Privacy Policy

REPLAICHAT GLOBAL PRIVACY NOTICE

Effective Date: 07.30.2026
Last Updated: 07.30.2026

This Privacy Notice explains how ReplAiChat processes Personal Data in connection with its website and Service.

1. Who We Are

Controller: ReplAiChat
Contact: hello@replaichat.com

2. Our Roles

2.1. ReplAiChat acts as a controller for:

a) Account administration;

b) billing;

c) website operation;

d) support;

e) security;

f) direct communications about ReplAiChat.

2.2. ReplAiChat acts as a processor, service provider or contractor when processing End User data for a Customer.

2.3. Customers determine the purposes of their chatbot processing and must provide their own privacy notice to End Users.

3. Personal Data We Process

3.1. Account Data

a) name;

b) email address;

c) telephone number, if provided;

d) organisation and role;

e) Account identifier;

f) settings and preferences;

g) login history;

h) Authorised User permissions.

3.2. Billing Data

a) Subscription details;

b) payment amount and status;

c) transaction identifier;

d) billing address;

e) tax and business information;

f) invoice and refund history.

Full payment card details are generally processed by the payment provider rather than ReplAiChat.

3.3. Technical Data

a) IP address;

b) browser and operating system;

c) device type;

d) language;

e) date and time;

f) activity logs;

g) security events;

h) pages viewed;

i) cookies and session identifiers.

3.4. Service Content

a) website addresses and selected pages;

b) uploaded files and documents;

c) knowledge-base content;

d) chatbot instructions and flows;

e) conversation content;

f) generated responses;

g) feedback and corrections;

h) integration data;

i) usage statistics.

3.5. End User Data

Depending on Customer configuration:

a) message content;

b) contact details requested by the Customer;

c) messaging-platform identifiers;

d) conversation history;

e) enquiry, product or order information;

f) voluntarily submitted files;

g) conversation time and source;

h) lead or enquiry status.

4. Purposes and Legal Bases

ReplAiChat processes Personal Data for:

a) providing and administering the Service;

b) authenticating users;

c) processing payments;

d) providing support;

e) operating integrations;

f) maintaining security;

g) preventing fraud and abuse;

h) diagnosing errors;

i) improving performance;

j) complying with legal obligations;

k) establishing and defending legal claims;

l) sending marketing communications where legally permitted.

For EEA and UK individuals, the legal bases may include contract, legitimate interests, consent and legal obligation.

When ReplAiChat acts as a processor, the Customer determines the applicable legal basis.

5. AI Processing

5.1. ReplAiChat uses AI components to retrieve relevant knowledge-base content, analyse context and generate responses.

5.2. The Service is designed to separate direct identifiers and contact details from the context provided to the AI processing component.

5.3. The AI processing component does not have direct access to:

a) complete profile databases;

b) lead records;

c) stored contact details;

d) payment information;

e) integration secrets;

f) administrative Accounts.

5.4. AI context may include:

a) message text after implemented removal or masking steps;

b) relevant knowledge-base extracts;

c) chatbot instructions;

d) a technical identifier that does not independently identify an individual.

5.5. An End User may voluntarily enter Personal Data in free-text content. ReplAiChat applies the filtering and separation measures supported by its technical architecture, but automated detection may not identify every unpredictable form of Personal Data.

5.6. Generated responses may be stored in the Russian-hosted database as part of the conversation.

5.7. Customer Data is not used to train a publicly available AI model without separate express permission or a written agreement.

5.8. Customers must notify End Users that they are interacting with an AI system where required by law.

6. Storage and International Transfers

6.1. The main Service database is hosted on a server located in the Russian Federation.

6.2. Transfers of EEA Personal Data to Russia require a valid mechanism under Chapter V of the GDPR.

6.3. ReplAiChat and the relevant Customer may use:

a) the EU Standard Contractual Clauses;

b) a Data Processing Addendum;

c) a transfer impact assessment;

d) appropriate supplementary safeguards.

6.4. Transfers of UK Personal Data may require the UK International Data Transfer Agreement or the UK Addendum and an applicable transfer risk assessment.

6.5. Details of the relevant mechanism may be requested from privacy@replaichat.com.

6.6. Data that is only pseudonymised remains Personal Data. Information falls outside data protection law only where it has been irreversibly anonymised so that an individual is no longer identifiable by reasonably available means.

7. Recipients and Subprocessors

Personal Data may be made available, where necessary, to:

a) hosting and infrastructure providers;

b) payment providers;

c) email providers;

d) support tools;

e) security and monitoring providers;

f) professional advisers;

g) public authorities where legally required.

