Privacy Policy

Last updated: July 31, 2026

ReplyReady.ai is a product of Be Affluence LLC. Company details: beaffluence.com/about.

1. Introduction

ReplyReady ("we," "us," or "our") is a product operated by Be Affluence LLC, a limited liability company. We operate the website at https://replyready.ai and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including our AI voice agents, Facebook and Instagram message automation, CRM dashboard, lead capture tools, SMS notifications, and booking features.

Be Affluence LLC is the legal entity responsible for this Service and is the controller or processor of the data described below, as applicable. Our corporate address, telephone number and group-level policies are published at beaffluence.com.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Two Kinds of People in This Policy

ReplyReady is business software, so two different groups appear in our systems with different relationships to us:

Business customers — the business owner or staff member who signs up, connects a phone line, Facebook Page or Instagram professional account, and configures the Service. For their own account data we are the controller.
End users — members of the public who call, text, or message one of our business customers. That information belongs to the business. The business is the controller and we act as a processor / service provider on its instructions.

If you are an end user and want your data deleted, you can ask us directly — see our Data Deletion Instructions. You do not need an account to make that request.

3. Information We Collect

Account Information

When you sign up, we collect your name, email address, phone number, business name, and industry. Authentication is handled through Supabase JWT-based sessions.

Business and Lead Data

Through your use of the Service, we store call transcripts generated by our AI voice agents (powered by VAPI), message threads handled by our social agents, lead information (name, phone number, email address), business configuration, and booking link preferences. This data is stored in our Supabase PostgreSQL database with Row-Level Security (RLS) enforced, ensuring strict data isolation per customer account via a dedicated customer_id.

Payment Information

Subscription payments are processed by Stripe. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. Stripe handles PCI-DSS compliance.

Usage Data

We collect standard server logs including IP addresses, browser type, pages visited, and timestamps to maintain and improve the Service. Our backend runs on Google Cloud Run and our frontend is hosted on Vercel.

4. Facebook and Instagram Data

This section applies only to business customers who choose to connect a Facebook Page or Instagram professional account, and only from the moment that connection is completed.

4.1 How the connection is made

A signed-in business customer clicks Connect Facebook in the ReplyReady dashboard and is redirected to Facebook Login. Facebook — not ReplyReady — presents the permission screen and asks which Pages to grant access to. We receive an access token only for the Pages the person selects, and only for Pages on which they already hold an administrative role. We cannot connect, read or message a Page our customer does not administer.

4.2 Permissions we request, and why

Permission	What it gives us	Why the product needs it
`pages_show_list`	The list of Pages you administer: Page ID, name and category.	So you can pick which of your own Pages to connect, and so we can confirm you administer it.
`pages_messaging`	Receive messages sent to your Page and send the reply into that same conversation.	This is the core feature — answering the customer enquiries you would otherwise miss.
`pages_manage_metadata`	Subscribe your Page to our webhook, and unsubscribe it on disconnection.	Meta delivers inbound messages by webhook. Without the subscription we receive nothing and no reply is possible. Used for subscription management only — never to change your Page settings.
`instagram_basic`	The Instagram professional account linked to your Page: account ID, username and profile picture.	To identify which Instagram account to answer for, and to show it in your dashboard so you can confirm the right one is connected.
`instagram_manage_messages`	Receive direct messages sent to your Instagram account and send the reply into that same conversation.	Customers reach you on Instagram as well as Facebook. Same feature, second surface.
`instagram_manage_comments`	Reply to comments left on your own Instagram posts.	When someone comments asking where to buy, we answer within seconds with the product link, instead of the question going cold. We only ever reply to comments on your own posts.

We request no other permissions. In particular we do not request access to publish posts, manage advertising, read audiences, read follower or insights data, or access any personal Facebook or Instagram profile beyond what is listed above.

4.3 Webhook events we subscribe to

For each connected Page we subscribe to these fields and no others: messages, messaging_postbacks, hours, location, phone, description. The first two deliver customer enquiries. The last four tell us when you update your own published hours, address, phone or description, so your agent answers "what time do you close?" correctly instead of guessing.

If you connect an Instagram professional account, we additionally subscribe to the Instagram messages and comments events, which deliver direct messages sent to your account and comments left on your own posts.

