Privacy policy and data protection

Who we are

ReplyBay is a trading name and software product operated by Panorama Brands B.V., a Dutch private limited company registered with the Dutch Chamber of Commerce under KvK 92632483. Its registered business address is Koemarkt 53, 1441 DB Purmerend, the Netherlands. Throughout this policy, "ReplyBay", "we", "us", and "our" refer to Panorama Brands B.V. when it operates the ReplyBay service. We provide software that reads, organises, and drafts replies to messages arriving across your support inboxes.

For the purposes of the EU General Data Protection Regulation (GDPR), Panorama Brands B.V. is the data controller for the account, billing, usage and website data described in this policy, and a data processor for the messages, customer details and order data it handles on behalf of the businesses that use ReplyBay, under the data processing terms in our Terms of Service. For that data the business is the controller: its end customers should contact that business to exercise their rights, and we help it respond. ReplyBay's core application, database, object storage, backups and workflow processing run in Google Cloud's Netherlands region. Some providers process data outside the EU/EEA; the Sub-processors section names them and the safeguard for each.

ReplyBay has not appointed a data protection officer. If you have any questions about this policy or wish to exercise your rights, write to support@replybay.ai.

What data we collect

We collect only the data we need to deliver the service:

Account data. Your name, work email address, organisation name, billing details, and authentication credentials. This is the information you provide when you create and manage your ReplyBay account.
Inbox message content. When you connect a channel, we process the contents of incoming and outgoing messages, including sender details, subject lines, message bodies, and attachments, so that ReplyBay can read each message and draft a reply.
Usage analytics. Aggregated, operational data such as feature usage, draft acceptance rates, confidence scores, error logs, and performance metrics. This helps us keep the service reliable and improve it for you.
Product milestones and signup source. Records of key account events, such as signing up, creating a workspace, connecting a channel, the first AI reply and starting a subscription, and where a signup came from: the page, plan or channel, campaign (utm_) parameters and any referral code a signup link can carry, and the host name of the referring site. We keep them in our own EU-hosted database to learn which pages and steps help merchants get started, and we do not send them to third-party analytics or advertising services.
Anonymous visit counts. When you open a page on this website, it sends one count to our own API: the page path, the site language, any campaign (utm_) parameters in the address and the host name of the site that sent you. The count carries no cookie, browser storage or identifier. Your IP address is used only in hashed form, to limit how many counts are accepted, and expires after ten minutes; it is not stored with the count. Nothing is sent when your browser signals Do Not Track or Global Privacy Control. The counts are kept with the milestones above, in our EU-hosted database.
Case study permissions. Only if a workspace owner chooses them in Settings: which permissions were given (metrics, anonymised results, name and logo, quote), the quote itself, and when the permissions were given or withdrawn.
Referral records. The referral code a workspace shares, which accounts signed up through it, their progress (signed up, activated, paid) and the checks we run against abuse, such as whether both sides share a company email domain, a payment customer or a card fingerprint from Stripe. We never receive card numbers.

We do not knowingly collect special-category data, and we ask that you do not deliberately route sensitive personal data through the platform beyond what is inherent to your support conversations.

How we use your data

We use your data for the following purposes only:

Service delivery. Operating your account, authenticating you, routing messages, and providing the core ReplyBay functionality you signed up for.
AI drafting. Generating reply drafts from your resolved conversations, tone settings, help documentation, and product context. ReplyBay retrieves that context in its EU-hosted core service, then sends the minimum necessary prompt data to an AI model provider: Anthropic, under ReplyBay's own business account, by default, or the provider a workspace owner selects.
Support and billing. Responding to your requests and administering your subscription.

ReplyBay does not use your data to train AI models. Your message content and account data are never sold, rented, or shared with advertisers. Model requests are made through each provider's business or API service under that provider's data-use terms; ReplyBay does not opt customer content into provider model training. Resolved conversations may be kept, with personal details removed, as style examples that stay private to your workspace.

Purposes and legal bases

We process personal data for the purposes above on these legal bases:

Contract (Art. 6(1)(b) GDPR). Creating and running your account and workspaces, drafting and sending replies as you configure them, billing, transactional email and support.
Legal obligation (Art. 6(1)(c) GDPR). Keeping invoices and financial records as tax and accounting law requires, and answering lawful requests from authorities.
Legitimate interests (Art. 6(1)(f) GDPR). Keeping the service and your account secure, preventing abuse and fraud (including the referral checks), error monitoring, request logs, records of connection attempts for support, product milestones, signup sources and the anonymous visit counts on this website. Our interests are to run a secure and reliable service and to learn which pages and steps help businesses get started. We keep these records minimal and first-party, apart from error monitoring, which Sentry processes for us in the EU. You can object to them at any time.
Consent (Art. 6(1)(a) GDPR). Optional product telemetry in the app, and the case study permissions a workspace owner chooses. Consent can be withdrawn at any time in Settings or by email; this does not affect processing before the withdrawal.