The current subprocessor list is available at [subprocessor URL].

Customers will be informed of material subprocessor changes as described in the Data Processing Addendum.

8. Retention

Unless law or a written agreement requires otherwise:

a) Account Data: for the Account term and up to 30 days afterwards;

b) billing records: for the applicable legal retention period;

c) conversations: according to Customer settings or Subscription limits;

d) support records: up to 24 months after closure;

e) security logs: up to 12 months unless required for an incident;

f) backups: up to 90 days after deletion from the live system;

g) marketing prospects: up to three years after the last relevant interaction, unless an earlier objection is received.

Customers are responsible for selecting appropriate retention periods for End User Data.

9. Privacy Rights

Depending on applicable law, individuals may have rights to:

a) access Personal Data;

b) correct inaccurate data;

c) request deletion;

d) restrict processing;

e) object to certain processing;

f) withdraw consent;

g) receive portable data;

h) receive information about international transfers;

i) complain to a data protection authority;

j) exercise rights concerning significant automated decisions.

Requests may be sent to privacy@replaichat.com.

ReplAiChat may request information reasonably necessary to verify identity.

Where a request concerns a Customer chatbot, ReplAiChat may refer the request to the relevant Customer.

10. EEA and French Individuals

10.1. Individuals in the EEA may contact the EEA Representative listed above.

10.2. Individuals may lodge a complaint with the supervisory authority in their country.

10.3. Individuals in France may lodge a complaint with the Commission nationale de l’informatique et des libertés.

10.4. ReplAiChat applies the GDPR where its territorial scope requirements are met.

11. United Kingdom

11.1. UK individuals may contact the UK Representative where one is required and appointed.

11.2. Complaints may be submitted to the Information Commissioner’s Office.

11.3. Transfers from the UK are handled using an applicable UK transfer mechanism where required.

12. United States

12.1. Where a United States state privacy law applies, residents may have additional rights to know, correct, delete or obtain a copy of Personal Data and to opt out of certain uses.

12.2. ReplAiChat does not sell Customer Content or End User Data for monetary consideration.

12.3. Whether website advertising or analytics activity constitutes a «sale» or «sharing» under a particular state law must be assessed based on the tools actually deployed.

12.4. Where required, ReplAiChat will provide an additional state-specific notice and opt-out mechanism.

13. Australia and Other Regions

13.1. Where applicable, ReplAiChat will take reasonable steps required by local law in relation to overseas processing and disclosure.

13.2. Additional rights or disclosures may apply depending on the Customer’s location and the markets intentionally served.

13.3. A regional notice or contractual addendum prevails where it provides greater protection required by mandatory local law.

14. Marketing

14.1. ReplAiChat sends marketing communications only where a lawful basis exists.

14.2. A recipient may unsubscribe using the link in the message or by contacting ReplAiChat.

14.3. Account, billing, security and contractual notices may still be sent where necessary.

14.4. Customers are responsible for the legality of marketing sent through their own chatbots, broadcasts or integrations.

15. Cookies

15.1. Strictly necessary cookies may be used to operate and secure the website.

15.2. Analytics, personalisation and advertising cookies that require consent are activated only after the relevant choice has been made.

15.3. Cookie preferences can be changed through the consent manager.

15.4. Additional information is provided in the Cookie Notice.

16. Security

ReplAiChat uses technical and organisational measures proportionate to the relevant risks, which may include:

a) access controls;

b) environment separation;

c) protection of secrets and tokens;

d) encryption in transit;

e) backups;

f) security logging;

g) incident monitoring;

h) vulnerability management;

i) restrictions on administrative access.

Only measures actually implemented should be listed publicly.

17. Security Incidents

17.1. ReplAiChat investigates incidents affecting the confidentiality, integrity or availability of Personal Data.

17.2. When acting as a processor, ReplAiChat notifies the affected Customer without undue delay after confirming a Personal Data breach.

17.3. When acting as a controller, ReplAiChat makes legally required notifications to regulators and affected individuals.

18. Sensitive Data and Children

18.1. The Service is intended for adult business users.

18.2. Customers must not configure chatbots to collect sensitive, biometric, health, detailed financial or children’s data without a valid legal basis and prior agreement with ReplAiChat.

19. Changes to This Notice

ReplAiChat may update this Notice to reflect changes in the Service, infrastructure or applicable law.

Material changes will be communicated through an appropriate notice before they take effect.

20. Contact

hello@replaichat.com