repliso Privacy Policy

Last updated: October 13, 2026

This policy explains how personal data is handled when you visit the repliso website, ask for or use an account, or when a business uses repliso to talk to its own customers. We have tried to write it in plain language. “We” means the operator of repliso named in section 1.

1. Who is responsible, and in which role

The responsible person under Art. 4(7) GDPR is Kourosh Shafizadeh, Zimmerseestraße 30, 63477 Maintal. E-mail: privacy@repliso.com.

We have two roles:

• We are responsible (controller) for data about website visitors, people who ask for access, account holders and newsletter subscribers.
• We are a processor (Art. 28 GDPR) for the conversations and customer records that a business handles in repliso. The business decides why and how that data is used, and we act only on its instructions. If you wrote to a business that uses repliso (for example on Instagram, WhatsApp, Telegram, Facebook or through a chat window on its website), please contact that business first about your data; we help it answer you. Businesses can ask us for a data processing agreement at privacy@repliso.com.

We have not appointed a data protection officer, because the law does not require one for us at present. Questions about data protection go to privacy@repliso.com.

2. Visiting the website

We do not use analytics, advertising or tracking tools on repliso. Our server answers your request and, to keep the service safe, records suspicious events in a security log (section 9). The server is located in Germany.

3. Cookies and data stored in your browser

repliso stores only what is needed to run the service you asked for. Nothing is used for tracking or advertising.

• Cookie “session”: keeps you signed in (not readable by scripts, sent only to our own site). A sign-in lasts at most 8 hours and ends when you close the browser, or lasts 30 days if you choose “stay signed in” (administrators: always at most 8 hours).
• Short-lived cookies while you connect a Google or Instagram account, to protect that connection process.
• Browser storage: your language (“locale”, “marketingLocale”), the workspace you selected (“organization”) and the pricing region you chose (“pricingMarket”).

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for a service you requested) and Art. 6(1)(b) and (f) GDPR. You can delete these items in your browser settings; you will then be signed out and the language is reset.

Some features load a script from another company, and only when you use that feature: Cloudflare Turnstile (bot protection) on the sign-in form, the Google sign-in script when you choose “Sign in with Google”, and the Facebook script only on the page where a business connects a WhatsApp number. These companies receive technical data from your browser (such as your IP address) when the script loads. For Turnstile our legal basis is our legitimate interest in protecting sign-in from automated attacks (Art. 6(1)(f) GDPR); for the Google and Facebook scripts it is your own action to use them.

4. Asking for access and your account

What we process: e-mail address, password (stored only as a salted hash, never as plain text), business name, country, preferred language, the link to your business page or website and a short code we ask you to place there, the approval decision, and your sign-in sessions. Administrators additionally use a second step (authenticator app) for sign-in.

Phone check (optional): you may confirm your phone number through our Telegram verification bot. We receive the number from Telegram only at the moment of checking and do not store it. We keep a masked form (country prefix and last two digits) and a one-way keyed hash, which stops one number from being used for several accounts. Telegram handles your number under its own privacy policy.

Sign in with Google (optional): we receive your Google e-mail address and account identifier to sign you in.

Purpose and legal basis: creating and running your account (Art. 6(1)(b) GDPR) and checking that requests come from real businesses and preventing fake or duplicate accounts (our legitimate interest, Art. 6(1)(f)). Without the data marked as required you cannot get an account.

Retention: as long as the account exists. Verification data is deleted with the account or when you ask. One-time verification links expire after 30 minutes. You can delete your account yourself in the app.

5. Using repliso as a business

What is processed: workspace name, team members (e-mail address and role), the channels a business connects (account identifiers; access tokens are stored encrypted with AES-256-GCM and deleted when the channel is disconnected), the messages and comments received and sent there, customer profiles and everything a business records about customers (contact details, tags, notes, tasks, deals, consent records, “customer memory”), AI settings and credit usage, plan and billing requests, and an audit trail of important administrative actions.

Role: for the content of conversations and customer records the business is the controller and we are its processor (section 1). Businesses are responsible for informing their own customers and for having a legal basis for what they record; people can write to the business to exercise their rights. repliso offers tools for this: per customer consent records, export and erasure, a workspace export and account deletion.

Legal basis: performing our contract with the business (Art. 6(1)(b) GDPR).

