This policy explains how ReplySathi (“ReplySathi”, “we”) handles personal data when you use our website and the ReplySathi service, which answers WhatsApp and Instagram messages for businesses. It is written to meet the Information Technology Act, 2000, the IT Rules, 2011 and 2021, the Digital Personal Data Protection Act, 2023, and Meta’s Platform Terms.
Who is responsible for which data
- Account data (people who sign up and use ReplySathi): we decide how it is used.
- Customer conversations (messages that a business’s customers send on WhatsApp or Instagram): the business decides why they are processed; we process them on the business’s behalf to provide the service.
What we collect
- Account details: name, email address or mobile number, business name and type, team members you invite, and sign-in records (time, IP address, device).
- Business data you add: catalogs, prices, stock, hours, policies, FAQs and other files you upload.
- Messages from your customers: when you connect WhatsApp or Instagram, we receive the messages your customers send to your business, with their name, phone number or Instagram username, and any photos, voice notes or documents they share. We also store the replies sent by the AI and your staff.
- Connection details: access tokens from Meta that let us send and receive messages for your business. These are stored encrypted (AES-256-GCM).
- Billing details: plan, invoices and payment status. Card, UPI and bank details are handled by Razorpay; we never see or store them.
- Website enquiries: what you write in our contact form.
How we use it
- To answer your customers’ messages from your business data, and to show your team every conversation.
- To check AI replies against your data before they are sent, and to hand chats to your staff when needed.
- To remember details a customer has shared (for example a preferred size), only after your team approves them.
- To run, secure and improve the service, prevent abuse, and provide support.
- To bill you and meet tax and legal obligations.
We do not sell personal data, use your customers’ messages for advertising, or use them to train AI models.
Who we share it with
We share data only with the providers needed to run the service, under contracts that limit their use of it:
- Meta Platforms (WhatsApp Business Platform, Instagram API) to receive and send messages.
- OpenAI to generate and check replies. Data sent through OpenAI’s API is not used to train their models.
- MongoDB Atlas (database hosting) and our cloud hosting provider, to store data.
- Razorpay to process payments, and Resend to send sign-in codes and service emails.
- Government authorities, only when the law requires it.
Some of these providers may process data outside India. When they do, we rely on their security commitments and the safeguards permitted under Indian law.
How long we keep it
- Conversation history is kept for the period included in your plan (from 30 to 365 days), then deleted.
- AI reply traces and system logs are kept for a short period (usually 14 to 90 days) for troubleshooting.
- Billing records are kept as long as tax law requires.
- When a business deletes its account, its data is removed within 30 days, except billing records we must keep.
How we protect it
- Each business’s data is kept separate; one business can never see another’s data.
- Access tokens are encrypted; connections use HTTPS.
- Staff access follows roles set by the business owner, and every sensitive action is recorded in an audit log.
- Card numbers, OTPs and government ID numbers that customers type in chat are masked before AI processing.
Your rights
You can ask to see, correct, export or delete your personal data, withdraw consent, or nominate someone to exercise these rights for you. Business owners can export and delete data from their dashboard. If you are a customer of a business that uses ReplySathi, you can contact that business, or us, and we will help. See data deletion for the steps.
Cookies
We use one essential cookie to keep you signed in. We do not use advertising cookies. If we add analytics in the future, we will update this policy and ask for consent where required.
Children
ReplySathi is for businesses and is not meant for anyone under 18.
Grievance officer
Our grievance officer can be reached through the details below and will acknowledge complaints within 24 hours and resolve them within 15 days.
Contact
For privacy questions or requests, use our contact form.
Changes
If we change this policy in a way that affects you, we will tell account owners by email before the change takes effect.