Legal
Privacy notice
What StayReplied collects, why, how long we keep it, who else handles it, and how you can control it.
Last updated: 10 November 2026.
Who we are
StayReplied is operated by BytesGlue (BytesGlue Software Services and Solutions FZCO, Dtec G-1B, Nadd Hessa, Dubai Silicon Oasis, Dubai, United Arab Emirates (trade licence no. 44334)). Contact privacy@stayreplied.com about this notice or your data. Our privacy contact is Andrew Rober, reachable at privacy@stayreplied.com. We have not appointed a formal data protection officer.
Two roles
We decide how your StayReplied account, your workspace's billing details, this website and its contact form are used. For that data we are the controller, and this notice applies.
What a business puts into its workspace (conversations, contacts, files, notes, knowledge, tickets) is controlled by that business. We process it only for the business, under our Data Processing Agreement.
This website
If you use the contact form we store your name, email, optional company and phone, your message, your language, the page you sent it from and a salted hash of your IP address for abuse prevention. We use them to reply to you and to stop spam. Marketing emails are sent only if you tick the separate box, and you can unsubscribe at any time.
Analytics
This website (stayreplied.com only) uses Google Analytics 4 to count visits, but only after you choose Accept in the cookie banner. Until then no analytics script loads and no analytics cookie is set. If your browser sends Do Not Track or Global Privacy Control, we treat it as Reject. You can change your choice any time from Cookie settings at the bottom of every page; choosing Reject later removes the analytics cookies. Analytics never runs inside the StayReplied app or inbox and never records conversation content or email addresses. We use no advertising scripts.
Your account
To run your account we keep your name, email, language, time zone and notification choices, your password only as a hash, and your two-step verification secret encrypted. If you sign in with Google or Facebook we receive only your account id, email and name, use the provider's token once and do not keep it.
For security we keep your sessions (the token only as a hash, your browser type and a hash of your IP address) and an audit log of important actions such as sign-ins, exports, settings changes and sends. We send service emails (verification, invitations, alerts); alert emails have one-click unsubscribe. Addresses that bounce or complain go on a suppression list so we stop mailing them.
Billing
Payments run on Stripe's hosted Checkout and Customer Portal. You enter payment details with Stripe, and we never see or store your full card number. We keep the Stripe customer and subscription ids, your plan, status and billing period, whether the introductory code was used, and records of invoices, refunds and disputes, to give you the plan you paid for and to keep accounts.
Data inside a workspace
A workspace can hold conversations from connected channels, contacts with their phone numbers, emails and consent records (including STOP), files, notes, tags, tickets, pipeline entries, knowledge and price lists, and web chat visitor sessions. Every record belongs to one workspace, taken from the signed-in session, never from the request.
When a workspace uses AI, the relevant part of the conversation, the workspace's instructions and the approved knowledge and prices the reply needs are sent to the AI provider the workspace chose. Files are given to the AI, sent or downloaded only after a malware scan marks them clean. On a business's website, the chat widget keeps a visitor session token in the browser's local storage so the visitor can return to the same conversation; it sets no cookies and runs no analytics.
We do not sell workspace data, we do not use it for advertising, and we do not use it to train AI models.
AI usage records and logs
For each AI call we record the model, token counts, the provider's list cost and what was charged, but not the message text. Our server logs help us fix faults and stop attacks; they never contain message bodies or secrets, and email addresses appear only as short hashes.
How long we keep data
Conversations and their files stay as long as the workspace keeps them. A workspace owner can set a message retention period (Settings → Workspace); older conversations are then deleted with their files. A deleted workspace is removed 7 days after the request, and your account when you delete it.
Other periods: export files 30 days; files stuck in quarantine 30 days; technical logs 90 days; email delivery events 90 days; Facebook deletion status records 365 days; contact-form enquiries 24 months; billing records five years (accounting law). Database backups and old file versions expire on their own within 35 days.
Who else handles data
Amazon Web Services in Milan, Italy (hosting, database, files, encryption keys, service email and logs); Stripe (payments); Anthropic (the main AI provider for managed AI); OpenAI (only if a workspace turns on the optional, cost-capped fallback); Google (Google sign-in, and Analytics on this website after you accept); Meta (Facebook sign-in, and the WhatsApp Business Platform when a business connects a number); and our mailbox provider Openprovider (Hosting Concepts B.V., Netherlands). The Subprocessors page has the full list.
These providers also process data under their own terms. WhatsApp messages travel through Meta, which processes them under its own WhatsApp terms. Stripe handles payment data under its own terms. AI providers process the content we send under their own commercial terms. If a workspace uses its own AI key, that provider works for the business under the business's contract. We may disclose data when the law requires it. We do not sell personal data.
International transfers
Our main systems are in the European Union (Milan). Some providers, including Anthropic, OpenAI, Stripe, Google and Meta, may process data in the United States and other countries. Where the law requires safeguards for these transfers, we rely on the safeguards the provider offers, such as standard contractual clauses.
Security
We encrypt data in transit and at rest, isolate every workspace, store passwords, session tokens and API keys only as hashes, offer two-step verification, check the signature of every incoming provider webhook and keep an audit log. We hold no security certification and do not claim one. If a breach affects your personal data, we will tell you, and the authorities where required, without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct or delete your data, get a copy, object to or restrict some uses, withdraw consent, and complain to your data protection authority. Edit your profile in the app, export a workspace from Settings → Data, follow the steps on Delete your data, or email privacy@stayreplied.com. We confirm who you are before acting and reply within 30 days.
If you messaged a business that uses StayReplied
That business decides what happens to your conversation, so ask it first. If you cannot reach it, email privacy@stayreplied.com and we will pass your request on. Sending STOP records your opt-out on that channel: the AI stops replying, and automated, API and marketing messages to you are refused; a person can still answer if you write again. Sending START opts you back in.
Age and changes
StayReplied is a service for businesses and not meant for children; accounts are for people aged 18 or older. We will post changes here with a new date and tell account holders before material changes take effect.
How to delete your account, a workspace or your Facebook sign-in data