You need to provide your name, email address and a password, or use a Google or Apple sign-in, to create an account; without them we cannot provide the service. Everything else described as optional is your choice. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). AI replies to your end customers follow the rules your workspace sets, and payment problems, disputes, legal threats and privacy requests are always held for a person.

Data storage and security

ReplyBay's core application, database, object storage, backups and workflow processing run in Google Cloud's Netherlands region. Cloudflare, AI model providers, payment and email-delivery providers, and the channels you connect may process the limited data their service needs outside the EU/EEA. The Sub-processors section names them and the transfer safeguard each one relies on.

We protect your data with industry-standard safeguards, including encryption in transit (TLS 1.2 or higher for all network connections) and encryption at rest for stored data and backups. Access to production systems is restricted to authorised personnel on a least-privilege basis, protected by multi-factor authentication and logged for audit.

While no system can be guaranteed perfectly secure, we maintain organisational and technical measures appropriate to the risk, and we will notify affected users and the relevant supervisory authority of any qualifying personal data breach within the timeframes required by the GDPR.

Sub-processors and where data is processed

ReplyBay's core service runs in the EU. These providers process personal data for ReplyBay, or for you when you connect them, to deliver the service:

Google Cloud (Netherlands region). Core application, database, object storage, backups and workflow processing. Where Google processes data outside the EU/EEA, for example for support, it relies on the standard contractual clauses in its Cloud data processing terms and on Google LLC's certification under the EU-U.S. Data Privacy Framework.
Cloudflare. DNS, TLS and edge delivery for replybay.ai and the app. A connection may be terminated at a Cloudflare location outside the EU. Safeguards: Cloudflare, Inc.'s certification under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Anthropic. The default AI model provider for drafting and reviewing replies, under ReplyBay's own business account. For customers in the EEA the service is provided by Anthropic Ireland, Limited under Anthropic's data processing addendum; requests may be processed outside the EU/EEA, transfers rely on the standard contractual clauses in that addendum, and Anthropic does not use this data to train its models.
OpenAI. Text embeddings used in knowledge search, under ReplyBay's own business account. For customers in the EEA the service is provided by OpenAI Ireland Ltd; requests may be processed outside the EU/EEA, and OpenAI's onward transfers rely on standard contractual clauses.
OpenAI, Anthropic, Z.ai or OpenRouter. Optional AI model providers that a workspace owner selects with their own account or key, used instead of ReplyBay's account for that workspace. They then process the data under the workspace owner's own agreement with them, and the workspace owner is responsible for the transfer safeguard. Z.ai processes data in Singapore, which has no EU adequacy decision. OpenRouter requests are sent with provider data collection denied.
Stripe. Payment processing and billing, provided by Stripe Payments Europe, Limited (Ireland). Card details go to Stripe and never reach ReplyBay's servers. Transfers to Stripe in the United States rely on Stripe's certification under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Resend. Transactional email, such as verification, password reset and billing notices, and the waitlist and update sign-ups on this website. Safeguards: the certification of Plus Five Five, Inc. (Resend) under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Sentry (Functional Software, Inc.). Error and performance monitoring for the API, the app and this website. Events contain technical error data only, such as the error type, the code location, the page or API route and response times. Message content, contact details and IP addresses are removed before an event is sent. Data is stored in Sentry's EU region (Germany) for up to 90 days, on the basis of our legitimate interest in a secure and reliable service. Where Sentry accesses data from the United States, it relies on Functional Software, Inc.'s certification under the EU-U.S. Data Privacy Framework and the standard contractual clauses in its data processing agreement.
Meta Platforms. Meta's JavaScript SDK loads only when you start connecting WhatsApp, to authorise your WhatsApp Business account. Meta Platforms Ireland Limited provides it; transfers to Meta Platforms, Inc. rely on its certification under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Channels and tools you connect. Gmail, Instagram, Messenger, WhatsApp, TikTok, Shopify, helpdesks and other integrations process the data their feature needs under their own terms.

Which AI model provider handles a workspace's requests depends on that workspace's settings. You can ask for a copy of the transfer safeguards at support@replybay.ai. We update this list when these providers change and, for the businesses we process data for, announce changes in advance as our data processing terms describe.

Your GDPR rights

If you are located in the EU/EEA, you have the following rights over your personal data:

Right of access. You can request a copy of the personal data we hold about you.
Right to erasure. You can ask us to delete your personal data ("the right to be forgotten"), subject to our legal obligations.
Right to data portability. You can request your data in a structured, commonly used, machine-readable format.
Right to rectification. You can ask us to correct inaccurate or incomplete data.
Right to object and restrict. You can object at any time to processing based on our legitimate interests, and ask us to restrict certain processing of your data.
Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time, without affecting processing before the withdrawal.

