Privacy policy

1. Who is the controller

For workspace user accounts we act as the data controller. For end-customer conversations we act as a processor on behalf of the business operating the assistant, under the Data processing agreement. Needs legal reviewconfirm roles with legal counsel; DPO or privacy contact details

2. Data we process

• Account data: name, email address, password hash, two-factor secrets and backup codes, session and device information (IP address, browser).
• Organization content: catalog items, knowledge-base documents, channel credentials (encrypted at rest) and settings.
• Conversation data: messages exchanged through connected channels, including pseudonymized personal data of end customers, and the identifiers those channels provide (for example a WhatsApp phone number or Telegram user ID).
• Usage and audit data: actions taken in the dashboard, usage counters for plan limits, and technical logs that never contain raw message bodies.

3. Purposes and legal bases

• Providing the service (contract): running your workspace, delivering answers to your customers, enforcing plan limits.
• Security and abuse prevention (legitimate interest): audit logs, rate limiting, two-factor authentication.
• Legal obligations: responding to lawful requests and keeping records where the law requires it.
• Consent: optional cookies as described in the Cookie policy. No analytics or marketing tool is active today.

4. How we protect end-customer personal data

End-customer personal data in messages is pseudonymized before any AI model call: names, phone numbers, emails and addresses are replaced with tokens. Originals are stored only in an encrypted vault with a defined purge date and are never written to logs in raw form.

5. AI providers and international transfers

AI processing uses EU-region endpoints by default. A provider outside the EU is used only with a data-processing agreement and a valid transfer mechanism (EU–US Data Privacy Framework or standard contractual clauses). We never route traffic to China-hosted AI APIs. The current providers are listed on the Sub-processors page.

6. Data residency and retention

Application and database infrastructure is hosted in the European Union. Conversation data is kept for Needs legal reviewretention period for conversations; the pseudonymization vault is purged after Needs legal reviewvault purge window; account data is deleted Needs legal reviewperiod after account closure; audit logs are kept for Needs legal reviewaudit retention period.

7. Your rights

Under the GDPR you can access, rectify, erase and export your personal data, restrict or object to processing, and withdraw consent at any time. Workspace owners can request erasure of organization data. You also have the right to lodge a complaint with your supervisory authority — in Romania, the ANSPDCP. To exercise a right, contact Needs legal reviewprivacy contact email.

8. Sub-processors

We use a small number of sub-processors for hosting, email delivery and AI inference. The list is maintained on the Sub-processors page and updated before a new sub-processor is engaged.

9. Security

Credentials and channel secrets are encrypted at rest with AES-256-GCM, administrative actions are recorded in an append-only audit log, sessions are cookie-based with secure flags, and two-factor authentication is available for all accounts and required for platform administrators.

10. Children

Reply Fast is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16 as a workspace user.

11. Changes to this policy

We will announce material changes by email and in the dashboard before they take effect and keep previous versions available on request.

12. Contact

Privacy questions and requests: Needs legal reviewprivacy contact email. General support: support@replia.dev.