This Data Processing Addendum ("DPA") forms part of the Terms of Service between Replyna LLC ("Replyna", "we") and the business using Replyna ("you", the "Merchant"). It applies whenever Replyna processes personal data on your behalf. If this DPA and the Terms conflict on data protection, this DPA wins.
1. Roles
For the personal data of your customers that Replyna handles to provide the Service, you are the controller and Replyna is your processor. For your own account and billing data, Replyna is the controller as described in our Privacy Policy.
2. What we process
- Data subjects: people who message your business on your connected channels (WhatsApp, Messenger, Instagram, your website chat) and people who place orders through your assistant.
- Personal data: messages and their content (including voice notes, which are transcribed and not stored as audio), profile names and channel identifiers, and — when you connect an online store such as Shopify — the name, mobile number and delivery address a customer gives to place an order, with the items and totals of that order.
- Purpose and duration: only to provide the Service you signed up for — replying to your customers, escalating to your team, and creating and tracking the orders your customers confirm — for as long as you use the Service.
3. Our commitments
- We process the data only on your documented instructions — the Service settings you choose and these terms — unless the law requires otherwise (and then we tell you, unless the law forbids it).
- We do not sell the data and do not use it to train public AI models.
- Everyone at Replyna with access to the data is bound by confidentiality, and access is limited to what is needed to run and support the Service.
- We apply appropriate technical and organisational security measures, including encryption in transit (HTTPS/TLS) and at rest, encryption of stored access tokens (AES-256), encrypted and verified backups, strict per-account isolation, and access controls with remote sign-out.
- We help you respond to requests from your customers to access, correct or delete their data, and we automatically honour the data-deletion requests the platforms send us.
- We tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- When you close your account, or ask us to, we delete the data from our live systems (backups roll off within 14 days), except where the law requires us to keep it.
- On reasonable request we provide the information needed to show we meet this DPA.
4. Sub-processors
You authorise us to use sub-processors for cloud hosting and database, AI processing (a primary provider and a backup), speech-to-text and text-to-speech for voice notes, the messaging platforms you connect, the online store platforms you connect, email delivery and payment processing. Each is bound by written terms that protect the data at least as well as this DPA. We will tell you before adding a new category of sub-processor, and you may object by contacting us.
5. International transfers
Some sub-processors operate outside Egypt. Where data is transferred abroad, we rely on appropriate safeguards required by applicable law (such as standard contractual clauses where the EU/UK GDPR applies).
6. Your commitments
You confirm you have a lawful basis to have Replyna process your customers' data for these purposes, and that your own privacy notice tells your customers you use service providers like Replyna.
7. Liability, law and changes
Liability and governing law follow the Terms of Service. We may update this DPA to reflect changes in law or in the Service; we will post the new version here and update the date above.
8. Contact
Data-protection questions or requests: support@replyna.io.