Signed-in users can download a machine-readable account export and delete their account from Settings. To exercise any other right, email support@replybay.ai. We will respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where an infringement took place. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If your data reached ReplyBay through a business that uses it, such as a shop you contacted, please contact that business first.

Data retention

Resolved conversations and their attachments, execution metadata, thread context, and learned case memory are retained for 365 days by default. Workspace owners can choose a period from 1 to 3,650 days, or explicitly choose indefinite retention. Open conversations remain available while they still require action. Cancelling a subscription does not by itself delete the account.

You can permanently delete your account in Settings. ReplyBay first cancels active subscriptions, then removes the account, workspaces you own, conversations, attachments, knowledge, saved connections, and active-system vector copies. We keep only financial records required by tax or accounting law.

Residual copies may persist in encrypted backups for a limited period before being rotated out. Where we are required to retain certain records to comply with legal, tax, or accounting obligations, we will keep only the minimum data necessary for the period required by law.

Product milestones, the signup source copied onto them and the anonymous visit counts are kept for 25 months and then deleted. Records of provider connection attempts, kept to debug failed connections, are kept for 90 days. The signup source saved to an account is kept while the account exists and is deleted with it; product milestones that remain until their 25 months end no longer point to a deleted account. Error reports and request logs are kept only as long as needed to investigate problems. Invoices and financial records are kept for seven years, as Dutch tax law requires. A case study quote is deleted when its permission is withdrawn.

Third-party integrations

ReplyBay connects to the channels and tools you choose to authorise. When you connect an integration, you grant ReplyBay permission to access the data necessary to operate that channel:

Gmail / Google Workspace (OAuth). We use Google's OAuth flow to read and send messages on your behalf. We request the minimum scopes required and never use Google user data for purposes outside delivering the ReplyBay service, in line with Google's API Services User Data Policy.
WhatsApp Business API. Where connected, we process inbound and outbound WhatsApp messages through the official Business API to draft and send replies.
Other channels and providers. Additional email, helpdesk, and messaging integrations operate on the same principle of least access.

These providers act as independent controllers of the data within their own platforms; their use of your data is governed by their respective privacy policies. You can revoke any integration's access at any time from your account settings or the provider's security dashboard.

A connected provider may operate outside the EU/EEA. ReplyBay sends only the data needed to deliver the feature you authorised and relies on the provider's applicable transfer safeguards where required.

Cookies and local storage

This website and the ReplyBay app use only strictly necessary cookies and browser storage: to make them work, to keep your session secure, and to remember choices you make. We do not use analytics, advertising, cross-site tracking, or third-party marketing cookies. We do not build advertising profiles, and we do not share cookie-derived data with advertising networks.

On this website (replybay.ai) we set:

Language (nuxt-lang). A cookie that remembers the language you choose in the language menu, for one year. The cookie is set for replybay.ai and its subdomains, so the ReplyBay app at app.replybay.ai uses the same language. Without it, on your first visit our hosting provider Cloudflare picks the language when it serves the page, from your browser language and the country of your connection. The country is used only for that choice and is not stored.
Cookie choice (ncc_c, ncc_e). Cookies that record that you have seen the cookie notice and what you chose, for one year.
Update recovery (session storage). A short-lived entry that lets a page reload once if the site was updated while you were browsing. It is deleted when you close the tab.

Signup links. When you follow a signup link on this website, the link can carry the page you came from, the plan or channel you picked, any campaign (utm_) parameters and any referral code to the app as URL parameters. The app also notes the host name of the site that sent you (for example a search engine), never the full address. Neither this website nor the app stores these values on your device: the app holds them in memory and sends them with your signup, or with the start of a Google or Apple sign-in, where our API keeps them for at most ten minutes. They are then saved once to your new account.

The ReplyBay app at app.replybay.ai uses strictly necessary cookies and browser storage to keep you signed in, protect your session, open the setup you picked on a signup link, and remember your language, theme, workspace and the notices you dismissed. The app lists each of them on its own privacy page.

You can review this information and your choice at any time with the Cookie settings button on every page, or with the Cookie settings link in the footer.

Age requirement

ReplyBay is a business service for people aged 18 or older. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy. We will announce material changes in the app and by email at least 14 days before they take effect. This version was published on 30 September 2026. It applies to accounts created on or after 1 October 2026 from the start, and to accounts created before then from 15 October 2026.

Contact

For any privacy-related question, request, or complaint, please contact our Data Protection contact:

support@replybay.ai

We will acknowledge your request promptly and respond within the timeframes required by the GDPR.