Privacy Policy

For your ReplyKing account we are the data controller. For the contacts and conversations a business stores in ReplyKing, that business is the controller and we process the data on its behalf as a processor.

• Account data: name, email address, password hash or Google sign-in identifier, workspace and team membership.
• Connected channels: when you connect Instagram, WhatsApp or Gmail we store access tokens (encrypted) and the messages, comments and profile details those platforms send us for your account.
• Business data: contacts, leads, deals, tasks, bookings, payment links and notes you or your automations create.
• Usage and technical data: IP address, device and browser details, logs and security events.

• To provide the service: run your automations, show your inbox, send the messages you or your automations send.
• To secure the service: authentication, rate limiting, fraud and abuse prevention, audit logs.
• To bill you and to talk to you about your account.
• AI features process message content only to generate replies, summaries or suggestions for your workspace. We do not use your data to train AI models.

If you sign in with Google or connect Gmail, ReplyKing’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to show, send and organise email inside your ReplyKing inbox; it is never sold, used for advertising, or read by humans except with your permission, for security, or where the law requires.

Data received from Meta platforms is used only to provide the features you enable for your connected accounts. You can disconnect an account at any time from Integrations; to delete data we hold about you from an Instagram interaction, remove ReplyKing from your Instagram settings (Apps and websites) or email [email protected].

We do not sell personal data. We share it only with providers that run the service for us — cloud hosting (Hetzner, Cloudflare), email delivery (Amazon Web Services), payment processors (Stripe, Razorpay), AI model providers used by AI features, and the platforms you connect (Meta, Google) — under contracts that protect it, or when the law requires.

We keep data while your account is active. Deleted records are removed from active systems and purged from backups on their normal rotation. A business can export or erase any contact’s data from the contact page; you can ask us to delete your account at any time.

Depending on where you live (including the EU/UK GDPR, India’s DPDP Act and US state laws) you can access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. Email [email protected]; if a business holds your data in ReplyKing we will pass your request to it. You may also complain to your local data protection authority.

Data is encrypted in transit, access tokens and payment keys are encrypted at rest, and access inside a workspace is role-based.

We will post changes here and, for material changes, notify account owners by email before they take effect.