Privacy policy

Last updated 27 October 2026

1. Who we are
2. Whose data, and our role
3. What we collect
4. How we use it
5. AI processing
6. Data from Meta
7. Data from Google
8. Who we share it with
9. Where it is processed
10. How long we keep it
11. How we protect it
12. Your choices and rights
13. Children
14. Changes
15. Contact us

1. Who we are

Repll.ai ("Repll.ai", "we", "us") is a software service operated by Techtromech Sdn Bhd, registration no. 202101007077 (1407376-T), a company registered in Malaysia. This policy explains how we handle personal data under Malaysia's Personal Data Protection Act 2010 (PDPA) and the platform rules of the services we connect to. It covers our website (https://repll.ai) and the Repll.ai app at each business's workspace address (for example yourbusiness.repll.ai).

2. Whose data, and our role

• Our customers are the businesses that sign up, and the staff who log in to their workspace. For their account and billing details, we decide how the data is used (we are the data user).
• Their customers are the people who message a business on WhatsApp. Their messages, contact details, bookings and notes are brought into Repll.ai by that business. We process this data on the business's behalf and on its instructions, only to provide the service to it. The business is responsible for telling its customers how their data is used and for having a lawful basis to message them.

If you messaged a business that uses Repll.ai, please contact that business first about your data. We'll help them answer you, and you can also contact us.

3. What we collect

From businesses and their staff

• Account details: name, email address, phone number, role, password (stored only as a one-way hash) and login sessions.
• Workspace content: business details, services, prices, staff profiles, working hours, answers to common questions, documents and website pages added as knowledge for the AI, flows, tags and settings.
• Billing and contract details agreed with us.

About the people who message a business

• WhatsApp messages sent and received through a number the business links to Repll.ai, including text, photos, voice notes, documents, locations and reactions, and the time each was sent.
• Contact details: WhatsApp name, phone number or WhatsApp account identifier, and anything the business or customer adds, such as email, company or language.
• Bookings, notes, tags, pipeline stage, and short facts the AI or staff save about a customer to serve them better next time (for example "prefers Saturdays"). The AI is set up not to save health details, secret numbers or passwords as facts.
• When a chat starts from a Facebook or Instagram click-to-WhatsApp ad: the ad's identifier, headline, text, image link and Meta's click identifier, as WhatsApp attaches them to the first message.

From services a business connects

• Meta (if connected): see section 6.
• Google Calendar (if connected): see section 7.

Technical data

• Logs of requests and errors, IP address, browser and device type, used to run, secure and fix the service.
• Our website doesn't use advertising or analytics cookies. The app uses only the storage it needs to keep you logged in.

4. How we use it

• To provide the service: show and send messages, run the AI assistant and flows, manage contacts and bookings, send reminders, and produce reports for the business that owns the data.
• To keep the service secure and working: prevent abuse, fix problems, and keep records of important actions.
• To support and bill our customers, and to tell them about changes to the service.
• To meet legal obligations.

We don't sell personal data. We don't use a business's data to advertise to anyone, and we don't use one business's data for another business.

5. AI processing

When the AI assistant is turned on, the relevant part of a conversation goes to an AI model so it can write a reply or take an action, such as booking an appointment. That includes the recent messages, the customer's saved details and facts, and the business's knowledge. We send these requests through AI providers that are required not to store the content and not to use it to train their models. Businesses decide which chats the AI answers, and their staff can take over any chat. AI replies can be wrong, so businesses should check what the AI says about their prices and policies.

6. Data from Meta (Facebook, Instagram and WhatsApp)

A business can connect its Meta business account to Repll.ai using Facebook Login for Business. It chooses which ad accounts to share, and the access is read-only (permission ads_read). From the shared ad accounts we receive:

• the ad account's identifier, name, currency and time zone;
• the names and identifiers of ads, ad sets and campaigns, and ad preview images;
• daily performance figures per ad: amount spent, impressions, clicks and messaging conversations started.

We use this data only to show that business which ads brought its leads, bookings and sales, and what each cost. We don't use it for any other purpose. We don't sell it, share it with other businesses, or use it to build advertising profiles. Only that business's workspace can see it.

The access token Meta gives us is stored encrypted. The connection can be removed at any time, either in Repll.ai (Settings → Meta ads → Disconnect) or in Meta Business Settings → Integrations → Connected apps. When it's removed, we stop syncing and delete the token and the synced ad data. See data deletion.

We handle Meta Platform Data in line with Meta's Platform Terms and Developer Policies.

7. Data from Google

A staff member can connect their Google Calendar so Repll.ai can see busy times and add bookings as events, with a Google Meet link for online meetings. We read only free and busy times and the events Repll.ai creates. We don't read the content of other events.

Repll.ai's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, and we don't allow people to read it except where needed for support, security or the law, or with the user's agreement.

8. Who we share it with

We share personal data only with service providers that help us run Repll.ai, under contracts that limit their use of it, and only as much as each one needs:

Provider type	What for
Cloud hosting and storage	Running the app, the database and file storage
Cloudflare	Serving this website and protecting it from attacks
AI model providers (through OpenRouter)	Writing AI replies and transcribing voice notes, with no storage or training on the content
Meta (WhatsApp, Facebook, Instagram)	Sending and receiving WhatsApp messages, and reading ad data a business connects
Google	Calendar busy times and events, for staff who connect Google Calendar

We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if our business is sold (with this policy still applying).

9. Where it is processed

Some of our providers process data outside Malaysia, for example AI model providers and cloud services in other countries. When we transfer personal data abroad, we do it as the PDPA allows, with providers that protect it to a standard at least as strong as this policy.

10. How long we keep it

• We keep workspace data, including chats, contacts and bookings, for as long as the business uses Repll.ai, or until the business deletes it.
• When a business closes its account, we delete its workspace data within 30 days, apart from records we must keep by law, such as invoices.
• Meta ad data and tokens are deleted when the Meta connection is removed.
• Technical logs are kept for a short period, normally no more than 90 days, unless needed to investigate a security issue.

11. How we protect it

• Each business's data is kept separate in the database, so one workspace can't read another's.
• Data is encrypted in transit (HTTPS). Access tokens and API keys for connected services are encrypted at rest.
• Staff access within a workspace follows roles (owner, admin, agent). Agents can be limited to the chats assigned to them.
• Only a small number of our own staff can reach production systems, and only when needed to run or support the service.

No system is perfectly secure. If a breach affects your personal data, we'll tell the affected business, and you where the law requires, without undue delay.

12. Your choices and rights

Under the PDPA you may ask to access and correct your personal data, withdraw consent, and limit how it is processed. You can also ask us to delete it.

• Businesses and staff: most details can be changed in the app. For anything else, email privacy@repll.ai.
• People who messaged a business: ask that business. If you can't reach them, email us with the business's name and your phone number, and we'll help.
• Deleting data and removing connections: see data deletion.

We reply to requests within 21 days. We may need to confirm who you are first.

13. Children

Repll.ai is a service for businesses and isn't meant for children. We don't knowingly collect personal data from children under 13 for our own purposes.

14. Changes

We'll update this page when our practices change and change the date at the top. For important changes, we'll also tell businesses by email or in the app before the change takes effect.

15. Contact us

Techtromech Sdn Bhd 202101007077 (1407376-T)
Privacy: privacy@repll.ai
General: hello@repll.ai