Privacy Policy

This policy is provided as a strong starting template. It is not legal advice. Have it reviewed by a qualified Australian privacy lawyer before you rely on it, and complete every [bracketed] placeholder.

Replyora ("Replyora", "we", "us", "our") is an AI customer-conversation platform that helps businesses reply to enquiries, capture leads, qualify them, and book customers ("Service").

Pre-launch status. Replyora is currently pre-launch and is operated by its founder, based in Sydney, Australia. A registered operating entity and ABN have not yet been established and will be added here at official launch. Until then, this policy applies to any early/trial use of the Service on that basis.

We respect your privacy and are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

This policy explains what we collect, how we use it, who we share it with, and your rights. By using the Service you agree to this policy.

1. Who this policy covers and our role

Replyora serves three groups, and our role differs for each:

• Account holders (business owners/admins who sign up). For your account, billing and usage data, Replyora is the data controller.
• Businesses' content and end-user data. When a business uploads knowledge and its assistant handles conversations and captures leads, that data belongs to the business. For this data Replyora acts as a data processor / service provider on behalf of the business (the business is the controller). The business is responsible for having a lawful basis and privacy notice for the personal information it collects through its assistant.
• Website visitors and end-users who interact with a Replyora-powered chat widget on a business's website.

2. Information we collect

a. Information you give us (account holders)

• Identity and contact details: name, email, business name, phone.
• Business profile: industry, description, website, address, opening hours.
• Content you upload to your knowledge base: FAQs, services, pricing, policies, documents, and website content.
• Account settings and support communications.

b. Payment information

• Billing is processed by Stripe. We do not store full card numbers. We receive limited billing details (e.g. name, plan, last 4 digits, transaction status) to manage your subscription and the one-time setup fee.

c. End-user / conversation data (processed on behalf of the business)

• Chat messages between visitors and a business's assistant.
• Lead details a visitor provides (e.g. name, email, phone, enquiry/intent) and booking details.
• Technical metadata: page URL, approximate location from IP, timestamps, channel.

d. Information we collect automatically

• Device and usage data: IP address, browser type, pages viewed, actions taken, and diagnostics.
• Cookies and similar technologies (see section 8).

We do not intentionally collect sensitive information (e.g. health, racial, political data). Businesses should avoid configuring their assistant to collect sensitive information without a lawful basis and appropriate consent.

3. How we use information

We use personal information to:

• Provide, operate, and maintain the Service, including generating AI responses from your knowledge base.
• Capture, qualify, and route leads and bookings for the relevant business.
• Process payments, manage subscriptions, and prevent billing fraud.
• Provide customer support and respond to enquiries.
• Monitor, secure, debug, and improve the Service.
• Send service and administrative communications, and (with consent where required) marketing you can opt out of at any time.
• Comply with legal obligations and enforce our Terms.

We do not sell personal information.

4. AI processing

To generate responses, relevant content and conversation messages are sent to our AI providers (Anthropic and/or OpenAI) via their APIs. We also create numerical representations ("embeddings") of knowledge-base content to power search and retrieval. We configure these services so that your content is not used to train their models, consistent with the providers' API terms. AI-generated responses may be imperfect; see our Terms for the associated disclaimer.

5. Who we share information with (subprocessors)

We share information only as needed to run the Service, with vetted providers under confidentiality and data-protection obligations:

We may also disclose information: to comply with the law or valid legal requests; to protect our rights, users, or the public; and in connection with a business sale or reorganisation (with continued protection of your data).

6. Storage and international transfers

Personal information may be stored and processed on servers located outside Australia (for example, in the United States or the EU) by our providers. Where we transfer data overseas, we take reasonable steps to ensure it is handled consistently with the APPs and, for GDPR data, use appropriate safeguards such as Standard Contractual Clauses.

7. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within a reasonable period, unless a longer period is required by law (e.g. financial records). Businesses can delete knowledge sources, conversations, and leads at any time, and can request full workspace deletion (see section 9).

8. Cookies and tracking

We use essential cookies to run the Service (e.g. authentication) and, with your consent where required, analytics cookies to understand usage. You can control cookies through your browser settings; disabling essential cookies may break parts of the Service.

9. Your rights and choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or restrict certain processing, and withdraw consent.
• Request a copy of your data in a portable format (data export).
• Opt out of marketing communications.

Account holders can exercise many of these directly in the dashboard (edit profile, delete sources/leads, export data, delete workspace) or by emailing us. End-users who interacted with a business's assistant should contact that business (the data controller); we will assist the business in responding.

To make a request, email hello.replyora@gmail.com. We will verify your identity and respond within the timeframe required by law.

10. Security

We use technical and organisational measures to protect personal information, including encryption in transit and at rest, strict tenant isolation (row-level security so each business's data is separated), access controls, and least-privilege handling of secrets. No system is completely secure; we cannot guarantee absolute security, but we work to protect your data and will notify affected users and regulators of eligible data breaches as required by the Notifiable Data Breaches scheme.

11. Children

The Service is not directed to individuals under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice.

13. Complaints

If you have a privacy concern, contact us first at hello.replyora@gmail.com and we will work to resolve it. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. EU/UK users may also contact their local supervisory authority.

14. Contact us

Replyora (pre-launch; operating entity to be confirmed at launch) Email: hello.replyora@gmail.com Sydney, Australia