Privacy Policy

Who we are

Replyit is run by the Replyit team. Replyit puts an AI chat assistant on business websites. This page explains what information we handle, why, how long we keep it, and what you can ask us to do with it. If you have a question, write to us through our contact page.

If you're a Replyit client

When you create an account and use it, we keep:

• Your name, business name and email, plus a phone number and website if you give them. If you sign in with Google, we receive your name, email and Google account ID from Google, and nothing else.
• Your password, stored only as a secure one-way hash. We can't read it. If you turn on two-factor sign-in, its secret is stored encrypted.
• Your sign-in history: the device type, network (IP) address and time of recent sign-ins, including failed ones, so you can spot one that wasn't you.
• The business information you or we write for your assistant, and its settings, including a booking link or webhook address if you add one.
• How many messages your assistant answers each day and how much AI processing they use, for your plan's limits, and the web address where your chat button was last seen running.
• Your plan and payment status. Your card is handled by our payment provider; we never see the full card number.
• Your teammates' names, emails and roles, if you invite any.

We use this to run your assistant, show you your conversations and leads, keep your account secure, email you about your account and new leads, and bill you. Our legal basis is the contract with you; for security records and preventing abuse, our legitimate interest in keeping Replyit safe; for billing records, our legal obligations.

If you chatted with an assistant on a business's website

The business you chatted with decides what happens with your conversation, and we store it on their behalf: the messages you sent, the replies (from the AI or from someone at the business), any contact details you chose to share such as your name and phone number, the page of their website you were on, the kind of device you used (for example “iPhone”), and whether you rated the replies as helpful. If you wrote on WhatsApp, we also receive your WhatsApp number and profile name. The business can read all of this in its dashboard to answer you, and may send your contact details to its own tools (such as its customer list). To see, correct or delete your information, contact that business, or contact us and we'll pass your request on.

If you wrote to us

When you send a question through our contact page, we keep your name, email, business name and message to answer you.

Who at Replyit can see what

We don't read clients' conversations or leads. Our admin tools show account and billing details, and only counts of conversations and leads. To set up or fix an assistant, we can open a client's dashboard, but only while the client allows “Replyit support access” in their settings. Every visit is recorded with its reason and shown to the client, and it can't change their password.

The companies that help us

We don't sell personal information. We share it only with the services that run Replyit, and only what they need:

• Hosting and AI: Vercel. Chat messages are sent through Vercel's AI Gateway to an AI model provider to write each reply. They aren't used to train AI models.
• Database: Supabase, where accounts, conversations and leads are stored.
• Email: our email delivery provider (Resend, or our own mailbox provider), for confirmation, password reset and lead alert emails.
• Payments: Lemon Squeezy, which takes card payments as merchant of record.
• WhatsApp: Meta, for businesses on the Website + WhatsApp plan.
• Sign-in: Google, only if you choose “Continue with Google”.

These services may process information in other countries, including the United States, under safeguards such as the European Commission's Standard Contractual Clauses. We may also share information if the law requires it.

Cookies

We use one cookie to keep clients signed in, and short-lived ones while you finish a two-factor or Google sign-in. These are needed for the site to work, so they don't need consent. We don't use advertising or tracking cookies. To see which pages of this website people visit, we use Vercel Web Analytics, which counts visits without cookies and without identifying you. The chat window remembers your conversation in your browser until you close the tab.

How long we keep it

• Conversations are deleted automatically after 12 months without new messages. A business can delete any conversation sooner.
• Leads stay in the business's dashboard until it deletes them or closes its account.
• Sign-in history is kept for 90 days. Records used to stop password guessing and spam (such as the network address of a request) are kept for about a day.
• Messages sent through our contact page, and our record of support visits to accounts, are deleted after 12 months.
• Account information is kept while the account is open. When an account is closed, we delete its data within 30 days, except what we must keep by law, such as billing records.

Children

Replyit is a service for businesses and isn't meant for children. We don't knowingly collect information from anyone under 16.

Your rights

You can ask us for a copy of your information, or to correct, delete or stop using it, or to receive it in a portable format, at any time: write to us through our contact page. Clients can also download their leads and conversations, and delete their account, from Settings. We answer within 30 days. You can complain to your data protection authority: in the European Union, the authority in your country; in Morocco, the CNDP. If we change this policy, we'll update the date at the top of this page and tell clients by email when the change matters.