Government Request Policy

1. Scope

This policy explains how WP Media LLC, which operates ReplyMe, handles requests from public authorities, such as law enforcement, national security agencies and regulators, for personal data we hold. It covers all personal data described in our Privacy Policy, including WhatsApp messages and other data we receive through the Meta WhatsApp Business Platform.

For messages between a business and its customers, the business is the data controller and we act as its processor. Where we can, we direct authorities to request that data from the business itself.

2. Legal review of every request

Before we act on any request, we review it to confirm that:

• it comes from an authority with jurisdiction over us and over the data requested
• it is made under a valid legal process, such as a court order, warrant or subpoena, that we are required to follow
• it is specific: it identifies the account or data concerned and states its legal basis

Requests are reviewed by company management and, where needed, by external legal counsel. We do not disclose data voluntarily or informally in response to a request that has not passed this review.

3. Challenging unlawful requests

If a request is unlawful, overbroad, lacks a valid legal basis or conflicts with applicable data protection law, including the GDPR, we will refuse it or ask the authority to narrow or clarify it. Where appropriate, we will challenge it through the legal remedies available to us.

4. Disclosing the minimum necessary

When we are legally required to disclose data, we disclose only the minimum strictly necessary to comply, limited to the accounts, data types and time period the valid request covers. We do not give any authority direct, bulk or ongoing access to our systems or data.

5. Notifying our customers

Before disclosing data about a business that uses ReplyMe, we notify that business so it can seek legal remedies, unless we are legally prohibited from doing so or notice would create a risk to someone's life or safety. If we are prohibited from giving notice, we will notify the business once the prohibition ends.

6. Emergency requests

If we believe in good faith that there is an imminent risk of death or serious physical injury, we may disclose limited data without a court order, but only the data needed to address the emergency. These requests are documented and reviewed in the same way as any other.

7. Documentation

We keep a record of every request we receive, including:

• the requesting authority and the date of the request
• the legal basis given and the data requested
• our response, what we disclosed (if anything) and the legal reasoning behind it
• the people involved in reviewing and answering the request

We keep these records for at least five years.

8. Contact

Authorities should send requests to privacy@replyme.io. Questions about this policy can be sent to the same address.