Data Processing Agreement

This agreement is part of our Terms of Service. It covers the personal data of your website's visitors (and WhatsApp contacts) that Replyit handles for you. For that data, you are the controller and Replyit, run by the Replyit team, is the processor.

What we process, and why

• Whose data: people who chat with your assistant on your website or WhatsApp number.
• What data: the messages they send, the replies, the contact details they choose to share (such as a name, phone number or email), the page they were on and their type of device. We ask the assistant not to collect sensitive data, and you agree not to ask for it.
• Why: to answer their questions, pass their requests to you, show you conversations and leads, email you about new leads and, if you set one up, send leads to your own webhook.
• For how long: while your account is open. Conversations are deleted after 12 months without new messages; you can delete any conversation, lead or your whole account sooner.

Our commitments

• We process this data only to provide Replyit to you, following your documented instructions: these terms and the way you set up and use the service. If we think an instruction breaks data protection law, we'll tell you.
• Everyone at Replyit who can access it is bound to keep it confidential. We only open your dashboard while you allow “Replyit support access”, and every visit is recorded and shown to you.
• We protect it with appropriate security measures, including encrypted connections, hashed passwords, encrypted two-factor secrets, role-based access for your team, rate limits against abuse and isolation between clients' data.
• We don't use it to train AI models and don't sell it.
• We help you answer requests from people who want to see, correct or delete their data, and with security, breach notifications and impact assessments where they concern our service. Your dashboard lets you download and delete it yourself.
• If we become aware of a breach affecting this data, we tell you without undue delay and, where we can, within 72 hours, with what we know.
• When your account is closed, we delete this data within 30 days, except what the law requires us to keep. Before closing, you can download it from Settings → Your data.
• We give you the information reasonably needed to show that we meet these commitments, and allow reasonable audits with notice, at your cost.

Sub-processors

You allow us to use these providers to run Replyit. Each is bound by data protection terms at least as protective as this agreement:

• Vercel: hosting, and the AI Gateway that sends each chat message to an AI model provider to write the reply (not used for training).
• Supabase: the database where conversations and leads are stored.
• Our email delivery provider (Resend, or our own mailbox provider): lead alert emails.
• Meta: WhatsApp messages, for businesses on the Website + WhatsApp plan.

If we add or replace a sub-processor, we update this list and email active clients at least 14 days before. If you object for a reasonable data protection reason, tell us: if we can't resolve it, you can cancel before the change applies.

Some providers may process data outside your country, including in the United States. Where the law requires it, transfers are covered by the European Commission's Standard Contractual Clauses or another lawful safeguard.

Your part

You decide to use a chat assistant on your website, so you're responsible for telling your visitors about it, for example in your own privacy policy, for keeping the AI notice at the start of each chat visible, and for having a lawful reason to handle their requests. Questions about this agreement: write to us through our contact page.