ReplyPack
Subject access requests · EU-resident by design

One request. Years of records. One month to answer.

ReplyPack gathers the records, proposes the redactions, and assembles the reply — the response letter, the redacted bundle, and a log of every decision. The AI proposes. Your team decides. Nothing is exported until someone has looked at it.

Book a walkthrough See how it works

One month

The response clock starts when the request lands. ReplyPack starts it for you, tracks extensions, and shows the deadline on every screen.

Every channel

Email, HR files, contracts, DMs, WhatsApp and SMS exports — ingested into one case instead of a folder someone reassembles by hand.

Nothing underneath

Export removes the text from the file. It is not a black box drawn over words that are still there and still recoverable.

The shape of a request

Four steps, and the deadline in view for all of them

The same sequence whether it is your fourth request this year or your fortieth this month.

  1. 01

    Log the request

    Record who asked, what they asked for, and when it arrived. The clock starts from that date and the deadline is visible from then on — including if you extend it.

  2. 02

    Bring the records in

    Batch-upload the files and drop in the exports: mailboxes, HR records, contracts, chat and messaging threads. Organise them into folders as you review.

  3. 03

    Review what the AI proposes

    Every candidate redaction arrives as a proposal with a confidence signal, grouped by the person or detail it refers to. Accept it, edit it, reject it, or add your own.

  4. 04

    Send the pack

    Export the response letter, the redacted bundle and the redaction log together — and keep the record of what was sent, to whom, and when.

The line that does not move

The AI proposes. A person decides. Always.

This is an architectural property of ReplyPack, not a setting someone can switch off when a deadline gets close. The model reads the documents and marks what it thinks is personal data belonging to someone other than the requester. It has no path to the exported file that does not run through a human review.

  • A proposal is not a redaction

    Nothing the model suggests is applied to a document until a reviewer accepts it. Rejecting a proposal is a single click, and the export burns only what was accepted.

  • Who decided what stays visible

    AI-proposed and human-added marks are labelled as exactly that — on screen while you work and in the exported redaction log, in line with EU AI Act Article 50 provenance labelling.

  • Every action is attributable

    Proposed, accepted, edited, rejected, exported, delivered — each one timestamped against the person who did it, and readable afterwards without asking us for anything.

Who it's for

Four requests a year or four hundred — the work is the same shape

What changes is who is doing it, how much of it there is, and what has to be provable afterwards.

Charities, non-profits & housing bodies

The person handling the request already has a full-time job doing something else.

Requests arrive from service users and tenants, often with a history going back years, and there is rarely a dedicated data protection team to hand them to. ReplyPack takes the parts that need specialist attention — spotting third-party details, keeping the clock, producing the log — and leaves you the parts only you can do.

  • Nothing to install and nothing to run — it is a website your team signs into
  • The deadline is tracked for you, including extensions, instead of living in someone's calendar
  • Roles for the people who review and the person who signs off, without buying a seat for everyone
Ask about a pilot →
SMEs & employers

The request is from a former employee, and it arrived through a solicitor.

An employment file is never one file. It is the HR record, the contract, the appraisals, the mailbox, and the team chat — with other colleagues named throughout. ReplyPack pulls the set together and proposes the redactions so you are not reading every message twice at midnight.

  • Ingest a mailbox export and a chat export into the same case as the HR file
  • Third-party colleagues flagged consistently across the whole set, not document by document
  • An exportable record of what you disclosed and what you withheld, if the request escalates
Talk to us about your case →
Enterprise & regulated organisations

It is not one request. It is a queue, and the volume is the problem.

Long tenures, multi-channel communications, and thousands of pages per case — reviewed by a team, overseen by a DPO, and expected to withstand scrutiny after the fact. ReplyPack is built around request volume and record scale rather than adapted to it.

  • Batch upload, paginated case views and streaming bundle export for cases in the thousands of pages
  • Row-level database isolation, per-organisation storage and a login tenant of your own
  • A standing audit trail your own auditors can read, and per-case oversight for a DPO
Arrange a technical review →
What you actually send

The reply is a pack, not a file

Four things go out together, generated from the same case rather than assembled separately and reconciled by hand. That is the whole product in one word, and it is where the name comes from.

  • The response letter

    Assembled from the case itself, so what it says was disclosed matches what is actually in the bundle.

  • The redacted bundle

    True redaction: the text is removed from the exported file. There is nothing underneath to copy out, search for, or recover.

  • The redaction log

    Every mark in the bundle, showing whether the AI proposed it or a person added it, and who made the call.

  • The reasons companion

    A plain account of why each thing was withheld — so the person who asked can see the reasoning without a second exchange of letters.

Your data

The questions your IT reviewer is going to ask

Answered here rather than three meetings in.

It stays in the EU

Documents are stored and processed in Google Cloud's Belgium region (europe-west1) — application, database, file storage and AI inference alike. They are not moved elsewhere for any purpose.

It is not used to train models

Google's Cloud Service Specific Terms prohibit using customer data to train or fine-tune models without permission, and that permission is not given. What If Now does not train anything on your documents either.

Another customer cannot reach it

Isolation is enforced at three independent layers: row-level security in the database, per-organisation file storage, and a login tenant scoped to your organisation alone.

We cannot read your documents

There is no support back door into your case files. If we need to see a screen to help, you drive a screen-share and we log that it happened — we do not sign in as you.

One caveat we say first, not last: the login service does not yet offer EU region pinning for account metadata, so email addresses and sign-in records may be processed outside the EU under standard contractual clauses. Document contents never touch it — it handles logins only.

Straight answers

Questions we get asked first

Does the AI decide what gets redacted?

No. It proposes, and a person accepts, edits or rejects every proposal. A reviewer can also mark things the model missed. Only accepted marks are applied to the exported file, and the export records which were AI-proposed and which a person added.

Do we have to move our documents into a new system permanently?

No. Documents are uploaded per request, worked on, and exported. Retention is set per organisation and case data is deleted on that schedule after the request is answered — you do not have to keep a second copy of everything you hold.

What if the request covers WhatsApp messages and email as well as files?

Message and chat exports go into the same case as the documents, so a mailbox export, a WhatsApp export and an HR file are reviewed as one set rather than three separate jobs with three separate deadlines.

Are you ISO 27001 or SOC 2 certified?

Not yet — and we would rather tell you that than imply otherwise. What we can give you instead is specific: the region everything runs in, the isolation controls, the subprocessor list, and an audit trail your own team can read directly. Ask and we will send the full data-handling pack.

What does it cost?

It depends on the size of your organisation and how many requests you handle, and we are still running founding pilots — so the honest answer is a conversation rather than a number on a page. Get in touch and we will tell you plainly whether we are a fit.

Get started

Show us the request you are dreading

A short walkthrough against a case that looks like yours — the volume you actually get, the channels it actually arrives on. We will tell you if ReplyPack is not the right fit.

Book a walkthrough hello@whatifnow.ie