Privacy Policy

This policy explains what ReplyPrism ("we", "the service") collects, why, and what happens to it. It covers two different groups of people: the businesses who sign up for an account, and the customers of those businesses whose messages pass through the service.

1. What we collect from businesses who sign up

• Account details — name, email address, and a hashed password. We never store the password itself.
• Business information you enter — your business name, description, prices, policies, FAQs and anything else you put into the knowledge base.
• Facebook access tokens — when you connect a Page, Meta gives us a token that lets us read and reply to that Page's messages. It is encrypted before it is stored.
• Usage records — how many replies you have used, and an estimate of the AI cost.

2. What we collect from your customers

When someone messages a connected Page, we receive and store:

• The text of their message and our reply.
• Their Facebook-scoped user ID (a number specific to your Page — not their real Facebook account ID).
• Their public display name, so you can recognise them in your inbox.
• Any contact details they choose to give during the conversation, such as a phone number for a callback.

We collect this because it is not possible to reply to a message without receiving it, and not possible to show you a conversation history without storing it.

3. Who we send data to

We use a small number of third parties, and only for the purpose described:

• AI provider (OpenAI by default). The text of a customer's message, your business information, and relevant knowledge base entries are sent so a reply can be generated. We do not send names, phone numbers, or email addresses unless the customer typed them into the message itself. Our AI providers do not use data sent through their API to train their models.
• Meta Platforms. Replies are delivered back through Facebook's and Instagram's messaging APIs, because that is where the conversation lives.
• Our hosting provider. Data is stored on servers we rent; the provider has no right to read or use it.

We do not sell data. We do not share it for advertising. We do not build profiles across businesses.

4. Where it is stored and for how long

Everything is held in our own database, on servers we rent from our hosting provider.

Conversations and leads are deleted automatically 24 months after the last message. This runs on a schedule, whether or not anyone asks for it.

You do not have to wait for that. If you disconnect a Page, the conversations belonging to that Page are deleted with it. Closing your account deletes your workspace, your knowledge base, your leads, and all conversations in it. Removing the app from your Facebook settings triggers deletion through Meta's data-deletion callback.

5. Your rights

You can see, correct, export or delete your data at any time from inside the dashboard, or by emailing us. If you are in a country with data protection law that gives you additional rights — such as the UK, EU, or similar — those rights apply and we will honour them.

A customer of a business using this service who wants their data removed should contact that business directly, since the business controls it. They may also use our data deletion page, or remove the app from their Facebook settings, which triggers deletion automatically.

6. Security

Facebook access tokens are encrypted at rest. Passwords are hashed. All traffic is over HTTPS. Incoming messages from Meta are cryptographically verified before we act on them. No system is perfectly secure, and we will tell you promptly if we become aware of a breach affecting your data.

7. Children

The service is for businesses. It is not intended for anyone under 18, and we do not knowingly collect their data.

8. Changes

If we change this policy in a way that materially affects you, we will say so by email rather than quietly editing this page.

9. Contact

Questions, requests, or complaints: admin@replyprism.com