Privacy policy

Receply (Receply) operates the Receply platform (https://receply.io), a service that answers inbound business calls with AI phone agents. For questions about this policy or your data, contact us at privacy@receply.io.

For account and website data we act as the controller. For call content that our business customers process through their AI agents, we act as a processor on their behalf — see the data processing addendum.

• Account data: name, work email, password hash or Google sign-in identifier, organisation name, role, language.
• Billing data: plan, subscription status, usage minutes, invoices. Payment card data is handled by our payment provider, never by us.
• Configuration data: agent settings, greetings, business hours, knowledge base content, phone numbers assigned to your workspace.
• Call data: caller phone number, call time and duration, audio recording, transcript, AI summary, detected outcome, lead details and callback requests.
• Technical data: IP address, browser and device information, security and audit logs, integration logs.
• Support chat: messages you send to our in-app assistant, used to help you and to improve our support quality.

• Contract performance (Art. 6(1)(b)): providing accounts, agents, phone numbers, call handling, transcripts, summaries and the dashboard.
• Legitimate interests (Art. 6(1)(f)): platform security, fraud and abuse prevention, service reliability, aggregated product improvement.
• Legal obligation (Art. 6(1)(c)): accounting, tax and telecom record-keeping requirements.
• Consent (Art. 6(1)(a)): optional analytics cookies and marketing emails. You can withdraw consent at any time.

Calls answered by an AI agent may be recorded and transcribed. Our customers are responsible for informing callers that the call is answered by an automated assistant and that it may be recorded, and for obtaining any consent required in their jurisdiction. We provide configurable greetings and disclosures to support this.

We use a limited number of vetted providers to deliver the service: cloud hosting and database (EU region), voice AI processing, telephony connectivity, email delivery and payment processing. Each is bound by a data processing agreement and processes data only on our instructions. The current list is available on request.

Our core infrastructure and databases are hosted in the European Union. Where a provider processes data outside the EEA, we rely on the European Commission's Standard Contractual Clauses together with additional technical safeguards such as encryption in transit and at rest.

• Account and configuration data: for the lifetime of the account.
• Call recordings, transcripts and summaries: according to the retention period configured by the customer; by default they are kept while the subscription is active.
• Security and audit logs: up to 12 months.
• Invoices and accounting records: as required by law (typically 7 years).

After account deletion we delete or irreversibly anonymise data within 30 days, except where law requires longer retention.

We apply per-tenant data isolation with row-level security, encryption in transit and at rest, private storage for recordings with short-lived signed access links, least-privilege access for staff, audit logging of administrative actions and secrets stored server-side only — never in the browser.

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. Write to privacy@receply.io and we will respond within one month. If a request concerns call data belonging to one of our customers, we will forward it to that customer as controller. You may also lodge a complaint with your national data protection authority.

We may update this policy as the service evolves. Material changes are announced in the dashboard or by email before they take effect.