Privacy Policy

ReplyMe is operated by De Jure Academy, a business registered in Bangladesh under registration number TRAD/DSCC/005391/2025, with its registered office at 69/1 Chandrashila Suvastu Tower (Floor 10C), Panthapath, Kalabagan, Dhaka 1205 (“ReplyMe”, “we”, “us” or “our”).

ReplyMe is an artificial-intelligence customer conversation platform. It connects a business’s Facebook Page, Instagram Professional account and WhatsApp Business number to a single AI assistant, a single business knowledge base and a single shared inbox, so that customer messages can be answered, qualified, followed up and, where needed, passed to a human being.

We treat the security and confidentiality of personal information as a core part of the product rather than an afterthought. This Privacy Policy explains what information we handle, why we handle it, who we share it with, how long we keep it, and what choices you have.

Please read this Policy together with our Terms and Conditions, which govern your use of the platform.

This Policy covers:

• Visitors to our website and marketing pages.
• Account holders — the individuals who create and manage a ReplyMe account.
• Workspace members — team members invited into a business workspace.
• Enquirers and subscribers — people who fill in a form, request a demo, or sign up for updates.
• End Customers — the people who message a business through Facebook, Instagram or WhatsApp and whose messages are handled by ReplyMe on that business’s behalf.

The way we handle information depends on which of two roles we are performing. This distinction matters, so we set it out clearly at the start.

Role one — we decide. For our own account, billing, security, support and marketing purposes, we determine what information we collect and why. This applies to account holders, workspace members, website visitors and enquirers. Everything in this Policy describes how we act in that role.

Role two — the business decides. When a business connects its channels and switches ReplyMe on, the conversations that follow belong to that business. We store and process those conversations, and the personal information inside them, on the instructions of that business and for the purpose of delivering the service to it. We do not use that material for our own independent commercial purposes.

We refer to this second category as Customer Content. It includes End Customer messages, names, phone numbers, delivery addresses, order details, uploaded images and any business knowledge the account holder loads into the platform.

If you are an End Customer and you want your information corrected or removed, the business you messaged is the right first point of contact, because it controls that information. If you cannot reach them, write to us at hello@replymeapp.io and we will assist where we are able to.

• Directly from you. When you create an account, complete your business profile, load products, prices, FAQs and policies into the knowledge base, invite team members, contact support, complete a form or subscribe to updates.
• From the channels you connect. When you authorise ReplyMe to connect to your Facebook Page, Instagram Professional account or WhatsApp Business account, those platforms pass us the information needed to operate the connection — page and account identifiers, permission scopes, access tokens, and the messages and events routed to us through their webhooks.
• Automatically as you use the platform. Device, browser and log information is recorded when you sign in and use the dashboard.
• From service providers. For example, our payment gateway confirms whether a payment succeeded or failed. We do not receive your full card number.
• From End Customers, through our account holders. Where an End Customer sends a message to a connected business, that message reaches us through the relevant channel.

5.1 Account and workspace information

Name, email address, mobile number, password in hashed form, workspace name, business type and industry, business address and contact details, role and permissions, preferred language, and account status.

5.2 Business knowledge base content

Product and service names, descriptions, prices, availability, delivery and payment information, FAQs, refund and exchange policies, offers, custom instructions for the AI, and any documents or images uploaded to teach the assistant. Where this material contains personal information — for example a staff member’s name in an escalation rule — it is handled as described in this Policy.

5.3 Channel connection information

Page, account and phone-number identifiers for the channels you connect; granted permission scopes; access and refresh tokens, held in encrypted form; webhook subscription state; and connection health and error logs.

5.4 Conversation information

Inbound and outbound message content across Facebook, Instagram and WhatsApp; attachments such as images and voice notes where the channel supports them; the End Customer’s channel display name and channel identifier; timestamps; the session or conversation identifier used for billing; the AI’s classification of intent and lead status; internal notes and tags added by your team; conversation summaries; handover events; and any contact details an End Customer chooses to share during a conversation, such as a phone number or delivery address.

5.5 Billing information

Selected plan, billing cycle, invoice history, payment status, transaction references from the payment gateway, masked card details such as the last four digits, and the mobile number used for a mobile financial service payment. Full card numbers, PINs and one-time passwords are never stored by us.

5.6 Usage, technical and diagnostic information

IP address, browser type and version, operating system, device type, pages and features used, session duration, feature interaction events, error reports, API request logs, and webhook delivery records.

