This policy explains what personal data [Company legal name], [Registered address], handles when you use Repli, and why. In India we act under the Digital Personal Data Protection Act, 2023; for visitors to our customers' websites, our customer decides what is collected and we process it on their behalf.
Data about our customers and their team
- Account details: name, work email, company name and an encrypted password.
- Activity: sign-ins, changes made in the account (kept in the audit log for one year) and technical logs such as IP address.
- Settings: AI provider keys, mail server passwords and the FlowOS link are stored encrypted and never shown back.
Data about website visitors
- Chat messages, and details a visitor chooses to type in, such as name, email, phone number and request details.
- Technical details: the website the chat was opened on, browser and approximate address (IP), used for security and to stop abuse.
- This data belongs to the business whose website the visitor used. Visitors should contact that business to see, correct or delete it.
Why we use it
- To run the service: answer visitors, store conversations and requests, send the emails a business set up.
- To keep it secure: stop spam and attacks, investigate misuse.
- To support you when you ask for help.
- To publish anonymised totals, such as the share of chats that arrive after business hours. These come from at least 20 businesses at a time and never include a business name, a visitor's details or the text of any message.
We do not sell personal data and do not use visitors' conversations to advertise.
Who else handles it
- The AI provider chosen by the business (for example Anthropic, OpenAI or Google) receives the visitor's question and the relevant parts of the business's content to write an answer.
- Our hosting and database providers: [list providers and regions].
- Cloudflare, for the check that stops automated sign-ups and form spam.
How long we keep it
Conversations and requests are kept while the business keeps its account, unless it deletes them sooner. Audit entries are kept for one year. When an account is closed, its data is deleted within [30] days, except where the law requires us to keep it.
Your rights
You may ask to see, correct or delete your personal data, or withdraw consent, by writing to [legal@yourdomain]. If you are not satisfied with our answer you may complain to the Data Protection Board of India. [Name the grievance officer and their contact details here.]
Security
Data is sent over encrypted connections, each business's data is kept separate from every other business, and secrets are encrypted at rest.