Privacy Policy

1. Who we are

ReplyMe (replyme.io) is operated by WP Media LLC, 30 N Gould St, Sheridan, WY 82801, USA. WP Media LLC is the data controller for the personal data described in this policy.

Contact: privacy@replyme.io

EU representative (GDPR Art. 27):
WP Media Nordic AB, SE556856238201, Drottningholmsvägen 80, Sweden

UK representative: to be appointed

2. Two kinds of data

Our customers' data. When a business signs up for ReplyMe, or joins our beta waitlist, we are the controller of that data.

Our customers' end-customers' data. When someone messages a business that uses ReplyMe on WhatsApp, we process those messages on behalf of that business. The business is the controller, and we act as its processor, using the data only to provide the service. For questions about how a specific business handles your data, please contact that business directly.

3. What we collect

• Account and contact details: name, email address, business name and phone number
• Waitlist sign-ups: email address
• Billing information: handled by Stripe. We never see or store full card details.
• Service data: WhatsApp messages, contact names and phone numbers, email addresses a customer chooses to share, booking details, and business FAQs and settings
• Calendar data: if you connect a calendar, the availability and events needed to make bookings
• Technical data: IP address, browser type, and log and error data needed to run and secure the service

4. Why we use it (and legal basis)

• To provide the service, including AI replies, bookings, routing and notifications (contract)
• To keep the contact details a customer chooses to share, such as an email address, so the business can communicate with its customer (on the business’s instructions)
• To manage accounts and billing (contract, legal obligation)
• To send beta and service updates to waitlist members and customers (consent or legitimate interest). You can unsubscribe at any time.
• To keep the service secure and fix problems (legitimate interest)
• To meet legal and accounting requirements (legal obligation)

We do not sell personal data, and we do not use it for advertising.

5. AI processing

Incoming messages are processed by an AI model (Anthropic's Claude) to generate replies and detect intent. Under our agreement with Anthropic, this data is not used to train their models. Businesses using ReplyMe are responsible for informing their customers that an AI assistant may respond.

6. Who we share data with

We use trusted service providers that process data on our behalf:

• Supabase: database and authentication, hosted in the EU (Paris)
• Vercel and Upstash: application hosting and background processing
• Meta / WhatsApp Business Platform: sending and receiving WhatsApp messages
• Anthropic: AI replies (not used to train their models)
• Stripe: payments
• Resend: account and service emails
• Google: calendar integration, only if connected

We may also disclose data if required by law.

7. International transfers

WP Media LLC is based in the United States, and some of our service providers are too. Our main database is hosted in the EU. Where personal data is transferred from the EU/EEA, the UK or other regions to the US or other countries, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework.

8. How long we keep data

• Account data: for as long as your account is active, plus up to 30 days after closure
• Messages and bookings: for as long as the business keeps its account, or until the business deletes them
• Billing records: for as long as required by applicable tax and accounting laws (typically up to 7 years)
• Waitlist emails: until 12 months after launch, or until you unsubscribe
• Technical data: log and security data, including IP addresses, for up to 30 days

9. Cookies

We only use essential cookies needed to log you in and keep the service secure. We do not use advertising or tracking cookies.

10. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy of it (data portability). Where processing is based on consent, you can withdraw it at any time.

To exercise your rights, email privacy@replyme.io.

If you are in the EU/EEA, the UK or Australia, you can lodge a complaint with your local data protection authority, for example IMY in Sweden, the DPC in Ireland, the AEPD in Spain, the ICO in the UK, or the OAIC in Australia.

11. Security

We use encryption in transit, access controls and tenant isolation to protect your data. No system is 100% secure, but we take reasonable measures to protect your information.

12. Changes

We may update this policy, especially as we move out of beta. We will post the new version on this page and notify account holders of significant changes.