Privacy policy

Who is who

Replybio (“we”, “us”) provides software that lets a business owner publish a personal AI assistant on a public link.

• Owners are the people and businesses with an account. For the account data of owners, we are the controller.
• Visitors are people who chat with an owner's assistant. For the conversations and contact details of visitors, the owner decides why and how the data is used, so the owner is the controller and we act as the owner's processor.

Data we process about owners

• Account data: email address and a password (stored only as a hash by our authentication provider).
• Profile data you enter: display name, handle, bio, timezone and tone of voice.
• Content you add: knowledge items, rules, notification settings, replies, corrections and the status you give to leads.

We use this data to run your account, show your assistant to visitors, send you the notifications you turned on, and keep the service secure.

Data we process about visitors

• Messages a visitor types in the chat, the replies of the assistant and of the owner, and the visitor's browser timezone and language.
• An anonymous identifier stored in a cookie named vid. It is random, not linked to a name, lasts one year, and is used only to keep a visitor's conversation together and to limit abuse. Without it the chat cannot continue after a reload.
• Name and email address, only if the visitor chooses to share them. Before asking, the assistant tells the visitor that sharing them means the owner may store them, with the conversation, to reply to them. The time the visitor shared them is recorded.
• IP address, used only to rate-limit requests. We store only a one-way hash of it, in short-lived records that are cleaned up automatically. We do not store raw IP addresses.

The owner can read every conversation. The chat page tells visitors that they are talking to an AI assistant and that the owner can read the conversation.

How AI is involved

To write a reply, the visitor's messages and the owner's knowledge are sent to an AI provider (OpenAI or Anthropic, depending on how the service is configured). The assistant is instructed to answer only from the owner's knowledge and to say so when it does not know. AI can still make mistakes, which is why owners can read conversations and mark answers as wrong. We do not use your content to train our own models. The providers' API terms apply to the processing they do; please check their current policies.

Who else processes data

• Supabase: database, authentication and file hosting.
• OpenAI or Anthropic: generating the assistant's replies.
• Resend: sending notification emails to owners.
• Sentry: error monitoring. It receives technical error reports; chat messages, email addresses and cookies are removed before a report is sent.
• Our hosting provider: serving the website and the application.

We do not sell personal data and we do not use it for advertising. We do not use advertising or analytics cookies. The cookies we do set are listed in the section Cookies and similar storage below.

Cookies and similar storage

We set only essential cookies, the ones the service needs to work. They are set without asking because they are needed to give you what you asked for, and the notice on the site tells you about them. You can open the cookie settings at any time with the link at the bottom of every page. If we ever add optional cookies, such as analytics, we will use them only if you allow them there.

• Sign-in cookie (owners): keeps you signed in to your dashboard. It is set by our authentication provider and lasts for your login session.
• vid (visitors who chat): a random anonymous identifier so your conversation stays together and abuse can be limited. It is not linked to your name and lasts 1 year.
• Current chat (browser session storage): remembers the open conversation until you close the tab.
• Your cookie choice (browser local storage): remembers your answer to the cookie notice so we do not ask again.

You can also block or delete cookies in your browser settings. If you block the essential ones you will not be able to sign in, and the chat may not keep your conversation after a reload.

How long we keep data

Conversations, leads and knowledge stay until the owner deletes them or closes the account. Short-lived rate-limit records are cleaned up automatically.

Deleting your data

• Owners can delete a conversation, with its messages and lead, from the dashboard at any time. They can delete the whole account under Settings, Delete account. That removes the profile, knowledge, rules, conversations, messages, leads, notification settings and subscription record, and cancels the subscription at once.
• Visitors can delete their own conversation, including any name or email they shared, with the link “Delete this conversation” below the message box. It works in the browser where the conversation was started. The owner may already have received your details by email; for those, ask the owner or write to us.
• What stays. Our payment provider keeps the payment records that the law requires. If you received a refund, we keep a minimal record of it (email address and a card identifier, no card number) so the one-refund-per-customer rule can be applied. Copies in our database provider's backups disappear when those backups expire.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, to object to or restrict its processing, and to withdraw consent at any time. If you are a visitor, ask the business owner whose assistant you chatted with, or write to us and we will pass the request on or act on it ourselves. You also have the right to complain to your data protection authority.

Security

Data is transferred over encrypted connections. Each owner can only access their own rows, enforced in the database. Public chat requests run on the server and never expose another owner's data. Secrets are kept on the server and never sent to the browser. No system is perfectly secure, and we will tell affected people and authorities where the law requires it.

Owners' responsibilities

If you use the service you decide what your assistant says and what you do with visitors' data. You are responsible for having a lawful reason to process it, for answering visitors' requests, and for not asking visitors to share sensitive data through the chat.

Children

The service is meant for businesses and their customers. It is not directed at children under 16, and we do not knowingly collect their data.

International transfers

Our providers may process data outside your country. Where required we rely on legal safeguards such as standard contractual clauses.

Changes to this policy

If we change this policy in a meaningful way we will update the date above and, for owners, notify you by email.

Contact

Questions or requests about personal data: andriimuzhchil@gmail.com.