Privacy Policy

replyora (“we”, “us”, “our”) is operated by Aarushi Duggal, a sole trader trading as replyora, ABN 14 143 824 703, based in Sydney, New South Wales, Australia.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you:

• visit our website;
• join our waitlist;
• contact us;
• create a replyora account;
• accept an invitation to a client portal or workspace;
• connect a social media account;
• upload content or assets;
• use our AI-assisted tools;
• interact with an AI website chatbox operated through replyora; or
• otherwise use our website, platform, products or services,

together referred to as the “Service”.

Where applicable, this Policy is intended to support our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Where we handle information relating to people outside Australia, additional privacy or data-protection laws may also apply.

This Policy applies to:

• agency account holders;
• personal-brand users;
• client portal users;
• workspace administrators and team members;
• waitlist users;
• people who contact us; and
• visitors who communicate with an AI website chatbox installed by a replyora customer.

This Policy does not apply to third-party websites, social networks, platforms or services that you connect to or access through replyora. Those services are governed by their own terms and privacy policies.

Depending on how you use replyora, we may collect the following categories of information.

Account and profile information

This may include:

• name;
• email address;
• password, stored in hashed form;
• workspace name;
• role;
• preferences, including timezone and date format; and
• authentication and sign-in session information.

Workspace and client information

This may include information you or your team enter into replyora, including:

• brand names;
• package details;
• deliverables;
• voice notes;
• content pillars;
• posts;
• captions;
• schedules;
• tasks;
• invoices;
• billing notes;
• client information; and
• invitation records.

Uploaded content

We may process content you upload to the Service, including:

• images;
• videos;
• documents or other assets;
• filenames; and
• associated metadata.

Connected social account information

If you connect an Instagram, Facebook or TikTok account, we may access and store information made available through the platform’s official API and within the permissions you authorise.

This may include:

• access and refresh tokens;
• connected-account IDs;
• profile information;
• Facebook Pages you authorise;
• Instagram Business or Creator accounts you authorise;
• content available through the relevant API; and
• performance information such as reach, engagement or other metrics made available by the relevant platform.

We use this information so you can plan, preview, manage and report on content within replyora.

Where supported by the relevant platform, replyora may also use your authorised connection to publish or schedule content that you have created and approved.

Publishing occurs only when you initiate or schedule that action. replyora does not independently decide what to post.

AI website chatbox information

If a replyora customer installs an AI chatbox on a website, we may process:

• conversations and messages submitted by website visitors;
• the webpage or page address from which the interaction occurred;
• technical information necessary to deliver the chatbox;
• information voluntarily entered by the visitor; and
• an email address or other contact information where the visitor chooses to provide it.

Waitlist and enquiry information

If you join our waitlist, we may collect your:

• name; and
• email address.

If you contact us, we may collect:

• name;
• email address;
• message;
• phone number, if you choose to provide it;
• Instagram handle, if provided; and
• business name, if provided.

Usage and device information

We may collect technical and usage information including:

• IP address;
• browser type;
• pages viewed;
• features used;
• actions taken within the Service;
• timestamps;
• security logs; and
• diagnostic information.

Communications

We may retain communications you send to us, including:

• support requests;
• feedback;
• complaints;
• enquiries; and
• account-related correspondence.

Subscription and payment information

Payments may be processed through Stripe, Inc.

Stripe may collect information such as payment-card details and billing information.

replyora does not store your complete payment-card number on our own systems.

We may collect information:

• directly from you when you register, join the waitlist, complete a form, upload an asset, create content, connect an account, purchase a subscription or contact us;
• from a workspace administrator who invites you to a workspace or assigns your permissions;
• from Meta, TikTok or other connected platforms when you authorise an integration;
• automatically through cookies, authentication tokens, logs and similar technologies needed to operate and secure the Service; and
• from service providers that help us provide hosting, storage, payments, email delivery, AI services and other infrastructure.