4.3a Instagram comment replies are rule-based, not AI-generated

A comment reply is public, so we treat it differently from a private message. You write explicit keyword rules — for example, a comment containing "I want it" gets a reply with the product link — and we send only those replies. We do not generate public comment text, and comments that match no rule get no reply at all. We reply at most once to any given comment, enforced by a uniqueness constraint in our database rather than by application logic, so a repeated delivery from Meta cannot produce a duplicate public reply. We never comment on anyone else's posts, and we do not delete or hide comments.

4.4 Exactly what we store

Page ID, name and category — to identify and label the connected Page. Deleted on disconnection.
Page access token — to receive webhooks and send replies. Encrypted at rest, never returned in any API response or exposed to any browser. Deleted immediately on disconnection or revocation.
Page-scoped user ID (PSID) of the person who messaged you — to address the reply to the right conversation and recognise repeat messages. A PSID is scoped to your one Page; it cannot identify a person elsewhere on Facebook and we make no attempt to do so.
Message content, both directions — to understand the enquiry, generate an accurate reply, keep context for follow-ups, and let you read the thread in your dashboard.
Contact details the person volunteers in the conversation (name, phone, email) — to create the lead record and book the appointment.
Your published Page business information (hours, location, phone, description) — so the agent answers factual questions correctly. Deleted on disconnection.
Instagram account ID and username — to route incoming Instagram messages and comments to your account, and to label it in your dashboard. Deleted on disconnection.
Instagram comment records — the comment ID, the post ID, the commenter's Instagram ID, the reply we sent and which of your rules matched. We keep this to guarantee we never reply to the same comment twice and so you can audit what was sent on your behalf.
Reply events and timings — to produce your reporting: enquiry volume, response time, booking rate and attributed revenue.

4.5 How replies are generated

When a message arrives we first try your own keyword rules. If none match, the message text and recent conversation history are sent to our AI provider (OpenAI) to draft a reply consistent with the instructions you configured. The reply is sent back into the same Facebook conversation. Our AI provider processes this data on our instructions under a commercial agreement and does not use it to train its models. If the AI cannot produce a reply, we notify you instead of sending anything.

4.6 Restrictions we accept on Meta Platform Data

Consistent with the Meta Platform Terms and Developer Policies, data received from Meta platforms ("Platform Data") is:

used only to deliver the messaging and reporting features our business customer authorized — never for a separate purpose of our own;
never sold, rented, licensed or transferred to a data broker, ad network, monetization platform or information-resale service;
never used to build advertising audiences, target advertising, or profile individuals outside the conversation they started;
never used to re-identify anonymized data, or to link a Page-scoped ID to a person's wider Facebook or Instagram identity;
never used to send unsolicited outbound messages, or to message anyone who has not contacted the business first;
kept confidential, encrypted in transit and at rest, and access-controlled;
deleted on request, on disconnection, and when no longer needed for the purpose collected.

We honour opt-out immediately. If a person asks the business to stop messaging them, the agent stops and the conversation is flagged for the owner. We do not attempt to re-engage them through automation.

4.7 Disconnecting and revoking

You can disconnect a Page at any time from your ReplyReady dashboard, or revoke ReplyReady entirely at Facebook Settings → Business Integrations. On either action we unsubscribe the Page from our webhook and delete the stored access token immediately. Conversation history is then handled under section 11, or deleted straight away on request — see Data Deletion Instructions.

5. SMS/Messaging Terms

Our Service sends SMS notifications via Telnyx from the phone number +1 (732) 394-1771. By providing your phone number and opting in, you consent to receive transactional SMS messages related to lead alerts, booking confirmations, and account notifications.

Message frequency varies based on your account activity and settings.
Message and data rates may apply.
Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.

Opt-Out: Reply STOP to any message to unsubscribe from SMS notifications. You will receive a single confirmation message and no further texts.

Help: Reply HELP to any message for support information, or contact us at support@replyready.ai.

6. How We Use Your Information

Provide, operate, and maintain the Service
Process subscriptions and billing through Stripe
Send transactional SMS notifications and email alerts
Power AI voice agents to answer calls and capture leads on your behalf
Reply to inbound messages on the Facebook Page or Instagram account you connected, using the instructions you configured
Generate call transcripts, message threads and lead summaries
Produce your own reporting on enquiry volume, response time, bookings and attributed revenue
Improve and personalize the Service
Respond to support inquiries
Comply with legal obligations

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use customer conversation content to train general-purpose AI models.

