Privacy Policy

1. Who We Are

Replify is a product of Esipick, based in the United Arab Emirates. We operate the Replify SaaS platform at inboxsaas.esipick.ai.

Data controller: Esipick · info@esipick.tech

2. What We Collect

• Account information: Your name, email address, and hashed password when you sign up.
• WhatsApp message data: Inbound and outbound messages processed through your connected WhatsApp Business number, stored to power the inbox and AI features.
• Contact data: Phone numbers and names of your WhatsApp contacts who message your business number.
• Usage data: AI reply counts, login timestamps, IP addresses (for security), and audit logs.
• Billing data: Subscription plan and Stripe customer ID. We do not store card numbers — payments are handled by Stripe.
• Settings: Your WhatsApp API credentials, AI persona configuration, and workspace preferences.

3. How We Use Your Data

• To provide and operate the Replify service.
• To process AI-powered auto-replies on your behalf.
• To send transactional emails (welcome, receipts, password reset, security alerts).
• To enforce usage limits and billing.
• To detect and prevent fraud, abuse, and security incidents.
• To improve the service (aggregated, anonymised analytics only).

4. Legal Basis for Processing (GDPR)

• Contract: Processing necessary to deliver the service you signed up for.
• Legitimate interests: Security monitoring, fraud prevention, and abuse detection.
• Consent: Marketing emails (you can withdraw consent at any time).
• Legal obligation: Compliance with applicable laws.

5. Data Sharing

We do not sell your data. We share data only with:

• Anthropic / OpenAI: Message content is sent to AI APIs to generate replies. Subject to their privacy policies.
• Stripe: Billing and subscription management.
• Meta Cloud API: Your WhatsApp provider receives messages for delivery.
• ElevenLabs: Audio content for voice reply features (if enabled).
• Hostinger SMTP: Email delivery.
• Law enforcement: Only when required by law or to protect rights and safety.

6. Data Retention

• Account and message data is retained while your account is active.
• Login attempt logs are retained for 90 days.
• Audit logs are retained for 12 months.
• When you delete your account, your personal data is anonymised immediately and messages are permanently deleted.

7. Your Rights

Under GDPR and similar laws, you have the right to:

• Access: Download all your data from Settings → Account → Export My Data.
• Deletion: Delete your account and all associated data from Settings → Account → Delete Account.
• Rectification: Update your name and email from Settings.
• Portability: Export your data in JSON format at any time.
• Withdraw consent: Unsubscribe from marketing emails via the unsubscribe link in any email, or from Settings → Account.
• Object: Contact us at info@esipick.tech to object to any processing.

8. Security

We protect your data with:

• TLS encryption in transit (HTTPS enforced via HSTS).
• Passwords hashed with bcrypt (cost factor 12).
• HttpOnly, Secure, SameSite cookies to prevent session theft.
• Rate limiting and account lockout to prevent brute force attacks.
• Audit logging of all sensitive account actions.
• No plaintext storage of API keys or secrets.

9. Cookies

We use a single session cookie ("token") that is strictly necessary to keep you logged in. It is HttpOnly (cannot be read by JavaScript) and Secure (only sent over HTTPS). We do not use advertising or tracking cookies.

10. Children's Privacy

Replify is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it promptly.

11. International Transfers

Your data may be processed by our AI and infrastructure providers in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for international transfers.

12. Changes to This Policy

We may update this policy from time to time. We will notify you by email of material changes. The "Last updated" date at the top reflects the most recent revision.

13. Contact & Complaints

For privacy questions or to exercise your rights, contact us at info@esipick.tech.

If you are in the EU/EEA and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.