This is a general explanation, not legal advice. The GDPR applies since 2018 and covers names, email addresses, order details, and anything else that identifies a person. It gives people rights over their data, such as seeing it and having it deleted, and it requires a lawful reason, security and transparency from whoever handles it.
Why it matters
When you answer customer email, your business is usually the controller: you decide why the data is used. A tool that reads your inbox on your behalf is a processor. The GDPR expects a written contract between the two, a data processing agreement, and a list of any other companies the processor relies on, its sub-processors. If data leaves the EU, it also requires approved safeguards.
Practical questions to ask any tool: what data it reads, where it is stored, who else sees it, how long it is kept, and how you can have it deleted.
An example
A customer asks you to delete everything you hold about them. You delete the emails in your own mailbox and ask each tool that processed them to do the same.
In ReplyPen: What ReplyPen stores, where, and which companies are involved is on where your data goes; the legal text is the privacy policy.