Retention: until the business deletes it or the account is deleted. Website chat messages are kept up to 12 months where that function is enabled (the text is then removed and only metadata stays). Failed incoming messages are kept at most 30 days. In-app notifications 90 days. We keep nightly backups of our databases for seven days, so deleted data can remain in a backup for up to seven days.

6. AI processing

When a business uses AI to draft or send a reply, summarise a conversation, suggest a lead score or suggest a customer note, we send the relevant conversation text, the business’s own instructions and knowledge and, where used, stored customer notes to an AI provider. We do not send passwords or access tokens. Currently used provider: Anthropic (USA).

We use the provider’s business interface under its commercial terms. According to those terms the provider acts as our processor, a data processing agreement with EU standard contractual clauses applies, and the data is not used to train its models. We do not sell conversation data or use it for advertising.

AI output is a reply or a suggestion that the business controls (it can approve replies, take over a conversation or switch the AI off). Lead scores and notes proposed by the AI are applied by a person. We do not make decisions about people that have legal or similarly significant effects solely by automated means (Art. 22 GDPR). Legal basis: performing our contract with the business (Art. 6(1)(b) GDPR). The business remains responsible towards its own customers for using AI in conversations.

7. E-mails

• Service e-mails (for example the decision on your access request, security messages, notifications you switched on) are sent through Resend. Basis: contract (Art. 6(1)(b)).
• Newsletter, only if you sign up: e-mail address, language, and the date, time and IP address of your sign-up and of your confirmation click, as the record of your consent. Nothing is sent until you confirm the link we e-mail you (double opt-in). You can unsubscribe at any time with the link in each e-mail or by writing to support@repliso.com. Unconfirmed sign-ups are deleted about a week after their 48-hour link expires. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time; the proof of consent is kept as long as we need it to show that you agreed.
• Contact form (repliso.com/contact): your name, e-mail address and message, the language of the page and the time, used to answer you (Art. 6(1)(b) and (f)). The message is sent to our support mailbox through our e-mail provider Resend and also kept on our server, so that it is not lost if the e-mail fails. Your IP address is not saved; to limit spam, a one-way code made from it is held only briefly in the working memory of the server. Cloudflare Turnstile checks that a person sends the form. We delete contact messages after 12 months at the latest.
• E-mails you send us (to support@repliso.com or privacy@repliso.com) are used to answer you (Art. 6(1)(b) and (f)). They are forwarded through Cloudflare e-mail routing to our mailbox, which is provided by Google.

8. Payments

repliso does not take payments yet; plan requests are reviewed by us. Before we accept payments, we will name the payment provider here and update this policy.

9. Security

To detect and block attacks we record suspicious events (such as repeated failed sign-ins, scans for sensitive files or floods of requests) with the IP address, the requested path and the browser type. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR). Events and ended blocks are deleted automatically after 30 days; automatic blocks are always temporary. Other measures: encrypted connections, hashed passwords, encrypted channel tokens, a second sign-in step for administrators and an audit trail of administrative actions.

10. Who receives personal data

• Our hosting provider (virtual server in Germany), as processor.
• Cloudflare (bot protection on sign-in; e-mail forwarding), Resend (sending e-mails), Google (sign-in if you choose it; our mailbox), Telegram (phone check if you use it), the AI provider named in section 6.
• The platforms a business connects (Meta for Instagram, WhatsApp and Messenger; Google for YouTube; Telegram). They process data under their own privacy policies and are independent controllers for their own services.
• Authorities, courts or advisers, only where the law requires it or to protect legal claims.

We never sell personal data.

11. Transfers outside the EU/EEA

Some recipients above are based in or process data in the United States or elsewhere outside the EU/EEA. We use them only where a legal basis for the transfer exists: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US companies), or the EU standard contractual clauses (Art. 46 GDPR) with additional measures where needed, or your own request (for example when you choose to sign in with Google). You can ask us at privacy@repliso.com for information about the safeguards for a specific recipient.

12. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), including at any time to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time with effect for the future (Art. 7(3)). Write to privacy@repliso.com; we answer within one month and may need to confirm your identity first. Some things you can do yourself in the app (export, account deletion).

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where the problem happened. In Germany each federal state has its own authority; the one responsible for us is that of the state where we are based. List of authorities.

13. Children

repliso is built for business use and is not intended for anyone under 16.

14. Changes

If this policy changes materially, the “Last updated” date above changes and, where required, we tell account holders.

15. Contact

For any privacy question: privacy@repliso.com