replyora.

Privacy Policy

Effective 9 July 2026Last updated 9 July 2026

ReplyOra ("we," "us," or "our") operates ReplyOra from Sydney, New South Wales, Australia. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, create an account, accept a client invite, connect a social media account, use our AI website chatbox, or otherwise use our services (the "Service").

This Policy is designed to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle personal information of individuals located outside Australia, we also seek to honour applicable local requirements.

ReplyOra is operated by Aarushi Duggal, a sole trader (ABN 14 143 824 703), based in Sydney, NSW, Australia.

1. Scope

This Policy applies to personal information we process about users of the Service, including agency account holders, personal-brand users, client portal users invited by a workspace administrator, and end-users who interact with an AI website chatbox that a customer has deployed using ReplyOra.

This Policy does not apply to third-party websites, social networks, or services you connect to or link from the Service. Those services have their own privacy policies.

2. Information we collect

We collect information in the following categories:

  • Account & profile: name, email address, password (stored in hashed form), workspace name, role, and preferences (timezone, date format, landing page), and authentication session data.
  • Workspace & client data: brand names, package details, deliverables, voice notes, content pillars, posts, captions, schedules, tasks, invoices, billing notes, and invite records you or your team enter.
  • Content you upload: images, videos, filenames, and related metadata stored in our cloud storage.
  • Connected social account data: if you connect an Instagram, Facebook (Meta) or TikTok account, we access and store — via the platform's official API and only within the scope you authorise — access and refresh tokens, the connected account's ID and profile details, the Facebook Pages and Instagram Business/Creator accounts you grant access to, existing content on the account, and basic performance metrics (such as reach and engagement) made available by the platform. We access this so you can plan, preview, and report inside ReplyOra, and — when you choose to publish or schedule a post you have created and approved — to publish that content to the account you connected. Publishing happens only when you initiate it; ReplyOra never posts on its own or decides what to post. See Section 7 for how we handle platform data.
  • AI website chatbox data: if you deploy an AI chatbox on a website, we process the conversations and messages that end-users send to that chatbox, along with basic technical data needed to deliver replies. You are responsible for telling your own website visitors that a chatbox is in use.
  • Usage & device: log data, IP address, browser type, pages viewed, actions taken in the app, and diagnostic information used to secure and improve the Service.
  • Communications: messages you send us (support requests, feedback).
  • Subscription & payment data: if you purchase a paid plan, payment card details and billing address are collected and processed by Stripe, Inc. We do not store your full payment card number on our systems.

3. How we collect information

  • Directly from you when you register, complete forms, upload assets, create posts, connect a social account, or contact support.
  • From workspace administrators who invite you to a client portal and assign your role.
  • From social media platforms (Meta, TikTok) when you authorise a connection, limited to the permissions you grant.
  • Automatically through cookies, session tokens, and similar technologies necessary to authenticate you and operate the Service.
  • From service providers that host infrastructure, authentication, storage, email, analytics, AI processing, or payment processing on our behalf.

Cookies we use

ReplyOra sets only cookies that are essential to run the Service:

  • Session cookies that keep you signed in and secure your account (set by our authentication system when you log in).
  • Google sign-in cookies — if you choose "Continue with Google", Google sets its own cookies as part of the sign-in flow, governed by Google's Privacy Policy.

We do not use advertising cookies, and we do not sell or share cookie data. Because these cookies are strictly necessary, the Service cannot function without them; blocking them in your browser will prevent sign-in.

4. How we use information

We use personal information to:

  • Provide, maintain, and secure the Service.
  • Authenticate users and enforce role-based access (agency vs. client portal).
  • Store and display your content, calendars, assets, approvals, and billing records.
  • Display your connected account's profile, content, and performance metrics so you can plan, preview, and report, and publish or schedule the posts you create and approve to your connected account when you choose to publish them.
  • Operate optional AI-assisted features (for example, generating or suggesting captions, content pillars, or chatbox replies).
  • Deliver the AI website chatbox and respond to end-user messages on your behalf.
  • Process subscription payments, renewals, cancellations, and billing-related communications through Stripe.
  • Send transactional messages (account creation, invites, security notices, billing receipts).
  • Respond to support requests and communicate about the Service.
  • Analyse usage to fix bugs, prevent abuse, and improve features.
  • Comply with law and protect our rights, our users, and the public.

5. Handling of personal information under the APPs

We collect personal information only where it is reasonably necessary for our functions and activities. Where practical, you may deal with us anonymously or pseudonymously, though some features (such as connecting a social account or paying for a plan) require identification. We do not use or disclose personal information for a purpose other than the one for which it was collected, unless you would reasonably expect it, you consent, or it is otherwise permitted under the Privacy Act 1988 (Cth).

Where we ask for consent (for example, certain optional communications), you may withdraw it at any time.