7. Data Sharing and Disclosure

We may share information with the following categories of recipients:

Service Providers: Supabase (database & auth), Stripe (payments), Telnyx (SMS), VAPI (voice AI), OpenAI (drafting agent replies), Meta Platforms (delivering and sending Facebook/Instagram messages), Google Cloud (hosting and secrets management), and Vercel (frontend hosting) — each bound by their own privacy policies and data processing agreements.
The business customer whose Page or phone line generated the conversation — this is the purpose of the Service.
Legal Requirements: When required by law, subpoena, or government request.
Business Transfers: In connection with a merger, acquisition, or sale of assets. Any acquirer remains bound by this policy for data received.

We do not sell your personal information to third parties. Our providers are located primarily in the United States; if you are outside the United States, your information will be processed there.

Government and law enforcement requests. Disclosing data because we were asked is not the same as disclosing it because we were obliged to. When a public authority requests personal information, we apply the following process before anything is released:

We review the legality of every request. We require legal process appropriate to the data sought, and we confirm the request is valid on its face and issued by an authority with jurisdiction over us.
We challenge requests we believe are unlawful. We will refuse or contest a request that lacks proper legal process, is overbroad, or seeks data beyond what the stated purpose supports.
We disclose the minimum necessary. We provide the narrowest set of records that satisfies a valid request — never an entire account history when specific records were sought.
We document every request. We record the request, our response, the legal basis relied on, and who authorised the disclosure.
We notify you where we lawfully can. If we are not prohibited from doing so by law or court order, we will tell the affected person before disclosing their data, so they have an opportunity to respond.

These commitments apply to all personal information we hold, including Platform Data received from Meta. We have received no national security requests for user data.

8. Data Security and Isolation

We implement industry-standard security measures to protect your data. All customer data is isolated at the database level using Supabase Row-Level Security (RLS) policies tied to your unique customer_id. This ensures that no customer can access another customer's data through the API.

Data is encrypted in transit (TLS) and at rest. Authentication tokens are signed using HS256 and validated on every request. Platform access tokens and API credentials are held in Google Secret Manager, not in application code or configuration files. Webhook payloads from Meta are rejected unless the request signature verifies against our app secret.

9. Automated Replies and AI Disclosure

Replies sent by ReplyReady are generated by software, not typed by a person. Our business customers are contractually required to disclose that an automated assistant may respond, and our agents identify themselves as an assistant when asked. An automated agent never provides legal, medical, tax or financial advice, and requests that need a human are escalated to the business owner.

10. HIPAA Disclaimer

ReplyReady is not HIPAA-compliant. While we offer industry templates including those for medical and healthcare businesses, the Service is not designed to collect, store, or transmit Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act. If you operate in the healthcare industry, you are responsible for ensuring that no PHI is transmitted through or stored by the Service.

11. Data Retention and Deletion

Category	Retention
Facebook Page access tokens	Deleted immediately on disconnection or revocation
Conversations, transcripts and lead records	Life of the subscription, then 90 days after cancellation to allow reactivation, then permanently deleted
Account and configuration data	Life of the account, then 90 days, then permanently deleted
Aggregate reporting metrics (no message content)	Life of the account
Billing and tax records	Seven years, as required by law
Security and server logs	90 days

A verified deletion request overrides the periods above, except where we are legally required to keep a record. To request deletion, follow our Data Deletion Instructions. Encrypted backups age out on their normal 90-day rotation; we do not restore deleted records from backup.

12. Cookies

We use only essential cookies required for the Service to function, such as authentication session tokens. We do not use advertising, analytics, or third-party tracking cookies.

13. Your Rights (CCPA / GDPR)

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal data we hold about you.
Correction: Request that we correct inaccurate or incomplete data.
Deletion: Request that we delete your personal data, subject to legal retention requirements.
Portability: Request your data in a structured, machine-readable format.
Opt-Out of Sale: We do not sell personal data. If this changes, we will provide an opt-out mechanism as required by the CCPA.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Appeal: If we refuse a request, you may appeal by replying to our decision; a different reviewer will consider it.

To exercise any of these rights, contact us at privacy@beaffluence.com or follow our Data Deletion Instructions. We will respond within 30 days (or as required by applicable law). If you are an end user whose data reached us through a business customer, we will act on your request and also notify that business.

14. Children's Privacy

The Service is intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

16. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Be Affluence LLC (operator of ReplyReady.ai)
Privacy and data requests: privacy@beaffluence.com
Product support: support@replyready.ai
Website: https://replyready.ai
Parent company: https://beaffluence.com