1. Scope
This Privacy Policy explains how AI Reply Solutions processes personal information through its website, dashboard, contact form, shared inbox, automation features, optional website analytics, and Meta and Google integrations. It covers account users as well as people whose messages or appointment details are handled by a business using the service.
2. Our role and the business user’s role
For account registration, website operation, security, and direct support, AI Reply Solutions determines why and how information is processed and acts as the data controller where that concept applies.
When a business connects Google Calendar or a WhatsApp Business Account, that business normally decides why its customer information is processed. The business is responsible for its privacy notice, legal basis, customer instructions, and any required consent. AI Reply Solutions processes that customer information to provide the service on the business’s instructions.
3. Information we process
- Account and workspace information: name, login email, hashed password, business profile, services, prices, opening hours, automation instructions, team roles, invitations, assignments, internal notifications, activity, and integration settings.
- Customer and lead information: names, email addresses, phone numbers or channel handles, enquiry content, conversation history, lead stage, tags, notes, and estimated value.
- Website support chat information: a browser session identifier; the name, email address, phone number, and company name a visitor provides; message content; timestamps; and support replies. This chat reaches the AI Reply Solutions support team; it is not a feature that a customer business can configure or embed.
- Appointment information: requested service, date and time, duration, customer contact information, booking status, cancellation or rescheduling timestamps, reminder status, and related calendar event information.
- Connected Google information: the authorised account email address and Google Calendar data described in Section 4 when the account owner grants access.
- Connected Meta information: WhatsApp Business Account and phone-number identifiers, access tokens, customer platform identifiers, profile names supplied by the channel, messages, message status events, timestamps, and provider message identifiers described in Section 5 when the account owner connects WhatsApp.
- Website and support information: contact-form submissions, session information, approximate request source, security events, and technical logs needed to operate and protect the service.
Passwords are stored as password hashes. Email-verification, password-reset, and team-invitation secrets are stored only as one-way hashes and expire automatically. When optional authenticator protection is enabled, its setup secret is encrypted at rest and recovery codes are stored only as one-way hashes. Supported access and refresh tokens are encrypted at rest.
4. Google Calendar data
Google Calendar access is optional and starts only after the Google account owner completes Google’s authorization screen. We request the following Google data only for the calendar and appointment features the account owner enables:
- Calendar list: retrieve the ID, name, time zone, primary-calendar indicator, and access role for calendars where the connected account can create and update events. This lets the owner choose a booking calendar; we do not change calendar-list or sharing settings.
- Calendar availability: query busy start and end times only to check availability, prevent double bookings, and offer appointment times. Busy periods are processed when needed and are not retained as a separate calendar copy.
- Calendar events: create, update, and delete the appointment events requested through the service. Those events contain the service, customer name and contact details, appointment time, and, where configured, the business location. When rescheduling, we retrieve only the technical event ID, status, and transparency needed to avoid treating the appointment being moved as a conflict; we do not retrieve, display, or store unrelated event titles, descriptions, attendees, or locations.
- Dedicated staff calendars: create and delete appointment-only calendars that the account owner explicitly creates for staff in the dashboard. We create only the calendar name, description, and time zone needed for that staff calendar, and never delete an existing or personal Google calendar.
While Google is connected, we store encrypted OAuth credentials; selected and staff-calendar IDs, names, and time zones; and, for appointments created through the service, the appointment record and its Google event ID and link. Appointment records include the customer and booking details described in Section 3.
Google Calendar information is processed by the service and by the hosting and database providers identified in Section 10, only to operate these features on our behalf. It is not sent to the configured AI model provider, sold, used for advertising, used to determine creditworthiness, used to build unrelated profiles, or used to improve a general-purpose AI or machine-learning model. AI Reply Solutions’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
The account owner can disconnect Google from the dashboard and can also revoke access through Google Account connections. Disconnecting revokes the saved Google token and stops Calendar API access. It does not automatically remove appointment records in the workspace or events already created in an external Google Calendar; those remain subject to the retention and deletion provisions below.
5. Meta data
Meta connections are optional. The official connection begins when a workspace owner connects a WhatsApp Business Account. For an enabled connection, the service receives customer messages and delivery-status events through Meta’s Graph API, places relevant messages in the workspace’s shared inbox, and may send a reply when the business has enabled that automation.
We use this information only to provide, secure, support, and improve the WhatsApp messaging features the business enables. We do not sell Meta data, use it for advertising, or disclose it to another business except as directed by the workspace owner or required to operate the service. Authorised workspace users can see the communications associated with their workspace. If AI-assisted replies are enabled, the minimum relevant conversation content and business instructions may be sent to the configured AI model provider solely to generate that reply.
The account owner can disconnect WhatsApp from the dashboard to stop future access. This does not automatically erase messages, leads, or appointments already stored in the workspace. A person whose information was obtained through WhatsApp can follow our User Data Deletion Instructions. Use of Meta products remains subject to Meta’s applicable terms and policies.
7. How we use information
- Provide, secure, maintain, and troubleshoot the service.
