Privacy Policy

Last updated: 30.06.2026

This Privacy Policy explains how [Şirket Ünvanı] (“Reply Flows”, “we”, “us”) collects, uses, and protects personal data when you use our website and services.

1. Who we are

Reply Flows provides a multi-tenant, AI-powered customer support and communication platform, including an AI agent, a human agent panel, a realtime chat widget, and a knowledge base. The data controller is [Şirket Ünvanı]. You can reach us at [email protected].

2. Data we collect

• Account data: name, email address, company name, password (stored hashed), and preferences.
• Workspace content: knowledge base sources, widget configuration, and team information you add.
• Conversation data: messages exchanged through the chat widget, including content your end users send.
• Usage data: log data, device and browser information, IP address, and analytics events.
• Payment data: handled by our payment provider (Paddle), which acts as Merchant of Record. Your card details and billing address are collected and stored by Paddle — we do not store or process them. We only keep transaction records (amount, date, invoice number) required for accounting.
• Cookies and similar technologies: see our Cookie Policy.

3. Roles: controller and processor

For our own account holders, we act as a data controller. For personal data contained in conversations and content that our customers process through Reply Flows about their own end users, we act as a data processor on the customer’s behalf, under the customer’s instructions.

4. How we use data

• To provide, operate, and secure the service;
• To generate AI responses grounded in the knowledge base you provide;
• To process subscriptions and payments (via Paddle);
• To communicate with you about your account and support requests;
• To measure and improve our website and marketing (analytics and advertising), subject to your consent;
• To comply with legal obligations and prevent abuse.

5. Service providers (sub-processors)

We share data only with trusted providers who help us run the service, including:

• AI providers (e.g. Anthropic, OpenAI) — to generate AI responses;
• Cloud hosting and infrastructure — to host the application and databases;
• Payments — Paddle, acting as Merchant of Record for purchases;
• Email delivery — to send transactional and account emails;
• Analytics and advertising — Google (Analytics, Ads), Meta, and LinkedIn, subject to your consent.

Each provider processes data only as needed to perform its function.

6. International transfers

Some providers (such as AI and cloud providers) may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Retention and deletion

We keep personal data for as long as your account is active or as needed to provide the service, and thereafter only as required to meet legal, accounting, or reporting obligations.

• Account deletion: the account owner can delete the account from the panel at any time. Access is disabled immediately; data is kept frozen for 30 days so the deletion can be undone, then permanently erased.
• What is erased: conversations and end-user (visitor) data, knowledge base content, workspaces, and team member accounts.
• What is retained: invoice and payment records (including the account holder’s identity attached to them) for the statutory retention period required by tax law, after which they are anonymised or deleted.

8. Security

We use industry-standard measures including encryption in transit, hashed passwords, access controls, and tenant isolation. No method of transmission or storage is completely secure, but we work to protect your data.

9. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, contact us at [email protected]. If you are an end user of one of our customers, please direct your request to that customer.

10. Children

Our services are not directed to children and we do not knowingly collect personal data from children.

11. Changes

We may update this policy from time to time. We will post the updated version on this page with a new “last updated” date.

12. Contact

Questions about this policy? Email us at [email protected].