We may use personal information to:

• provide, maintain and secure the Service;
• create and manage your account;
• authenticate users;
• enforce role-based access and permissions;
• maintain agency, workspace and client portal functionality;
• store and display content, calendars, assets, approvals, invoices and other workspace records;
• display authorised social account profiles, content and performance metrics;
• publish or schedule content you create and approve when you instruct us to do so;
• operate AI-assisted features;
• provide caption, script, hook, content and response suggestions;
• provide AI website chatbox functionality;
• process subscriptions, renewals, cancellations and billing;
• send transactional and service-related communications;
• send security notifications;
• send account invitations;
• send receipts;
• provide reports or briefs generated as part of the Service;
• respond to enquiries and support requests;
• send waitlist, beta, product or launch communications where you have requested or consented to receive them;
• analyse the Service to identify bugs, abuse, security risks and opportunities for improvement;
• prevent fraud or misuse;
• enforce our Terms of Service;
• comply with legal obligations; and
• protect our users, our rights and the public.

We do not use or disclose personal information for an unrelated purpose unless:

• you would reasonably expect us to do so;
• you consent;
• it is necessary to provide the Service you requested; or
• it is otherwise permitted or required by law.

Where we rely on consent, you may withdraw that consent, although doing so may prevent certain features from operating.

Where practical, you may interact with us anonymously or using a pseudonym. Some features, including subscriptions and connected social accounts, require identification.

replyora uses cookies and similar technologies that are necessary to operate, secure and remember preferences within the Service.

These may include:

Session and authentication cookies

These help keep you signed in and protect your account.

Google sign-in

If you choose to use Google sign-in, Google may use cookies and related technologies as part of its authentication process. Google’s processing is governed by its own privacy policy.

Preference and invitation cookies

These may remember information such as:

• invitations you have accepted;
• beta access;
• workspace settings; and
• user preferences.

We do not currently use advertising cookies or cross-site advertising trackers.

We do not sell cookie information.

Our marketing website may be hosted using Framer, which may process basic technical or operational logs.

If we introduce website analytics, we intend to favour privacy-conscious analytics tools where reasonably practical.

Blocking essential cookies may prevent some features, including sign-in, from functioning correctly.

We do not sell your personal information.

We may disclose information to the following categories of recipients where necessary to operate replyora.

People within your workspace

Agency users, workspace administrators and invited client users may see information according to their assigned role, permissions and workspace settings.

Social media platforms

If you connect a social media account, we exchange information with the relevant platform through its API to provide the functions you have authorised.

This may include accessing profile information, content or performance data and publishing content that you have created, approved and instructed us to publish.

Payments

Stripe may receive payment and billing information when processing subscriptions or other payments.

Hosting and database services

We may use providers including:

• Netlify for application hosting; and
• Neon for database infrastructure.

File storage

We may use Cloudflare, including Cloudflare R2, to store images, videos and other uploaded assets.

Email delivery

We may use Resend to send transactional emails and deliver website contact-form communications.

AI processing

We may use Google’s Gemini API to process information needed to generate AI-assisted responses and outputs.

Depending on the feature you use, this may include:

• brand information;
• topics or prompts;
• caption instructions;
• script instructions; and
• AI chatbox messages.

Google may also provide authentication services if you choose Google sign-in.

Website and waitlist services

Our marketing website may be hosted through Framer.

Waitlist information may also be stored or processed using services including:

• Notion; and
• Flodesk.

Legal, regulatory and safety disclosures

We may disclose information where reasonably necessary or required to:

• comply with law;
• respond to a valid legal process or court order;
• enforce our rights;
• investigate fraud or security incidents; or
• protect the safety of users or others.

Business transfers

Information may be transferred as part of a proposed or completed:

• merger;
• acquisition;
• restructure;
• financing;
• sale of a business; or
• sale of assets.

Where relevant, this would remain subject to this Privacy Policy, applicable law or additional notice.

Our providers process information in connection with the services they provide to us and subject to their applicable contractual, privacy and data-processing terms.

The providers used by replyora may change as our Service develops.

You may contact us for information about our current major service providers.

Our access to and use of information received through Meta platforms and the TikTok API is subject to the applicable platform terms, developer policies and permissions.

We request only the permissions reasonably required to provide the features that you choose to use.

Depending on the platform and permissions granted, these may include permissions necessary to:

• identify the connected account;
• display profile information;
• retrieve permitted content;
• retrieve available performance metrics;
• help you plan and report on content; and
• publish content you create and approve.

We use platform permissions only in connection with the Service and authorised functionality.

We do not independently decide to post content to your account.

We do not sell social-platform data.

