Legal
Data processing agreement
How we handle the personal data your business puts into StayReplied. Your business is the controller of that data; we are its processor.
Last updated: 10 November 2026.
Roles
This agreement is part of the Terms between your business and BytesGlue (BytesGlue Software Services and Solutions FZCO, Dtec G-1B, Nadd Hessa, Dubai Silicon Oasis, Dubai, United Arab Emirates (trade licence no. 44334)). It covers workspace data: conversations, contacts, consent and opt-out records, files, notes, tickets and knowledge. For our own account, billing, security and website data we are the controller, and the Privacy notice applies instead.
What we process and why
Data about your customers, contacts and team: names, phone numbers and WhatsApp ids, emails, message content and files, consent records and web chat sessions. We process it only to provide StayReplied: receiving, storing, routing and sending messages, scanning files, AI replies when you turn AI on, and export and deletion on your instructions.
Our commitments
We act only on your instructions (these terms, your settings and your use of the service); keep the people with access bound by confidentiality; apply the security measures below; use only the listed subprocessors; help you answer requests from individuals; and delete data at the end of the service. We do not sell workspace data, use it for advertising or use it to train AI models.
Your commitments
You need a lawful basis for the data you store and every message you send, including opt-in where the law or the channel requires it; you inform the people you message; you decide whether and how AI is used; and you set a retention period that matches your policy. Data you send to your own systems through the API or webhooks leaves our responsibility.
Subprocessors
You authorise the subprocessors on our list. We give at least 30 days' notice before adding one for workspace data. You may object on reasonable grounds; if we cannot resolve it you may cancel the affected service and get back prepaid fees for the period after cancellation. Services you connect yourself, such as Meta's WhatsApp platform or your own AI key, work under your own agreements with them.
Breaches
If a security breach affects workspace data, we notify the workspace owners without undue delay after becoming aware of it, with what we know and what we are doing, and keep you updated.
Audits and transfers
Once a year, or after a breach, we answer a reasonable security questionnaire and share the documents that show how we meet this agreement; we hold no third-party security certification today. Workspace data is stored in the European Union (Milan). Some subprocessors, such as the AI providers, may process it in the United States or elsewhere, under their transfer safeguards such as standard contractual clauses.
Return and deletion
Export your workspace at any time (workspace export is in private beta); export files are kept 30 days. Delete a workspace and everything in it is deleted 7 days later (any owner can cancel during those days); the paid subscription must be cancelled first. If your subscription ends we keep the data so you can return or export, and tell the owners at least 30 days before we delete it. Backups expire within 35 days.
Security measures
Hosting on AWS in Milan; database and files encrypted at rest with our own KMS key and HTTPS in transit; provider tokens and keys encrypted again in the application; passwords, sessions and API keys stored only as hashes; two-step verification that a workspace can require; workspace isolation covered by automated tests; roles and scoped API keys; signed, de-duplicated incoming webhooks; a send policy checked before every message; malware scan before any file is released; an audit log; logs without message bodies; point-in-time backups and a restore drill.