Replai ("Replai", "we", "us", or "our") provides a platform that lets businesses connect a Facebook Page and build automated Messenger conversation flows, including optional AI-generated replies. This Privacy Policy explains what information we collect through our website and application (the "Service"), how we use and share it, and the choices you have. By creating an account or connecting a Facebook Page to Replai, you agree to the practices described here.

If you are a customer or contact of one of our business users (for example, someone who messages a Facebook Page that uses Replai), this policy also explains how your message data is handled when it passes through our Service on behalf of that business.

Account information

When you register for Replai, we collect your email address and a securely hashed password. We never store your password in plain text.

Facebook Page & Meta Platform data

When you connect a Facebook Page via Facebook Login, Meta shares with us the Page ID, Page name, Page category, and a Page access token, based on the permissions you approve. We currently request:

• pages_manage_metadata — to subscribe your Page to webhook events.
• pages_messaging — to send and receive Messenger messages on your behalf.
• pages_read_engagement and pages_manage_engagement — to read and manage engagement on Page content relevant to your automations.

Messenger conversation data

Through the Messenger webhook, we receive and store message content, sender and recipient identifiers (page-scoped IDs), timestamps, delivery/read status, and postback data needed to run your automations and display your conversation inbox.

Automation and business data

We store the automation flows you build (triggers, conditions, actions), conversation tags you create, and any "Business Memory" content you provide (e.g. FAQs, business details, knowledge base entries) that you use to power automated or AI-generated responses.

Third-party AI provider configuration

If you choose to enable AI-generated replies, you may supply your own API key for a third-party AI provider (such as OpenAI, Anthropic, Google, or OpenRouter). We store that key encrypted at rest and use it only to send relevant conversation context and your Business Memory content to your chosen provider in order to generate a reply on your behalf. We do not use your key for any other purpose.

Technical and usage data

We use a session cookie to keep you signed in, and we log webhook and API activity (timestamps, status, error details) for reliability and debugging.

• Provide, operate, and maintain the Service, including running your automations and delivering messages.
• Authenticate your account and keep it secure.
• Generate AI-assisted replies when you enable that feature, using the provider and key you configure.
• Display your conversation inbox, tags, and automation analytics.
• Diagnose technical issues and improve reliability.
• Communicate with you about your account or the Service.
• Comply with legal obligations and enforce our Terms of Service.

Replai's use of information received from Meta APIs adheres to the Meta Platform Terms, including the Limited Use requirements. We use Facebook Page and Messenger data solely to provide and improve the messaging automation features you have configured for your own Page — we do not sell this data, and we do not use it for advertising or transfer it to any ad network, data broker, or other party for monetization unrelated to providing the Service you requested.

We do not sell your personal information. We share information only with:

• Meta Platforms, Inc. — to send and receive messages via the Messenger Platform, as directed by your automations.
• Your chosen AI provider (OpenAI, Anthropic, Google, or OpenRouter) — only if you enable AI replies and only using the API key and configuration you supply.
• Infrastructure subprocessors — our database (Supabase/PostgreSQL) and queue/cache (Redis) providers, which store and process data solely to run the Service on our behalf.
• Legal and safety — if required by law, legal process, or to protect the rights, property, or safety of Replai, our users, or others.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

Data is stored in a PostgreSQL database and Redis-backed queue, encrypted in transit via HTTPS/TLS. Access tokens and AI provider keys are encrypted at rest. Access to production data is restricted to personnel who need it to operate the Service. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

We retain account, Page, conversation, and automation data for as long as your account is active, so the Service can function. If you disconnect a Page or delete your account, we delete or anonymize associated Page tokens, message content, and Business Memory data within 30 days, except where we must retain limited records to comply with legal obligations, resolve disputes, or enforce our agreements.

You can, at any time:

• Disconnect a Facebook Page from the Settings area of the app, which revokes our access and stops further message processing for that Page.
• Revoke Replai's access entirely from Facebook, via Facebook Settings → Business Integrations (or Settings & Privacy → Settings → Apps and Websites), which immediately invalidates our access token for your Page.
• Request a copy of, correction to, or deletion of your personal data by emailing delgersaikhan.alt@gmail.com. We will verify your request and act on it within 30 days.
• Follow our data deletion instructions to remove Replai from Facebook, which sends us an automatic deletion request and gives you a confirmation code you can use to check its status.
• Delete your account outright, which deletes your login credentials, connected Pages, stored conversations, automations, and Business Memory content, subject to the retention exception above.

Depending on your location, you may have additional rights under applicable data protection law (such as the right to object to or restrict certain processing). Contact us at the email above to exercise these rights.

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

We may process and store information on servers located in countries other than your own. Where required, we take steps intended to ensure such transfers comply with applicable data protection law.

We may update this Privacy Policy from time to time. We will update the "Effective date" above and, for material changes, provide additional notice (such as an in-app notice or email).

Replai
Email: delgersaikhan.alt@gmail.com

See also our Terms of Service.