reply.green is a software service that helps Shopify merchants run their WhatsApp customer conversations through an AI agent. This page explains what data we collect, why, where it lives, and how we use it. If you spot a gap, mail us at privacy@reply.green.
Who we are
reply.green is operated by the team behind the reply.green domain. Contact details are in the footer of every page. For data protection enquiries, email privacy@reply.green.
What we collect
Merchant account data
When you sign up, we store your mobile number (in international E.164 form), a hashed password (bcrypt; we never see the plaintext), and the timestamp of account creation.
Per-store configuration
For each store you connect, we store the Shopify storefront MCP URL, the WhatsApp Cloud API credentials you provide (phone number ID, access token, app secret, verify token), the LLM provider and API key you choose, and the brand persona (name, tone, categories, boundaries). Tokens are stored in plain columns today; encryption at rest is planned for a future release.
Conversation data
For every WhatsApp message routed through reply.green, the agent runtime stores conversational state (session events, cart state, recent history) in our Postgres database. This is required to deliver multi-turn conversations and to resume mid-flow if the shopper comes back later. We treat phone numbers and addresses as personally identifiable information.
Operational logs
We write structured logs of every webhook delivery and outbound send. Logs include phone number IDs, message IDs, durations, and error details. Logs are retained for up to 30 days and then rotated.
What we don't collect
- We don't scrape your Shopify catalog into our database. Each turn is grounded in a live MCP call.
- We don't share your WhatsApp credentials, LLM API keys, or conversation transcripts with any third party. They're used only to operate your specific store's agent.
- We don't sell data. Period.
Where data lives
Production data lives in a Postgres database operated on infrastructure we control. We pick India-region hosting where possible for Indian merchants' data — DPDP-friendly by default. The WhatsApp Cloud API itself is operated by Meta and subject to their privacy policy; we are a data processor passing messages back and forth.
LLM provider data flow
Each merchant chooses their LLM provider (Google Gemini or Anthropic Claude) and supplies their own API key. When the agent runs a turn:
- The conversation history + system prompt is sent to your chosen provider.
- The provider returns a response which we relay back over WhatsApp.
- Provider data-handling is governed by your contract with them. reply.green has no separate model-training relationship — we use the provider's standard API.
How long we keep data
- Account data: until you delete your account.
- Store configuration: until you delete the store from your account, or close your account.
- Conversation state: as long as the conversation window is active. After 90 days of inactivity, we trim to anonymised aggregate metrics only.
- Operational logs: 30 days, then rotated.
Your rights
You can request access, correction, export, or deletion of your data at any time by emailing privacy@reply.green. Indian merchants are protected by the Digital Personal Data Protection Act (DPDP) 2023. Account deletion is a hard delete: rows go.
Security
Authentication uses bcrypt password hashes and signed JWTs. The admin API binds to loopback by default; production traffic terminates TLS at a managed reverse proxy. We follow standard secure-by-default practices but don't claim formal compliance certifications yet.
Changes to this policy
We'll update this page when we change how we handle data and post a note on the site. Material changes will also be notified by email to the address (or mobile number) on your account.
Contact
Privacy questions: privacy@reply.green.
Everything else: /contact.