Privacy Policy

We collect information necessary to provide and improve our AI agent platform. Here is what we collect and why.

We use your data for the following purposes:

• Operate the platform — process conversations, generate AI responses, deliver messages across channels
• Improve service quality — analyze usage patterns to fix bugs and enhance features
• Generate analytics — provide you with conversation metrics, response quality insights, and channel performance data
• Send service notifications — account alerts, security notices, and product updates (no marketing emails without consent)
• Ensure security — detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations — respond to lawful requests and enforce our terms

We never sell your personal data. We never use your business data or conversation content for advertising.

Our platform uses artificial intelligence to generate responses for your agents. Here is how it works:

Conversations are processed by third-party AI models, including OpenAI (GPT-4.1 mini) and Anthropic (Claude). These providers receive conversation context to generate responses.

We do not use your conversation data to train AI models. Your business conversations are processed for response generation only and are not used to improve general-purpose AI models.

AI-generated responses may contain inaccuracies, incomplete information, or inappropriate content. You are responsible for reviewing your agent's configuration and monitoring its outputs.

End-users interacting with your agents may be communicating with AI. We recommend clearly disclosing this in your agent's welcome message to comply with emerging AI transparency regulations.

We share your data only with the service providers necessary to operate our platform. We do not sell or rent your data to third parties.

Each sub-processor is bound by a data processing agreement. We will notify you of any changes to our sub-processor list.

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We retain your data only as long as necessary for the purposes described in this policy.

• Account data — retained while your account is active; deleted within 30 days of account deletion
• Conversation data — retained for active conversations; configurable per workspace settings
• Knowledge base — retained while uploaded; deleted immediately when you remove content
• Analytics data — retained for 12 months, then anonymized
• Technical logs — retained for 90 days
• Platform tokens — deleted immediately when you disconnect a channel

When you delete your account, we initiate permanent deletion of all associated data within 30 days. Some data may be retained longer if required by law.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data
• Portability — request your data in a structured, machine-readable format
• Withdrawal — withdraw consent for data processing at any time
• Objection — object to processing based on legitimate interests
• Restriction — request restriction of processing under certain conditions

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

For users in Taiwan, these rights are protected under the Personal Data Protection Act (PDPA). You may also file a complaint with the Personal Data Protection Commission (PDPC).

Your data may be transferred to and processed in countries other than your own. Our primary infrastructure is in Taiwan (GCP asia-east1), but AI processing occurs in the United States.

We ensure appropriate safeguards for cross-border transfers through data processing agreements with all sub-processors and compliance with applicable data protection laws.

We implement industry-standard security measures to protect your data:

• Encryption at rest and in transit (TLS 1.2+)
• Platform tokens encrypted using GCP Secret Manager
• Row-level security (RLS) policies on all database tables
• OAuth 2.0 authentication with no password storage
• Regular security audits and dependency updates
• Access controls and audit logging

In the event of a data breach, we will notify affected users and relevant authorities within 72 hours, as required by applicable law.

We use minimal cookies necessary to operate the service:

• Authentication session cookies (essential, cannot be disabled)
• Language preference cookies
• Theme preference (light/dark mode)

We do not use third-party advertising cookies, tracking pixels, or behavioral analytics tools. We do not participate in cross-site tracking.

Replai is a business tool and is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or in-app notification. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this privacy policy or our data practices, contact us at:

We aim to respond to all privacy inquiries within 30 days.