We do not use platform information for independent advertising or resale.

We may share platform information with service providers that are reasonably necessary to operate replyora, subject to this Policy and applicable platform requirements.

Access and refresh tokens may be stored in our database and used only to provide authorised features for the relevant workspace.

You may revoke replyora’s access at any time by:

• disconnecting the account within replyora; or
• removing replyora through the relevant Facebook, Instagram or TikTok settings.

Revoking access prevents future processing that relies on that connection, subject to information we may lawfully retain.

replyora includes features that may use artificial intelligence.

These may include:

• caption generation;
• reel or video scripts;
• hooks;
• content ideas;
• suggested replies;
• brand-related suggestions; and
• website chatbox responses.

When you use an AI-assisted feature, information necessary to perform the task may be sent to an AI service provider such as Google’s Gemini API.

Depending on the feature, this may include:

• brand information;
• content pillars;
• prompts;
• topics;
• instructions;
• website chatbox messages; and
• other text supplied in connection with the request.

replyora does not use customer content to train an AI model owned by replyora.

AI-generated material may be inaccurate, incomplete, unsuitable or misleading.

You should review AI-generated material before relying on it, sending it to another person or publishing it publicly.

Built-in templates or non-AI functionality may also be used in some areas of the Service.

Do not submit sensitive, confidential or third-party information to an AI feature unless it is reasonably necessary for your use of that feature and you are authorised to provide that information.

Customers who install a replyora AI chatbox on their website are responsible for ensuring that their own website visitors receive any privacy notices, disclosures or consents that the customer is legally required to provide.

If you join our waitlist, we store information such as your name and email address so that we can manage your place on the waitlist and contact you about replyora.

If you have requested or consented to receive marketing communications, we may send:

• waitlist updates;
• beta invitations;
• product announcements;
• launch information; and
• related replyora updates.

Marketing emails include an unsubscribe mechanism.

You may unsubscribe at any time.

We process unsubscribe requests in accordance with applicable Australian spam requirements.

If you redeem a beta invitation, we may record:

• the invitation or access code;
• the date it was redeemed; and
• the date your free or promotional access period began.

If you send us a general enquiry, we use your information to respond to that enquiry.

Submitting a general contact enquiry does not, by itself, mean you will automatically be added to a marketing mailing list.

To leave the waitlist or ask us to stop sending marketing communications, use the unsubscribe link provided in the relevant email or contact: aarushi@replyora.net

We retain personal information for as long as reasonably necessary to:

• provide the Service;
• maintain active accounts;
• comply with legal requirements;
• maintain appropriate business and financial records;
• resolve disputes;
• prevent fraud or abuse; and
• enforce our agreements.

Some categories of information may have more specific retention periods.

For example:

• notifications you have already read may be deleted after approximately 90 days;
• website chatbox conversations that did not produce a lead may be deleted after approximately 180 days;
• chatbox conversations where a visitor has submitted contact information may be retained for the relevant workspace owner until deleted or the workspace is closed; and
• financial, billing and tax information may be retained for periods required by law, including up to seven years where applicable.

When a workspace, client profile or connected account is deleted, we delete or de-identify associated information within a reasonable period unless we are legally required or reasonably permitted to retain it.

We use administrative, organisational and technical measures designed to protect personal information.

These may include:

• encryption in transit;
• access controls;
• authentication controls;
• role-based permissions;
• workspace separation;
• secure infrastructure;
• database encryption at rest where provided by our infrastructure providers; and
• server-side handling of connected social account tokens.

Connected social access tokens are intended to be used only to provide authorised functionality for the workspace associated with that account.

However, no method of internet transmission, storage or electronic processing can be guaranteed to be completely secure.

You are responsible for:

• choosing a strong password;
• keeping your login credentials confidential;
• protecting devices through which you access replyora; and
• notifying us promptly if you suspect unauthorised access.

If you believe your replyora account has been compromised, contact us as soon as possible.

Depending on the laws that apply to you, you may have rights concerning your personal information.

Under Australian privacy law, where applicable, you may be entitled to request access to personal information we hold about you and ask us to correct information that is:

• inaccurate;
• out of date;
• incomplete;
• irrelevant; or
• misleading.

