Data Processing Agreement
Last updated:
This agreement sets out how we handle your customers’ personal data when they message your business through ReplyMe. It applies automatically to every ReplyMe subscription; there is nothing to sign.
1. Parties and roles
This agreement is between WP Media LLC, 30 N Gould St, Sheridan, WY 82801, USA ("ReplyMe", "we") and the business that uses ReplyMe ("you"). It forms part of our Terms of Service and applies whenever we process personal data on your behalf.
For your customers' personal data — for example the WhatsApp messages they send you — you are the controller and we are your processor. For your own account and billing data we are the controller, as described in our Privacy Policy.
2. What we process
- Purpose: to provide the service: AI replies, bookings, routing, notifications and support, and to keep the contact details a customer shares so you can communicate with your customers
- Data subjects: your customers and prospects who contact you, and your team members
- Personal data: names, phone numbers, email addresses (only if a customer chooses to share one), message content, booking details and anything a customer chooses to write
- Special categories: not intended; ask your customers not to send sensitive data over WhatsApp
- Duration: for as long as you use ReplyMe, then deletion as described in section 8
3. Our commitments
- We process personal data only on your documented instructions: these terms, your settings and your use of the service. If we believe an instruction breaks data protection law, we will tell you.
- Everyone at ReplyMe with access to personal data is bound by confidentiality.
- We do not sell your customers’ data or use it for advertising or to train AI models.
- We help you respond to requests from data subjects (access, correction, deletion and similar), and with data protection impact assessments where our service is involved.
4. Security
We use appropriate technical and organisational measures, including:
- encryption in transit
- tenant isolation enforced in the database (row-level security), so one business can never read another’s data
- least-privilege access, with administrative keys kept server-side only
- production data kept separate from development and testing
- verified signatures on incoming webhooks from WhatsApp and Stripe
5. Sub-processors
You authorise us to use the following sub-processors. Each is bound by data protection terms at least as protective as this agreement:
- Supabase: database and authentication, hosted in the EU (Paris)
- Vercel and Upstash: application hosting and background processing
- Meta / WhatsApp Business Platform: sending and receiving WhatsApp messages
- Anthropic: AI replies (not used to train their models)
- Stripe: payments
- Resend: account and service emails
- Google: calendar integration, only if connected
We will tell account owners by email at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address it, you may end your subscription.
6. International transfers
Our main database is hosted in the EU. Where personal data is transferred outside the EU/EEA or the UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (with the UK Addendum) or the EU–US Data Privacy Framework.
7. Personal data breaches
If we become aware of a breach affecting your customers' personal data, we will notify you without undue delay, with the information we have about what happened, the data involved and what we are doing about it, so you can meet your own notification duties.
8. End of the service
When your account closes, we delete your customers' personal data within 30 days, unless the law requires us to keep it. Before closing, you can ask us for an export of your data.
9. Audits and information
We will make available the information you reasonably need to show compliance with this agreement, and answer reasonable written questions about our data protection practices.
10. Contact and precedence
Questions about this agreement: privacy@replyme.io. EU representative (GDPR Art. 27): WP Media Nordic AB, Drottningholmsvägen 80, Sweden. If this agreement and the Terms of Service conflict on personal data, this agreement applies.