Privacy Policy

1. Who we are

Replyze is run by VELJASMELE LTD, a company registered in England and Wales (company number 15570351), 128 City Road, London EC1V 2NX, United Kingdom. You can reach us at [email protected].

We have two roles:

• Controller for the account data of the businesses that use Replyze (our customers).
• Processor for the personal data of our customers' website visitors and shoppers (for example what they write in the chat). We process it only on our customer's behalf and instructions, under our Data Processing Addendum. The business you chatted with is the controller of that data.

2. What we collect

Account data (customers). Name, email address, password (stored only as a hash), workspace and team details, and billing details. Card payments are handled by Stripe or by Shopify; we never see or store card numbers.

Chat data (visitors and shoppers, on our customer's behalf). The messages and attachments a visitor sends, the name and email they choose to give, the page they chat from, their browser, operating system and device type, their IP address, and their approximate location (country and city, from the location headers our network provider Cloudflare adds to each request; the IP address is not sent to any location service).

Visitor tracking. Where the website allows it, the chat widget sets a cookie (rz_track_id) and records the pages a visitor views, so the business can see who is on its site right now. On Shopify stores this happens only after the shopper consents to analytics through the store's cookie banner, and stops if they withdraw it. Live visitor records are deleted after 24 hours. The chat works without tracking.

Usage and security logs. Server logs (kept 14 days) and a log of which team member opened or exported a conversation or contact (kept 12 months).

3. Replyze for Shopify

When a merchant installs Replyze for Shopify, we receive the store's name, domain and owner email, and an access token for the store (stored encrypted).

To answer a shopper's question about an order, the assistant reads that order from Shopify at the moment of the question: its status, fulfilment, shipment tracking and items. A shopper who is not signed in proves the order is theirs with the order number and the checkout email; the app only compares that email with the order's and does not show or store the order's email. A signed-in shopper is identified by Shopify, by customer id. We do not read customers' names, phone numbers or addresses, prices, or payment details. Order details are not stored apart from what appears in the chat itself.

To answer stock questions the assistant reads product titles and availability. We honour Shopify's privacy requests: a shopper's data is deleted on a customer redaction request, and a store's data 48 hours after the app is uninstalled.

4. How we use it

• To run the chat: deliver messages, generate AI answers from the business's knowledge base, hand chats to the business's team, and email visitors a transcript when they left their email.
• To run accounts and billing, send service notices, and provide support.
• To keep the service secure and working: detect abuse, investigate errors, and keep backups.

We do not sell personal data, use it for advertising, or use chat data to train AI models.

5. AI processing

To write an answer, the visitor's recent messages and the relevant parts of the business's knowledge base are sent to Anthropic, which provides the Claude models. Under its commercial terms, Anthropic does not use this data to train its models.

6. Who processes data for us

• Hetzner Online GmbH (Germany): servers, database, file storage, backups and our outgoing email server.
• Cloudflare, Inc.: network, DDoS protection and content delivery for our websites and the chat.
• Anthropic PBC (USA): AI answers (section 5).
• Stripe: payments for customers who pay us directly.
• Shopify: billing, and store data, for merchants using Replyze for Shopify.
• Google Firebase Cloud Messaging: push notifications to team members' devices, when they turn them on.

Integrations a customer connects themselves (such as Slack, HubSpot or Facebook) receive data at that customer's instruction. Where data leaves the UK or the EU, it is protected by appropriate safeguards such as the Standard Contractual Clauses or the UK International Data Transfer Addendum.

7. Security

All connections are encrypted with TLS, between the browser, our network provider and our servers. Our servers are in Hetzner's ISO 27001-certified data centres in Germany. Backups are encrypted, and store access tokens and two-factor secrets are stored encrypted. Access to production systems is limited to authorised staff, and opening or exporting a visitor's conversation or contact is logged. We have a written process for handling security incidents and will notify affected customers without undue delay.

8. How long we keep data

• Conversations, with their messages and attachments, and visitor contacts: deleted automatically 24 months after their last activity, or sooner when the business deletes them or closes its account.
• Account data: while the account is open, and deleted within 30 days after it is closed, unless the law requires us to keep it longer (for example invoices).
• Live visitor records: 24 hours. Server logs: 14 days. Access logs: 12 months. Backups: 14 days.
• Shopify stores: 48 hours after uninstalling (section 3).

9. Cookies and local storage

The Replyze dashboard uses only cookies and storage it needs to sign you in and keep your preferences. The chat widget keeps the current chat in the browser's local storage so it survives a page reload, and uses the rz_track_id cookie (up to one year) only where visitor tracking is allowed (section 2).

10. Your rights

Under the UK GDPR and the EU GDPR you can ask to access, correct, delete or export your personal data, and object to or restrict its processing. If you chatted with a business that uses Replyze, contact that business first; we help them answer. Customers can export and delete data from their account or by writing to [email protected]. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

11. Changes and contact

We will post changes to this policy here and tell customers by email about material ones. Questions: [email protected].