Privacy Policy

This policy explains how ReplyBack ("we", "us") collects and uses personal data when you use our missed-call recovery service and website at replyback.co.uk. We are based in the United Kingdom and comply with the UK GDPR and the Data Protection Act 2018.

Who we are

ReplyBack is the data controller for account information and the website. For the caller data our customers process through the service, ReplyBack acts as a data processor on the customer's behalf (the business is the controller). You can contact us at hello@replyback.co.uk.

What we collect

• Account data — your name, email, password, and your business details (business name and phone number).
• Caller data (processed for our customers) — the phone numbers of people who call our customers, the text messages exchanged, and basic call metadata such as time and outcome.
• Payment data — handled by Stripe. We never see or store full card details.
• Technical data — essential cookies to keep you signed in, and standard server logs.

How we use it and our lawful basis

• To provide and operate the service (performance of a contract).
• To take payment and prevent fraud (contract; legal obligation).
• To improve and secure the service and respond to support requests (legitimate interests).
• Caller text-backs respond only to enquiries a caller initiated — they are not marketing — and every message honours STOP opt-outs, in line with UK PECR.

Sub-processors we use

We share data only as needed to run the service, with providers acting on our instructions: Supabase (database & authentication), Twilio (calls & SMS), Anthropic (AI qualification), Stripe (payments), and Vercel (hosting). Some may process data outside the UK under appropriate safeguards.

Retention

We keep account and lead data for as long as your account is active, and delete or anonymise it within a reasonable period after you close your account, unless we must keep records for legal or accounting reasons.

Your rights

You have the right to access, correct, delete, or restrict the use of your personal data, and to object to certain processing. To exercise these rights, email us. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

Changes

We may update this policy from time to time. Material changes will be posted here with a revised date.