Privacy Policy

Effective: October 14, 2026

NOTE: This page is an English translation of the original and authoritative French Privacy Policy, provided for convenience. If the two versions differ, the French version prevails.

This Privacy Policy explains how REPPLY (“we”, “us”) collects and processes personal data when businesses use our product to connect their Instagram and WhatsApp accounts, submit menus and opening hours, and have AI-generated replies sent to their incoming messages. It also covers our website and analytics.

Who we are

Controller: REPPLY. For most website analytics and our direct customer account data, we act as an independent controller.

Processor: For messages received by our customers via Instagram/WhatsApp, we act as a processor on behalf of the business that connected the account. The business remains the controller for its end customers’ data.

Contact: contact+privacy_policy@repp.ly

What we process

• Business account identifiers and contact details (e.g., name, email, Instagram Business identifiers).
• Instagram/WhatsApp message content, identifiers, contact details and metadata necessary to receive, generate, and send replies.
• Menus, opening hours, and business instructions submitted to the product.
• Information our customers entrust to us about the people they talk to (identity, contact details, information shared in conversations), processed on their behalf and separately for each of them. To exercise your rights over this data, contact the business concerned; we help it respond.
• Operational logs and security signals (e.g., IP address, timestamps, error logs).
• Product and website analytics (events, page views) without third‑party advertising tracking.

Purposes and legal bases

• Provide and operate the service (account setup, integrations, message handling, AI replies) – Art. 6(1)(b) GDPR (contract) with our customer; for end‑customer messages we process as a processor under the customer's instructions.
• Security, abuse prevention, reliability, and debugging – Art. 6(1)(f) GDPR (legitimate interests).
• Repply learning: on our customers' instructions, we anonymize the conversations and data they send us to improve the service for all our customers. Anonymized data can no longer identify you.
• Product analytics and improvement – Art. 6(1)(f) GDPR (legitimate interests). Where required, we will seek consent – Art. 6(1)(a).
• Legal compliance (e.g., tax/audit, requests from authorities) – Art. 6(1)(c) GDPR.

Where we process and store data

Our application runs on Cloudflare in the closest region possible to users. Persistent data is stored in the European Union on Supabase, and analytics are stored in the EU with PostHog.

Processors and sub-processors

• Cloudflare – hosting, edge runtime, networking, security.
• Supabase (EU) – database and authentication.
• PostHog (EU) – product and website analytics (cookie-less).
• OpenAI, Anthropic, Google and Mistral AI – provide AI models for generating message replies. To offer the best performance, we choose and may change at any time which of these providers' models we use. For this purpose, they act as our sub-processors. As explained below, they may also, under their terms, use conversation content to improve their models, for which they act as independent controllers.
• Optional integrations you enable (e.g., Meta APIs for Instagram/WhatsApp; Google Drive for menus).

Each provider processes data under a data processing agreement and appropriate safeguards. We only share data with processors necessary to provide the service, under documented instructions.

International transfers

We use recognized safeguards for transfers outside your jurisdiction:

• EEA (EU/EEA): where a provider is certified, we rely on the EU–US Data Privacy Framework (DPF). Otherwise, we use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with appropriate supplementary measures. We also conduct transfer impact assessments (TIAs).
• UK: we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and the UK Extension to the DPF where applicable.
• Switzerland: we use the FDPIC‑compatible SCCs or the Swiss–US DPF where applicable.

For AI inference and model improvement, OpenAI, Anthropic and Google may process data in the United States; Mistral AI processes it in the European Union. Conversation content may include personal data provided by users in messages. We rely on the safeguards above for these transfers.

AI model improvement by our providers

To generate replies, we send conversation data to our AI model providers: OpenAI, Anthropic, Google and Mistral AI. Under their terms, they may use this data to train and improve their models. This section provides transparency on that practice. We update this list and notify our customers at least thirty (30) days before adding a provider.

• Scope: conversation content, related metadata and other information used to generate a reply. We do not add enrichment; data reflects what users and businesses submit in chats and configurations.
• Status: always on; no product toggle is offered. You may contact us to object. Where feasible with our providers, we will honor objections; otherwise we may discuss alternatives or limits on use of the feature.
• Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in improving the service and underlying models. You have the right to object at any time (Art. 21). Where local law requires consent for this use, we will obtain it via the relevant controller.
• Safeguards: contractual restrictions (DPAs/SCCs/DPF, as applicable), provider security controls, and transfer safeguards noted above.

Analytics and cookies

We use PostHog in a cookieless mode for product and website analytics. We do not use third-party advertising cookies or cross-site tracking via PostHog. Our legal basis is legitimate interests (Art. 6(1)(f) GDPR). Where local law requires consent for analytics, we will honor that requirement.

Retention

We keep personal data only as long as necessary for the purposes above. Typical periods:

• Operational logs: up to 90 days unless required longer for security or legal reasons.
• Business account data and configurations: while your subscription or contract is active, then deleted or anonymized within 90 days.
• Information about the people our customers talk to: for the duration of the relationship with the business concerned, then at most three years after the person's last self-initiated exchange, and at the latest at the end of our customer's contract as described above.
• Message content required to operate automations: up to 90 days after it is no longer needed for the service, unless a shorter retention is configured or a longer retention is required for the reasons below.
• Analytics: aggregated or anonymized after a short retention suitable for trend analysis.

We may retain limited data for longer where necessary for tax and accounting obligations, billing and debt collection, fraud and abuse prevention, security investigations, legal claims, authority requests, or anonymized and aggregated statistics.

Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit, network protections via Cloudflare, access controls, and least‑privilege principles. Access to end‑customer messages is restricted and audited.

Your rights

Under GDPR, you (or your end customers via the controller) may have the right to access, rectify, erase, restrict processing, object, and data portability. Where we act as a processor, please contact the relevant business/controller first; we will support their request. For matters where we are the controller (e.g., your repp.ly account or website analytics), contact us at contact+privacy_policy@repp.ly.

You can lodge a complaint with your local authority. Our lead authority is the CNIL (France): cnil.fr.

Assistant instructions and intellectual property

Assistant instructions, prompts and behavior templates, including any content you add to them, are Repply’s intellectual property, even when visible or editable in the app, an API, an MCP integration or an edit proposal. Access is permitted only to use and configure the Repply service, including through an authorized connected assistant. Outside this authorized use, reuse, publication, assignment or transfer to a third party is prohibited, subject to statutory rights, as set out in the terms of use and sale.

You remain free to use your business information and the documents you hold independently of the service in their original form. Where instructions contain personal data, that data remains subject to this policy and the rights described above. Intellectual property protection does not justify a blanket refusal to provide access to your personal data; we balance disclosure with the rights and freedoms of others. Access to or portability of personal data does not, by itself, grant a license to reuse Repply Instructions.

Children

Our service is for businesses and not directed to children. We do not knowingly collect children’s data.

Changes

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.

Contact

REPPLY – Privacy inquiries: contact+privacy_policy@repp.ly