5.7 AI operational information

For each AI request: the model used, input and output token counts, response latency, estimated cost, retrieval sources consulted, fallback events and error codes. This is used for cost control, quality monitoring and abuse protection.

5.8 Support and communication information

Support tickets, emails, chat transcripts with our team, feedback, survey responses, and — where you have been notified in advance — call recordings.

5.9 Marketing information

Subscription preferences, campaign engagement such as opens and clicks, and event or webinar registrations.

5.10 Information we ask you not to send

Please do not upload national identity card numbers, passport numbers, full payment card numbers, banking credentials, health records, biometric data, or information about a person’s religion, political opinion, ethnicity or sexual life into your knowledge base or conversation records. The platform is not designed to hold this category of information. If it reaches us despite this request, you remain responsible for having a lawful reason to hold it, and we may remove it.

We rely on the following grounds, as recognised under applicable Bangladeshi law and general data protection principles: performance of our contract with you; your consent, where we ask for it; our legitimate business interests in operating, securing and improving the platform; and compliance with legal obligations.

Because AI is central to the product, we set out separately how it works with information.

How replies are generated. When an End Customer sends a message, we assemble a limited context — the relevant part of the current conversation, a structured summary of what we know about that customer, and the sections of your knowledge base that are relevant to the question. That context is sent to a language model provider, and the reply is returned and delivered on the channel.

Model providers. We use third-party AI providers under a model-routing layer. Simple tasks may be routed to a smaller, cheaper model and complex reasoning to a stronger one. Our current providers are OpenRouter, which routes requests to model vendors such as Google and Anthropic, and OpenAI, which we use to create text embeddings for each business’s knowledge base. We update this Policy when that list changes.

Training. We do not sell conversation content, and we do not permit our AI providers to use your conversation content or knowledge base to train their general-purpose models, except where you have explicitly opted in. We may use aggregated statistics and de-identified examples — from which individuals and businesses cannot reasonably be identified — to improve prompts, retrieval quality and routing.

Human review. A small number of conversations may be reviewed by trained members of our team where necessary to investigate a reported fault, a safety concern or a suspected breach of our Terms. Access is restricted, logged and time-limited.

Limits of the AI. The assistant is configured not to invent prices, discount amounts, stock availability, delivery charges, schedules or policies. Where it does not have a reliable answer, it is designed to say so and offer a human. Even so, AI output can be incomplete or wrong. It should not be relied on for medical, legal, financial or other professional advice, and we do not represent that it will be free of error. Section B.10 of the Terms sets out your responsibilities here.

Record keeping. We retain a record of AI responses and the knowledge sources used to produce them, so that a disputed reply can be examined afterwards.

We do not sell personal information, and we do not rent or trade it for advertising.

We share information in the following circumstances only.

• Service providers. Cloud hosting and storage, database and backup services, AI model providers, payment gateways and mobile financial service providers, email and notification delivery, error monitoring and analytics, and customer support tooling. Each is bound by contract to use the information only to provide its service to us.
• Messaging platforms. Facebook, Instagram and WhatsApp, being the channels through which conversations are delivered. Their handling of that information is governed by their own terms and privacy policies.
• Within your workspace. Members of your workspace can see conversations, contacts and analytics according to the role you assign them. Choose roles carefully.
• Professional advisers. Lawyers, accountants and auditors, where they need the information to advise us.
• Legal and safety disclosures. Where we are required to disclose by law, a court order or a lawful direction from a competent authority, or where disclosure is reasonably necessary to investigate fraud or a security incident, to enforce our Terms, or to protect the rights and safety of any person. Where we are permitted to notify you of such a request, we will.
• Business transfer. If our business or a part of it is merged, acquired or reorganised, information may transfer as part of that transaction. The recipient remains bound by commitments no less protective than those in this Policy, and we will notify you.

Where you connect a Facebook Page, an Instagram Professional account or a WhatsApp Business account, additional commitments apply.

• We request the minimum permissions needed to operate the features you have enabled.
• Access tokens are stored encrypted, are never exposed to browser or frontend code, and are used only to deliver the service.
• Information obtained through Meta’s platforms is used only to provide and improve ReplyMe’s features for you, and is not sold or transferred to any data broker or advertising network.
• We verify the signature of every incoming webhook and process events idempotently.
• You may disconnect a channel at any time from the Channels screen. On disconnection we revoke the stored tokens and stop receiving new events for that channel.