- Authenticate users and keep workspaces separated.
- Receive, organise, and display customer communications and lead information.
- Apply business-authored rules and generate AI-assisted replies.
- Send authorised replies and enabled appointment reminders through a connected channel or configured email transport.
- Check availability, prevent conflicting bookings, and create, reschedule, or cancel appointments.
- Respond to support enquiries and communicate about the service.
- Detect abuse, enforce limits, investigate errors, and comply with legal obligations.
8. AI processing
When AI replies are enabled, AI Reply Solutions uses the OpenAI API to generate a response from the business profile, relevant instructions, and a limited portion of customer-authored conversation messages. Customers should not include unnecessary sensitive information in messages. AI output can be inaccurate and should be subject to appropriate business oversight.
The website support chat can use the OpenAI API to answer common questions from this website’s published help, terms, pricing, and privacy information. For that purpose, the relevant support-message content is sent to the provider; the visitor’s name, email address, phone number, company name, and browser session identifier are not included in that AI request. Account-specific, billing, refund, security, privacy, technical, or unclear questions are routed to the support team for review.
The Google Calendar connector and AI reply feature are technically separated. We do not send Google Calendar API output, Calendar account email, calendar names or IDs, event data, busy periods, staff-calendar data, appointment records, or availability-derived booking times to the AI provider. The website support chat uses only its own message content and published website information, never Google user data. AI Reply Solutions does not use Google user data to improve a general-purpose AI model.
9. Legal bases
Where the GDPR or similar law applies, AI Reply Solutions relies on performance of a contract to provide requested account features; legitimate interests in operating, securing, and improving the service; consent for optional integrations where required; and compliance with legal obligations. A business using the service must determine and communicate the appropriate legal basis for its processing of customer messages, leads, and appointments.
10. Service providers and disclosures
We use infrastructure providers to operate the service, including Vercel for application hosting and cookie-free, anonymised website analytics, Neon for database services, and a configured SMTP mail server to deliver account verification, password-recovery, staff-invitation, eligible manual-booking reminder messages, and an account-deletion notice containing the reason supplied by the workspace owner. If a website visitor accepts analytics cookies, Google Analytics measures high-level website use such as page views and selected sign-up or contact actions. If enabled by the account owner, information may also be processed by Google for Calendar functionality, Meta for the official WhatsApp Business Platform, and the configured AI model provider for response generation. A connected communication channel processes messages under that channel’s own terms.
Providers receive only the information reasonably necessary for their function and are expected to process it under applicable contractual and security obligations. We may also disclose information when required by law, to protect users or the service, or as part of a business reorganisation subject to appropriate safeguards. We do not sell personal information.
11. International transfers
Some providers may process information outside the country where it was collected. Where required, transfers must rely on an applicable legal mechanism, such as an adequacy decision or approved contractual safeguards.
12. Retention and security
Account, workspace, conversation, lead, and appointment information is retained while needed to provide the workspace and until it is deleted, the account is closed, or a valid deletion request is completed, subject to legal, fraud-prevention, dispute, and backup requirements. OAuth tokens are retained only while the integration remains connected or until they are revoked or replaced. Expired or consumed account-verification and recovery records are removed. Contact and security records are kept only for as long as reasonably necessary for support, service integrity, and legal obligations.
We use safeguards including strong password hashing, optional authenticator-based multi-factor authentication, one-way-hashed recovery codes, email verification, revocable signed sessions, encrypted integration credentials, access controls, tenant separation, secure transport, and webhook verification. No online service can guarantee absolute security.
13. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal information and to receive a portable copy. You may withdraw consent without affecting earlier lawful processing and may complain to your local data-protection authority.
Account owners can disconnect integrations or permanently delete their workspace from Account Security in the dashboard. Permanent deletion requires re-authentication, removes the workspace and its stored operational data, signs out its team members, and sends AI Reply Solutions the reason entered by the owner. Existing events already created in an external Google Calendar are not deleted. To request access or another privacy action, use the contact details below. We may need to verify identity and authority. If the request concerns a conversation handled for a business using AI Reply Solutions, contact that business first because it normally controls the customer relationship and must instruct us where appropriate. People using a Meta product can also use our dedicated User Data Deletion Instructions.
14. Automated processing
The service can classify enquiries, suggest or send replies, and offer appointment times. These functions are not intended to make decisions that produce legal or similarly significant effects. Businesses must provide human review where the context, risk, or applicable law requires it.
16. Children
The service is intended for business users and is not directed to children. Businesses must not knowingly use it to collect children’s information without the notices, consent, and safeguards required by law.
17. Changes to this policy
We may update this policy when the service or legal requirements change. Material changes will be communicated through reasonable means where required. The date above identifies the current version.
18. Contact
AI Reply Solutions is managed by Pasekaite Jurate, VAT IT02190230439. Legal address: Via Salvo D'Acquisto 8a Porto Recanati(MC), Italy. For privacy questions or requests, email aireplysolutions@gmail.com or use our contact form.