and how to revoke access

You can disconnect a connected Google Ads account at any time from within the Service (Settings → Ad accounts → Disconnect), and a connected calendar at any time from your course's 1:1 settings (Disconnect calendar), and a connected YouTube channel at any time from Settings → Socials (Disconnect). Disconnecting revokes our access and deletes the stored token; for YouTube it also deletes the channel data we stored. In addition, you can revoke our access to your Google data at any time through Google's security settings at security.google.com/settings/security/permissions. To request deletion of your account data, or with any question or complaint about our privacy practices, contact us at the address below.

7. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

8. International users

We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

10. Contact us

Questions about this policy or your data? Email support@replicants.ai.