Our use of these platforms is subject to Meta’s Platform Terms, Developer Policies and the WhatsApp Business Messaging Policy, and those requirements apply alongside this Policy.

Our website and dashboard use cookies and similar technologies. Essential cookies keep you signed in, protect the session and remember workspace context; the service cannot function without them. Analytics cookies help us understand which features are used and where people encounter difficulty. Marketing cookies, where used, measure the effectiveness of our campaigns.

You can control non-essential cookies through the consent banner presented on your first visit, or through your browser settings. Blocking essential cookies will prevent you from signing in.

Our infrastructure and service providers may be located outside Bangladesh, including in Singapore, the European Union, the United Kingdom and the United States. Your information may therefore be stored or processed in those countries.

Where information leaves Bangladesh, we require the receiving party by contract to apply protections consistent with this Policy, restrict use to the services provided to us, and impose appropriate security measures. Where the law of Bangladesh requires particular categories of information to be held locally, we will comply with that requirement.

When you close your account, we delete or irreversibly de-identify your workspace data within 90 days, except where a longer period is required by law or is necessary to resolve a dispute, prevent abuse or enforce an agreement. Backups are overwritten on their normal cycle.

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of traffic in transit and of stored secrets and access tokens.
• Separation of each workspace’s data, enforced at both the database and service layers.
• Role-based access control and least-privilege permissions for our own staff.
• Signature verification and idempotent handling of incoming platform events.
• Rate limiting and abuse protection on public endpoints.
• Audit logging of security-relevant and business-critical actions.
• Regular backups with tested restore procedures.
• Vetting of service providers and contractual security commitments.

No system connected to the internet can be guaranteed to be completely secure, and we do not claim otherwise. You also have a part to play: choose a strong and unique password, keep it confidential, review workspace roles regularly, and remove members who no longer need access.

If a security incident occurs that is likely to put your rights or your customers’ information at material risk, we will notify affected account holders without undue delay, describe what happened and what we know, explain the steps taken to contain it, and set out what we recommend you do. Where a regulator must be notified, we will do so.

Subject to applicable law, you may:

• Access the information we hold about you.
• Correct information that is inaccurate or incomplete — most account and workspace information can be edited directly in the dashboard.
• Delete your account and associated data.
• Export your conversations, contacts and knowledge base in a machine-readable format.
• Withdraw consent where we relied on it, without affecting anything done before withdrawal.
• Object to or restrict particular uses of your information.
• Opt out of marketing at any time, using the unsubscribe link or by writing to us. You cannot opt out of essential service notices while your account is active.
• Complain to us, or to a competent authority in Bangladesh.

To exercise any of these, write to hello@replymeapp.io from the email address registered on the account. We will acknowledge within 7 working days and respond substantively within 30 days. Where a request is complex we may extend that period and will tell you why. We may ask you to verify your identity before acting, and we will not charge a fee unless a request is repetitive or clearly excessive.

Requests from End Customers. If you messaged a business through Facebook, Instagram or WhatsApp and want your information accessed, corrected or deleted, please contact that business first, since it controls the information. If you tell us you cannot reach them, we will pass your request to the business and support them in responding.

ReplyMe is a business tool and is not directed at children. You must be at least 18 years old to open an account. We do not knowingly collect information from children through our website or dashboard. If you believe a child’s information has reached us, write to hello@replymeapp.io and we will delete it.

We recognise that an End Customer messaging a business through a public channel may occasionally be a minor. Businesses using ReplyMe are responsible for handling such conversations lawfully and appropriately, and for configuring the assistant accordingly.

Our website, dashboard and documentation may link to third-party sites and services. We do not control them and are not responsible for their content or their privacy practices. Read their policies before providing information to them.

We may update this Policy as the product, the law or our providers change. The effective date at the top always shows when it was last revised. For material changes we will give notice by email or an in-dashboard notice before the change takes effect, and where the law requires consent, we will ask for it. Continuing to use the platform after a change takes effect means you accept the revised Policy.

Privacy queries and requests: hello@replymeapp.io

General support: hello@replymeapp.io

Postal address: De Jure Academy, 69/1 Chandrashila Suvastu Tower (Floor 10C), Panthapath, Kalabagan, Dhaka 1205

If you are not satisfied with our response, you may escalate to our Grievance Officer at hello@replymeapp.io, marking your message “Grievance — Privacy”. We will respond within 30 days of receiving an escalation. You retain the right to approach a competent authority or court in Bangladesh.