Privacy Policy

Who We Are

ReplyQ is operated by Signum Solutions Private Limited (Singapore). We provide AI-powered customer service via the WhatsApp Business Platform. For your account data, we are the Data Controller. For your customers' messages, you are the Data Controller and we process that data on your behalf as your processor, under our Data Processing Agreement.

Data We Collect & How We Use It

We collect only what the service needs to work:

• Account data (name, email address, phone number, business details): to create and secure your account, sign you in, and contact you about the service.
• Billing data: subscriptions are handled by Stripe. We store a customer reference and subscription status. We never receive or store your full card number.
• Conversations (WhatsApp messages, media, contact phone numbers, delivery metadata): to display your inbox, generate replies, and produce your analytics.
• Knowledge base content you upload or approve, such as documents, website text, and business facts: to answer your customers accurately.
• Diagnostics (crash reports, error logs, IP address, device and app version): to detect and fix faults. Crash reporting is provided by Sentry and processed in the EU.
• Push notification tokens: to alert you when a conversation needs you. Delivered via Expo.

We do not sell your data, and we do not use it for advertising or cross-app tracking.

How AI Processing Works

To draft a reply, we send the relevant conversation and your knowledge base to our AI provider, OpenRouter, which routes the request to the underlying model. To match your business's tone, short excerpts from your own past conversations may be included in that request. This happens only within your own account.

We do not use your conversations or your customers' data to train shared or public AI models, and we do not fine-tune models on your data.

Data Sharing

We share data only with service providers who help us run ReplyQ: Meta/WhatsApp (message delivery), OpenRouter (AI generation), Supabase (database and storage), Vercel (hosting), Upstash (message scheduling), Stripe (payments), Resend (email), Expo (push notifications), Sentry (crash diagnostics), and Google Places (business lookup during onboarding).

Each provider is bound by contract to protect your data to a standard at least equivalent to this policy, to use it only for the purposes we instruct, and not for their own purposes. The current list, with each provider's role and location, is maintained in our Data Processing Agreement. Data may be processed in Singapore, the EU, and the USA under Standard Contractual Clauses.

Device Permissions

The mobile app asks for camera and photo library access only so you can attach or save media in a conversation, and for notification permission so we can alert you. Each is requested at the moment you first use the feature, and you can decline or revoke it in your device settings without losing access to the rest of the app.

Data Retention & Deletion

We retain your data while your account is active. You can export or delete your data at any time from Settings, or by emailing support@replyq.app. A deletion request is scheduled 48 hours ahead so you can cancel it if it was made by mistake, after which your account and its data are permanently erased. Encrypted backups are purged within 90 days. Records we are required to keep by law, such as payment and invoice records, are retained for the period the law requires. Full details are on our Data Deletion page.

Security

All traffic is encrypted in transit with TLS. Sensitive credentials, including your WhatsApp Business tokens, are encrypted at rest with AES-256-GCM. Access to production data is restricted and tenant isolation is enforced at the database level.

Your Rights

You may access, correct, delete, export, or restrict processing of your data, and withdraw consent at any time, via Settings or by emailing support@replyq.app. You may lodge a complaint with the Singapore PDPC or your local Data Protection Authority.

Children

ReplyQ is a business tool and is not directed to children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact support@replyq.app and we will delete it.

Changes to This Policy

If we make a material change, we will update the date above and notify you in the app or by email before it takes effect.

Contact

Signum Solutions Private Limited, Singapore. support@replyq.app