Privacy Policy
ReplyKit is operated by ReplyKit, Malaysia ("we"). This policy explains what data we handle when you use ReplyKit and when your customers message a business that uses ReplyKit.
1. What we collect
From you (the business): your email address and password (stored as a one-way hash), business name, website, industry, timezone, agent instructions, knowledge sources you add (website content, PDFs, text, Q&A), booking services and availability, and billing status. Card details are entered directly with Stripe and never reach our servers.
From your customers (people who message your WhatsApp number): their WhatsApp phone number and display name, the messages they send (text; voice notes are transcribed to text; photos are described as text), details your agent captures during a conversation (for example name, service interest, budget), appointments booked, and opt-out status. We do not store the original audio or image files.
Technical: server logs with timestamps and request paths, and the encrypted access token Meta issues for your WhatsApp Business Account, which lets ReplyKit send and receive on your number. If you connect a number you also use in the WhatsApp Business app and choose to share history, Meta sends ReplyKit your contacts and up to 180 days of past one-to-one chats from that app, which are stored like any other conversation.
2. How we use it
- To run the service: generating agent replies, booking appointments, showing conversations in your inbox and leads in your CRM.
- To send transactional email: verification codes, password resets, handoff and disconnection alerts, and billing notices.
- To bill you through Stripe and to prevent abuse (rate limits and abuse protection).
- We do not sell your data and we do not use your conversation data to train shared AI models. Message content is sent to our AI provider only to generate the reply for that conversation.
Abuse and legal requests. We do not read your conversations as a matter of routine. We may access agent instructions, knowledge sources and conversation records to investigate suspected abuse or a complaint under the Acceptable Use Policy, to prevent harm or fraud, or where the law requires it, and we may preserve and disclose such records to law enforcement, regulators, courts or affected parties in those cases.
3. Sub-processors
We rely on these providers, each bound by their own terms and security commitments:
- Railway (application hosting and database, EU region)
- OpenRouter and the AI model providers it routes to (generating replies, transcribing voice notes, describing photos)
- Stripe (payments and subscriptions)
- Resend (transactional email)
- Google Analytics (aggregate usage statistics for the public website, see section 8)
- WhatsApp / Meta (message delivery: your customers' messages travel through WhatsApp's systems under WhatsApp's own privacy terms)
4. Retention and deletion
- Conversation and lead data is kept while your account is active so your inbox and CRM work.
- Removing a knowledge source deletes its content from retrieval immediately.
- Deleting your account (Settings → Delete account) cancels billing and permanently deletes your workspace, agents, knowledge, contacts, conversations, appointments and WhatsApp session credentials. Backups age out within 30 days.
- If a subscription lapses, we keep the account for 30 days so you can return, then delete it.
5. Your rights, and your customers' rights
You can export all your data at any time from Settings (a complete JSON export) and delete it by deleting your account. Where data-protection law applies (including Malaysia's Personal Data Protection Act 2010, the GDPR, or similar laws), you and your customers may have rights to access, correct, delete or restrict processing of personal data. Business customers should route requests from their own customers to us via hello@replykit.app; we act on your instructions for the personal data of people who message your business.
Your customers can stop automated messages at any time by replying STOP; this is honoured immediately and permanently until they reply START.
6. Security
Data is encrypted in transit (HTTPS/TLS) and stored on encrypted infrastructure. WhatsApp session credentials are stored server-side and never exposed in the browser. Passwords are hashed with bcrypt. Access to production systems is limited to the operator.
7. Data processing terms
For business customers, this section serves as our data processing agreement: we process personal data of your customers only on your documented instructions and for the purposes above; we apply the security measures described here; we engage only the sub-processors listed above and will notify you of changes; we assist you with data-subject requests within a reasonable time; we delete or return the data at the end of the service; and we make available the information needed to demonstrate compliance. If you require a signed DPA on your own template, contact hello@replykit.app.
8. Cookies and analytics
The public website and sign-up pages use Google Analytics 4 to understand how visitors use the site: pages viewed, buttons clicked, and whether a visit led to a sign-up or trial. Google sets first-party cookies (names beginning with _ga) that last up to two years. We configure it with IP anonymisation, without advertising features, and without Google Signals, so it is not used for ads or cross-site profiling. We do not load analytics inside the operator console, and we do not send your customers' WhatsApp messages or contact details to Google. You can opt out with Google's browser add-on or by blocking cookies for this site; the service works without them. Session cookies and local storage needed to keep you logged in are strictly necessary and do not require consent.
9. Changes and contact
We will notify you of material changes to this policy by email. Questions about privacy: hello@replykit.app.