Instant Reply

GDPR overview

GDPR compliance is claimed concretely rather than vaguely. The privacy policy maps each purpose to an Article 6 legal basis: 6(1)(b) contract, 6(1)(f) legitimate interest, 6(1)(c) legal obligation and 6(1)(a) consent. The UAE PDPL (Federal Decree-Law No. 45 of 2021) applies alongside it, the company being based in Abu Dhabi, and Californian CCPA/CPRA rights are handled separately with a 45-day answer, extendable once. EU and UK users are offered access, rectification, erasure, portability, restriction, objection, withdrawal of consent and complaint to their supervisory authority, with a 30-day response from privacy@instantreply.co. An Article 28 DPA is published and counter-signed for business customers within five working days; transfers outside the EEA and UK rely on standard contractual clauses, and breaches are notified to customers within 72 hours. One clear gap: no Article 27 EU representative is designated.

Who owns the data?

The terms are explicit: you keep all rights to the data you upload to or generate through the service, defined as Customer Data, and you grant InstantReply only a limited licence to process it in order to provide and improve the service. Conversation data belongs to the customer. InstantReply is the controller for its own marketing site and a processor for customer conversations, while the customer remains the controller towards its own end customers and handles their requests. On the way out, Customer Data can be exported for 30 days after termination, and the DPA lets the customer choose between deletion and return within 30 days of the contract ending.

Reuse rights

As the owner of your Customer Data you may reuse, export and reproduce it freely, without asking InstantReply for permission. On its side the company lists what it processes data for: running and improving the service, taking payments, sending transactional email, marketing with an opt-out, support, fraud prevention, legal obligations, and aggregated anonymised analytics. Conversation content is passed to AI model providers only to generate the reply, the transcription or the audio, and the policy states that it sends “only the content needed to generate the output and does not enroll this data in any provider data-sharing or model-training programs”. Staff may review Customer Data under confidentiality obligations to operate, secure, debug and improve the service. Personal data is not sold and is not shared for cross-context behavioural advertising. New-account details (name, email, company name) are pushed to an internal Discord channel.

Data retention & training

Hosting summary

The application, its frontend, the PostgreSQL database, Entra ID authentication, the Redis cache and message processing all run on Microsoft Azure in the Sweden Central region, inside the European Union. Around that core, a published table lists eleven subprocessors with their location: Stripe for payments, Google Analytics for the marketing site only, Meta for channel delivery, Resend for transactional email and Sentry for monitoring are all in the United States. AI inference is spread wider still — OpenAI in the United States, AWS Bedrock and Polly in the EU (Frankfurt) and the United States, Google Gemini API in the United States, Azure OpenAI Service in the United States and the EU, and Alibaba Cloud Model Studio for Qwen in Singapore. Transfers outside the EEA and the UK are covered by standard contractual clauses, with copies available on request. Data is encrypted at rest and in transit (TLS 1.2 and above), integration secrets use AES-GCM, and access is limited by row-level security and organisation-scoped controls. Customers are notified fourteen days before any material change of subprocessor and may terminate. No certification is claimed for any of it.