PRIVACY POLICY
Your Data.
Our Responsibility.
1. Two Roles, Treated Differently
AutoReply AI is a business tool, so there are always two sets of people involved. The distinction matters for everything that follows.
- You — the business owner. You create an account, connect your channels and pay for a plan. We are directly responsible to you for the account data in Section 2.
- Your customers. The people who message your business. We have no relationship of our own with them — we see their messages only because you connected a channel and asked us to reply for you.
For your customers' messages, you are the data fiduciary and we are only the data processor. The data is yours. We handle it strictly to run the service you asked for, we do not use it for any purpose of our own, and we delete it on a 90-day clock. These commitments apply to every business on AutoReply AI, wherever you and your customers are based. Under the Digital Personal Data Protection Act, 2023 — and equally under the GDPR and comparable laws elsewhere — the duty to give your own customers notice sits with you as the business; we give you the tools to honour it.
2. Information We Collect
We collect only what the service needs to function:
- Account information: Your name, email address and phone number. You sign in with Google, or with Apple in our iPhone app, so we receive the basic profile details that provider shares with us — your name, email address and, from Google, your profile photo. If you choose Apple’s “Hide My Email”, we only ever see the relay address Apple gives us. We never see your Google or Apple password
- Business information: Business name, your connected channel identifiers (WhatsApp Business number, Instagram account, Telegram bot, inbound email alias), FAQ content, and the reply settings you configure
- Customer conversation data: The content of messages sent to and from your connected channels, the sender's channel identifier (phone number, Instagram or Telegram ID, or email address), their display name, and timestamps. This is stored inside your account so that your inbox works and the AI has conversation context. It is deleted automatically after 90 days — see Section 8
- Payment information: Your plan, billing cycle, amount, currency, payment status, billing email, and Razorpay's order and payment reference IDs. Card, UPI and bank details never reach us — see Section 5
- Device information: Notification token, device type and operating system, used to deliver alerts
- Usage data: Message counts and feature usage, used to enforce plan limits and to bill you correctly
3. How We Use Your Information
- To generate AI replies to your customers across your connected channels
- To show you your inbox, conversation history and lead insights
- To authenticate you and keep your account secure
- To process payments and manage your subscription
- To send you alerts about your business (escalations, new leads, billing) by push notification and email
- To enforce plan limits and prevent abuse of the service
- To diagnose failures and monitor service quality, using aggregated counts rather than message content wherever possible
We do not use your customers' messages for advertising or profiling, we do not use them to train our own models, and we do not sell data to anyone. Message content is sent to OpenAI only to generate the reply you asked for; OpenAI does not train its models on data submitted through its API.
4. Third-Party Services We Use
| Service | Purpose | Data Shared |
|---|---|---|
| Meta / WhatsApp Cloud API | Send & receive WhatsApp messages | Business phone number, message content |
| Meta / Instagram Messaging | Send & receive Instagram DMs | Account ID, message content |
| Telegram Bot API | Send & receive Telegram messages | Bot token, chat ID, message content |
| OpenAI (GPT-4o-mini) | Generate AI replies | Message content and business context |
| Firebase / Google Cloud | Sign-in, database, servers, notifications | Account data, conversation data, usage data |
| Razorpay | Payment processing | Amount and plan only — no card data |
| Resend | Outbound email and inbound email routing | Email addresses, message content on the email channel |
Each of these operates under its own privacy policy and data-processing terms. We share the minimum each one needs, and we do not control their internal practices.
5. Payments
All payments are processed by Razorpay, an RBI-authorised payment aggregator. Checkout opens inside Razorpay's own hosted window — your card, UPI or netbanking details are entered directly into Razorpay's systems and never pass through an AutoReply AI page, server or log.
The only payment-related data stored against your account is:
- Plan name, billing cycle, amount and currency
- Payment status — paid, pending or failed
- Razorpay order ID and payment ID (references to a transaction, not to an instrument)
- Plan start, end and next billing dates
- The email address your receipt was sent to
We hold no card number, no CVV, no expiry date, no UPI ID and no bank account details — not in our database, not in our logs, not anywhere. To change or remove a payment method, do it through Razorpay.
6. Where Your Data Is Stored
- Your account data and all conversation data are stored in Google Firestore in Mumbai, India (asia-south1)
- Our application servers currently run on Google Cloud in the United States, so data is processed there while a request is being handled
- AI replies are generated by OpenAI, which processes message content on servers in the United States
Where data leaves India, it travels under the contractual and security protections offered by those providers.
7. Data Security
- Data is encrypted in transit and at rest by Google Cloud
- Firestore Security Rules scope every record to the account that owns it — one business cannot read another's chats, and neither can an unauthenticated visitor
- API keys and secrets live in Google Secret Manager and are never present in client-side code
- Incoming webhooks from WhatsApp, Instagram, Telegram, Razorpay and Resend are verified by cryptographic signature before we act on them
- Sensitive account actions — deleting your account, changing connected channels — require a one-time code sent to your registered email
8. Data Retention
- Conversations and messages: 90 days. Every chat and message is written with an expiry timestamp, and Google Firestore's time-to-live policy deletes them automatically once it passes. This runs on its own — it is not a manual clean-up we have to remember
- Account and business profile data is kept while your account is active
- Payment records are kept for 7 years, as Indian tax and financial regulations require
- When you delete your account it enters a 7-day recovery window; after that the account is deactivated and queued for permanent deletion, which we complete within 30 days of your request, except where the law requires us to keep something
9. Your Rights
If you have an AutoReply AI account, you can:
- Delete your account and its data — in the app, under Settings → Delete account. It is confirmed with a one-time code and gives you a 7-day window to change your mind
- Delete individual conversations — from the Chats screen, at any time
- Get a copy of your data — ask us through our contact form and we will prepare an export for you. To be straightforward with you: there is no self-service download button today, so we put these together by hand and respond within 30 days
- Correct your details — most account and business fields are editable in Settings; email us for anything that is not
- Object, or complain — write to us, or approach the Data Protection Board of India
If you are a customer of a business that uses AutoReply AI and you want your messages deleted, please contact that business directly. The conversation belongs to them, and they can delete it from their inbox themselves. If they ask us for help doing so, we will assist them.
10. Children's Privacy
AutoReply AI is a business tool intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has provided us with personal data, we will delete it immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will tell you about significant changes by email or in-app notice, and the version number and date at the top of this page will change. Continuing to use AutoReply AI after an update means you accept the revised policy.
12. Contact Us
For privacy questions, data requests, or concerns about how we handle information, use our contact form — it reaches our team directly and we can track your request through to an answer.
📍 AutoReply AI, Pune, Maharashtra, India
We answer privacy requests within 30 days.