Legal
What we collect, why we collect it, who we share it with, and how you can control it.
We collect only what we need to draft and send replies on your behalf. We do not sell your data. We do not train AI models on your content. You can export or delete your workspace's data at any time from settings.
The rest of this page goes into the detail behind those statements.
We collect three categories of data:
We use the data we collect to:
When we draft a reply, we send the comment text, the related post content, and the relevant brand context to an AI provider (currently OpenAI). The provider returns a draft, which we store in your workspace.
We do not allow the AI provider to use your data to train their models. We have a Data Processing Agreement with our provider that covers this.
We share data only with service providers we need to run ReplyAuto AI, under contracts that restrict what they can do with it:
When you connect a Facebook Page or Instagram Business account, Meta shares the comments and post data we need to draft replies. When you connect Shopify, Shopify shares your products and policies. The exact data they share is governed by the scopes you grant during the connection flow, and you can revoke them at any time from your Meta or Shopify settings.
Workspace data (comments, drafts, replies) is retained for the life of your workspace. If you delete a workspace, its data is queued for deletion within 30 days. Server logs are retained for 30 days, then deleted.
If you want a workspace deleted sooner or want to confirm deletion happened, email hello@replyauto.ai.
Disconnecting an account from Settings → Connections stops all processing for it. If you remove ReplyAuto AI from your Facebook or Instagram settings, or send a data deletion request through Meta, we deactivate the connection, discard its access credentials, and delete the comments we had cached for that account.
Deletion requests made through Meta receive a confirmation code. If you want to verify a deletion, email hello@replyauto.ai and include that code.
We encrypt data in transit (TLS 1.3) and at rest. Access to production systems is restricted to a small set of employees on a need-to-know basis, and every access is logged. Workspace data is isolated at the database layer so members of one workspace cannot read another workspace's data through the application.
We're working through SOC 2 Type II certification. We'll publish our security report when it's ready.
Depending on where you live, you may have the right to access, correct, export, or delete your personal data. To exercise any of these, contact us at hello@replyauto.ai.
Most of these you can also do yourself from settings: you can edit your profile, export your data, and delete your account or workspace at any time.
ReplyAuto AI is operated from the United States. By using the service, you understand that your data will be processed in the US. Where required, we rely on Standard Contractual Clauses for transfers from the EEA and UK.
ReplyAuto AI is built for businesses and is not directed at children under 16. If we learn we have collected data from a child under 16, we will delete it.
We will update this page when our practices change. The "last updated" date at the top of the page reflects the most recent revision. Material changes will also be announced via email to workspace owners.
Questions about this policy or about how we handle your data? Email hello@replyauto.ai. We respond within two business days.
Questions? Email us at hello@replyauto.ai.
