Last updated 27 October 2026
Data Processing Agreement
When your customers chat with your ReplyWell assistant, you decide why their data is collected, so you are the controller. Cimpli AI handles it only to run ReplyWell for you, so we are your processor. This agreement sets out the terms required by Article 28 of the UK GDPR. It forms part of our Terms of service and applies automatically when you use ReplyWell. Need a signed copy for your records? Email hello@replywell.io.
1. Who's who
- Controller: the business that holds the ReplyWell account (“you”).
- Processor: Cimpli AI, which provides ReplyWell (“we”).
- Words like “personal data”, “processing” and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018.
2. What we process
| Purpose | Answering your customers' questions from the information you provide, passing unanswered questions to you, and running your inbox and notifications. |
|---|---|
| People | Your customers and website visitors who use your chat. |
| Data | Chat messages; name, email address and (if you ask for it) phone number given at handoff; the web page the chat was opened on; a one-way hashed IP address; a random browser ID. Plus any personal data you include in the documents you upload. |
| Special category data | Not intended. Don't upload it or ask customers for it. If a customer volunteers it in a message, it's handled like any other message. |
| Duration | For as long as your account is open, then until deleted under section 9. |
3. Your instructions
We process your customers' personal data only on your documented instructions: these terms, and the settings you choose in your dashboard. If we're ever required by law to do otherwise, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.
You're responsible for having a lawful basis for the processing, for telling your customers about it in your own privacy notice (including that your chat is an AI assistant), and for the accuracy of what you upload.
4. Confidentiality
Anyone we allow to access the data is bound by confidentiality, and access is limited to what's needed to run and support ReplyWell.
5. Security
We keep appropriate technical and organisational measures in place, including:
- Encryption in transit (HTTPS for every connection) and at rest, by our hosting and database providers.
- Each business's data kept separate, with every database query limited to one business. Database tables can't be reached from browsers; only our server can read them.
- Visitor IP addresses stored only as salted one-way hashes, used to stop abuse.
- Passwords stored only as secure hashes by our sign-in provider; new accounts confirm their email.
- API keys and other secrets held in our hosting provider's encrypted settings, never in code.
- Rate limits on the chat to stop automated abuse.
- Access to production systems limited to the people who run ReplyWell.
6. Sub-processors
You authorise us to use the sub-processors listed on our Sub-processors page, including our AI provider. Each is bound by data protection terms at least as protective as these, and we remain responsible for them. We'll email you at least 30 days before adding or replacing one that handles your customers' data, so you can object; if we can't resolve a reasonable objection, you can cancel and we'll refund any unused prepaid period.
7. Transfers outside the UK
Some sub-processors handle data outside the UK, including in the United States. Each transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK–US “data bridge”, as appropriate.
8. Helping you
- People's rights: you can see your customers' conversations and contact details in your inbox. For anything you can't do there, such as deleting a conversation, email us and we'll help within 10 working days. If a customer contacts us directly, we'll pass the request to you.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your customers' data, with the information you need to meet your own obligations.
- Assessments: we'll give reasonable help with data protection impact assessments and any consultation with the Information Commissioner's Office.
9. When you leave
When your account closes, or whenever you ask, we'll delete your customers' personal data within 30 days, unless the law requires us to keep it. Before that, you can ask us for a copy of your conversations.
10. Showing we comply
We'll answer reasonable questions and security questionnaires about how we handle your customers' data. If that isn't enough to show we meet these terms, you or an independent auditor bound by confidentiality may audit us, with at least 30 days' notice, at your cost, and no more than once a year unless a regulator requires it or there's been a breach.
11. General
If this agreement and the Terms of service conflict on data protection, this agreement wins. Liability is as set out in the Terms of service. This agreement is governed by the law of England and Wales.