People located in other jurisdictions may have additional rights under applicable law, which may include:

• deletion;
• objection;
• restriction;
• portability; or
• withdrawal of consent.

To make a privacy request, contact: aarushi@replyora.net

We may need to verify your identity before fulfilling a request.

We aim to respond to privacy requests within 30 days, although some requests may require additional time depending on their complexity or applicable law.

We do not charge a fee simply to receive a privacy request.

Where permitted by law, reasonable costs may apply to providing access in certain circumstances.

We will not treat you unfairly because you exercised a privacy right.

Privacy complaints

If you believe we have mishandled your personal information, please contact us at: aarushi@replyora.net

We will review your complaint and may contact you if we need additional information.

We aim to acknowledge and investigate privacy complaints within a reasonable period and provide a substantive response within approximately 30 days where reasonably possible.

If you are not satisfied with our response and Australian privacy law applies, you may also be entitled to contact the Office of the Australian Information Commissioner.

You may ask us to delete personal information associated with your replyora account or connected social account.

There are several ways to do this.

Disconnecting an account in replyora

You can disconnect a social media integration from the relevant Integrations area within replyora.

When a social account is disconnected, the stored access token associated with that connection is removed or invalidated so that replyora can no longer use it to act on that account.

You may also be able to delete individual information or content within the Service, such as:

• posts;
• assets;
• invoices;
• clients; and
• brand records.

Requesting account deletion by email

To request deletion of your whole replyora account or specific account information, email: aarushi@replyora.net

Use the subject: Data Deletion Request

Where possible, send the request from the email address associated with your replyora account.

Please tell us whether you are requesting:

• deletion of your entire account; or
• deletion of information associated with a particular connected account.

We may verify your identity before processing the request.

Removing replyora through a social platform

You can also remove replyora through the settings provided by Facebook, Instagram, TikTok or another connected platform.

This revokes our ability to access that platform through the authorisation you previously granted.

What happens following a deletion request

Once we verify a valid deletion request, we aim to delete or de-identify the relevant personal information within 30 days.

Depending on the request, this may include:

• access tokens;
• connected-account information;
• uploaded content;
• workspace information;
• account information; and
• other associated personal information.

We may retain limited information where reasonably necessary or legally required, including:

• financial records;
• tax records;
• records required by law;
• fraud-prevention information;
• information required to resolve disputes; or
• information necessary to establish, exercise or defend legal rights.

Information retained for these purposes will not be kept longer than reasonably necessary.

Where appropriate, we will confirm completion of a deletion request by email.

Meta, Instagram and TikTok data

If you connected a Meta, Instagram or TikTok account and want information obtained through that platform removed, you may:

• disconnect the account through replyora;
• revoke replyora’s access through the relevant platform; or
• email aarushi@replyora.net with the subject Data Deletion Request.

replyora is based in Australia.

Some of our service providers operate infrastructure or personnel in other countries.

Depending on the services you use, personal information may be processed in:

• Australia;
• the United States; and
• other countries in which our service providers or their infrastructure operate.

Where Australian privacy law applies to an overseas disclosure, we take reasonable steps required by applicable law in relation to the handling of that information.

Different countries may have different privacy and data-protection laws.

If you access replyora from outside Australia, you acknowledge that information may be processed in Australia and in jurisdictions where our service providers operate.

replyora is intended primarily for businesses, professionals, creators, agencies and their clients.

The Service is not directed to children under 16.

We do not knowingly seek to collect personal information directly from children under 16.

If you believe a child under 16 has provided personal information to us without appropriate authorisation, contact: aarushi@replyora.net

We will review the matter and take appropriate steps, including deletion where appropriate.

We may update this Privacy Policy from time to time as:

• our Service changes;
• our providers change;
• new features are introduced; or
• legal or regulatory requirements change.

When we update this Policy, we will publish the updated version and revise the “Last updated” date.

For material changes, we may also provide additional notice, including through:

• email;
• the replyora platform; or
• our website.

Your continued use of the Service after an updated Privacy Policy becomes effective will be subject to the updated Policy, to the extent permitted by law.

For privacy questions, access requests, correction requests, complaints or data-deletion requests, contact: aarushi@replyora.net

replyora is operated by: Aarushi Duggal, sole trader trading as replyora, ABN 14 143 824 703, Sydney, New South Wales, Australia.