Last updated 12 November 2026
Privacy policy
ReplyWell is a product of Cimpli AI. This policy explains what personal data ReplyWell handles, why, who helps us handle it, and the choices you have. Questions go to hello@replywell.io.
Who we are, and our two roles
“We”, “us” and “our” mean Cimpli AI, the business that provides ReplyWell. We handle personal data in two different roles:
- For business owners who use ReplyWell, we are the controller. We decide how your account details are used, and this policy covers that.
- For people who chat with a business's assistant, that business is the controller and we are its processor. We handle chat data only to run the service for the business, following its instructions and our Data Processing Agreement. If you chatted with a business, its own privacy notice applies and it is the best place to start with any request. We will help it respond.
What we collect
From business owners
- Your email address, password (stored only as a secure hash by our sign-in provider) and business name.
- Your assistant's settings: its name, greeting, colour, website address, chat link, and where handoff alerts go (an email address and, if you add one, a Slack webhook).
- The documents and text you upload so the assistant can answer from them.
- Billing details. Payments are handled by Stripe; we never see or store your full card number. We keep your Stripe customer reference and subscription status.
- Messages you send to customers from your inbox.
From people who chat with an assistant
- The messages you send and the replies you receive.
- If the assistant passes your question to the business: your name and email address, and your phone number if the business asks for it and you give it.
- The web page the chat was opened on.
- A one-way scrambled (“hashed”) version of your IP address, which we use only to stop abuse such as message flooding. We do not keep your IP address itself.
- A random ID stored in your browser so your conversation carries on if you leave and come back. It does not identify you.
Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account, the assistant and your inbox | Contract with you |
| Taking payments and keeping financial records | Contract, and legal obligation |
| Service emails: sign-up confirmation, password resets, handoff alerts | Contract |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Answering chat questions on a business's behalf | We act as processor; the business is responsible for its lawful basis |
We do not sell personal data, we do not use it for advertising, and we do not send marketing emails.
How the AI uses your information
ReplyWell's replies are written by an AI model provided by Anthropic. To answer a question, we send Anthropic the customer's message, the recent conversation and the passages from the business's documents that relate to it. Anthropic processes this to produce the reply and, under its commercial terms, does not use it to train its models. Every reply is then checked against the business's own documents before it is shown. The AI does not make decisions that have legal or similarly significant effects on anyone.
Who we share it with
We use these service providers (sub-processors) to run ReplyWell. Our Sub-processors page shows what data each one handles and how we tell businesses about changes.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Ireland (EU) |
| Vercel | Hosts the website and app | App runs in Ireland (EU); Vercel is a US company |
| Anthropic | AI model that writes the replies | United States |
| Cloudflare (Turnstile) | Bot check when a chat starts, to stop spam | Worldwide; Cloudflare is a US company |
| Resend | Sends emails: handoff alerts and replies | Ireland (EU); Resend is a US company |
| Stripe | Payments and subscriptions for business owners | UK, EU and United States |
| ImprovMX | Forwards emails sent to our support address | France and United States |
| Google (Gmail) | Our support inbox | United States and worldwide |
If a business connects Slack for handoff alerts, chat details go to that business's own Slack workspace.
Where data goes outside the UK, we rely on the protections the law requires, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK–US “data bridge”. We may also disclose data if the law requires it.
How long we keep it
- Account details, settings, documents and conversations are kept while the account is open, so the business keeps its history. A business can delete documents at any time from its dashboard.
- If a trial or subscription ends, we keep the account so it can be picked up again. To have an account and all its data deleted, email hello@replywell.io; we will do it within 30 days.
- We keep billing records for as long as UK tax law requires, usually six years.
Cookies and similar technology
We only use what is strictly necessary for the service to work: sign-in cookies for the dashboard, and the chat's random ID and conversation ID kept in your browser's storage. We do not use analytics or advertising cookies, so there is nothing to opt out of.
Your rights
You can ask to see, correct, delete or move your personal data, or object to or restrict how it is used. Email hello@replywell.io and we will reply within one month. If you chatted with a business, we will pass your request to that business and help it respond. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Security
Data is encrypted in transit and at rest by our providers. Each business's data is kept separate, and access is limited to what is needed to run the service. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator where the law requires.
Children
ReplyWell accounts are for businesses and people aged 18 or over.
Changes
If we change this policy, we will update the date at the top, and tell account holders by email about any important change.