6. When we share information

We do not sell your personal information. We share information only as described below:

  • Within your workspace: agency users, and client portal users invited to a brand, can see information according to role and visibility settings configured in the Service.
  • Social media platforms: if you connect an account, we exchange data with the platform (Meta, TikTok) via its API to read the information you authorise (such as your profile, content, and metrics) for planning and reporting, and to publish the content you create and approve when you choose to publish or schedule it.
  • Payment processing: Stripe, Inc. receives payment card and billing information you provide at checkout to process subscriptions on our behalf. Stripe's privacy policy is available at https://stripe.com/privacy.
  • Service providers (subprocessors): hosting and database (Netlify, Neon), authentication, cloud storage, email delivery, analytics, and AI processing (Google, for Gemini) vendors who process data under contractual obligations. A current list is available on request.
  • Legal & safety: when required by law, court order, or to protect rights, safety, and security.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy or notice to you.

7. Meta and TikTok platform data — limited use

Our access to and use of information obtained through the Meta Platforms (Facebook, Instagram) and the TikTok API is subject to, and we comply with, the Meta Platform Terms, the Meta Developer Policies, and the TikTok Developer Terms of Service and related policies.

Specifically:

  • We only request the permissions needed to provide the features you use — for example, reading your profile, content, and performance metrics so you can plan and report, and publishing the content you create and approve to your connected accounts when you choose to publish or schedule it. We use these permissions only to carry out actions you initiate, and never to post autonomously.
  • We use platform data only to provide and improve the Service for you, and not for any independent purpose, advertising, or resale.
  • We do not sell platform data, and we do not share it except with the service providers described above who help us operate the Service.
  • We store platform access tokens securely and use them only to perform actions you have authorised.
  • You can revoke our access at any time by disconnecting the account in the Service, or through your Facebook, Instagram, or TikTok settings. Revoking access stops future processing; see Section 11 for deletion.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

When a workspace, client, or connected account is archived or deleted, we delete or de-identify the associated data within a reasonable period (see Section 11) unless retention is required by law or for legitimate business needs (for example, billing and tax records, which we may retain for up to seven years as required under Australian law).

9. Security

We implement administrative, technical, and organisational measures designed to protect personal information, including encryption in transit, access controls, and secure cloud infrastructure. Social access tokens are stored using encryption.

No method of transmission or storage is completely secure. You are responsible for using a strong password and safeguarding your credentials.

10. Your privacy rights

Under the Australian Privacy Principles, you may request to access the personal information we hold about you and to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading. Depending on where you live, you may have additional rights (such as deletion or data portability) under other applicable laws.

To exercise your rights, email aarushi@replyora.net. We may verify your identity before responding, and we will respond within a reasonable period (usually within 30 days). We will not charge you to make a request, though a reasonable cost may apply to certain access requests as permitted by law. We will not discriminate against you for exercising your rights.

If you are not satisfied with how we handle your personal information or a privacy request, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. Deleting your data

You can ask us to delete the personal information associated with your account or a connected social media account at any time. There are three ways to do this:

  1. In the app: go to Settings → Account (or Settings → Connections for a specific social account) and choose Delete / Disconnect. Disconnecting a Meta or TikTok account immediately revokes the stored access token so we can no longer act on that account.
  2. By email: send a request to aarushi@replyora.net from the email address on your account, with the subject line "Data Deletion Request." Tell us whether you want your entire account deleted or only a specific connected account's data removed.
  3. Through the platform: you can also remove ReplyOra from your Facebook, Instagram, or TikTok app settings, which revokes our access.

What happens next: once we verify the request, we will delete or de-identify the relevant personal information — including stored access tokens, connected-account data, uploaded content, and workspace data — within 30 days. We may retain a limited amount of information where required by law or for legitimate business needs (for example, billing and tax records), and we will delete that information once the retention period ends.

Meta / Facebook & Instagram and TikTok users: if you connected a Meta or TikTok account and want the data we obtained through that platform deleted, either disconnect the account in the Service or email aarushi@replyora.net with "Data Deletion Request." We will confirm completion by email.

12. International data transfers

We are based in Australia. Some of our service providers may store or process data in other countries (for example, the United States). Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. If you access the Service from outside Australia, you understand that your information may be processed in Australia and in other countries where our providers operate.

13. Children's privacy

The Service is intended for businesses and is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact aarushi@replyora.net and we will delete it.

14. Cookies & similar technologies

We use essential cookies and similar technologies to keep you signed in, remember preferences, and protect the Service. We do not use non-essential advertising cookies on the core application without notice. You can control cookies through your browser settings; disabling essential cookies may prevent you from using the Service.

15. Third-party services

The Service relies on third-party infrastructure (for example, cloud hosting, database, authentication, file storage, and AI processing). Those providers process data on our instructions and are contractually required to protect it.

For subscriptions, Stripe, Inc. is our payment processor. We receive from Stripe limited information needed to manage your account, such as the last four digits of your card, card brand, expiration date, billing email, subscription status, invoice history, and payment success or failure notices. We do not receive or store your complete card number or CVC.

Links to social platforms or external sites are not controlled by us.

16. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the "Last updated" date. Material changes may be communicated by email or in-product notice where appropriate.

17. Contact us

Privacy inquiries: aarushi@replyora.net General contact: aarushi@replyora.net Operated by: Aarushi Duggal, a sole trader trading as ReplyOra (ABN 14 143 824 703) Location: Sydney NSW, Australia