Privacy Policy

Last updated: 2026-10-27

This policy explains how Polyreply ("we", "us") handles personal data when you use our website, our helpdesk application and the chat widget that stores embed on their websites. It is written for the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and similar laws.

1. Who is responsible

The service is operated by Riccardo Micalizzi, Via San Giacomo 11c, 98025 Itala (ME), Italy. Email: support@polyreply.app.

We act in two different roles:

• Controller for the data of people who create an account (store owners and their agents), for billing data, and for messages you send us directly.
• Processor for the data of a store's customers: emails, chat messages and order details that reach a store's workspace. The store is the controller of that data and decides what happens to it. We process it only on the store's documented instructions, under the data processing terms in our Terms of Service (Article 28 GDPR). If you contacted a store through our chat widget or by email, please read that store's privacy policy and send requests about your data to the store; we will help the store answer them.

2. What data we process

Account holders (store owners and agents)

• Name, email address and a hash of your password (we never store the password itself).
• Your workspaces, your role in each one, and invitations you send or receive.
• Sign-in sessions, including the IP address and browser (user agent) of each session, and the language you choose for the dashboard.
• Work you do in the application: replies, internal notes, knowledge base articles, settings, and which replies started from an AI draft.
• Billing: the plan of each workspace and the identifiers of your Stripe customer and subscription. Card details go directly to Stripe and never reach our servers.
• Notifications, if you turn them on: for browser and phone notifications, the push address your browser gives us (an address at your browser's push service, such as Google, Mozilla or Apple) and its encryption keys. Notification content is encrypted end to end, so the push service cannot read it. For email alerts, your choice per workspace. Sound and notification settings for a device stay in that browser's local storage.

Store customers (processed on behalf of the store)

• Name and email address, and the content of emails and chat messages sent to the store.
• For chats: the page the chat was started from, a random visitor token kept in your browser's local storage (we store only a hash of it), and when the chat was last open, so the conversation can continue and replies can be emailed if you have left.
• The detected language of the conversation, so replies are written in your language.
• Order details (status, products, total, shipping and tracking) are fetched live from the store when an agent opens a conversation. They are shown to the agent and, when the agent asks for an AI draft, included in it. They are not stored; only an order number linked by an agent is kept.

Everyone

• IP-based counters that limit how often public forms and APIs can be used. They expire after a few minutes.
• Technical logs kept by our hosting provider for security and troubleshooting.

3. Why we process it, and on what legal basis

• To provide the service you signed up for: accounts, workspaces, tickets, chat, emails, AI drafts and billing (Art. 6(1)(b) GDPR, performance of a contract).
• To keep the service secure and prevent abuse, with sessions, rate limits and logs (Art. 6(1)(f), our legitimate interest in a secure service).
• To meet legal obligations such as keeping invoices and tax records (Art. 6(1)(c)).
• To send service emails (invitations, password resets, important changes). We do not send marketing emails without your consent and we do not sell personal data.

AI drafts are suggestions: a person always reviews and edits a draft before anything is sent. We do not use automated decision-making that has legal or similarly significant effects on anyone.

4. Sub-processors

We use these providers to run the service. Each is bound by a data processing agreement.

When a store connects its WooCommerce shop, order details are requested from that store's own website, which the store runs under its own responsibility.

Stripe also acts as an independent controller for some data it collects on its own checkout and billing pages, for example to prevent fraud and to meet its legal obligations as a payment provider. Its own privacy policy applies to that.

5. Transfers outside the EU/EEA

Some providers above process data outside the European Economic Area. In those cases we rely on the European Commission's Standard Contractual Clauses or, for certified US companies, the EU-US Data Privacy Framework.

6. How long we keep data

• Account data: as long as your account exists. You can delete your account yourself under Settings › Profile, or ask us to do it, at any time.
• Workspace data, including store customers' conversations: until the store deletes it, deletes the workspace, or ends its contract with us. Deleting a workspace deletes its data immediately.
• Sign-in sessions: up to 30 days. Rate-limit counters: a few minutes.
• Invoices and billing records: as long as tax law requires (usually up to 10 years).
• Database backups: encrypted, kept for 7 days. Data you delete stays in them until they expire.
• Logs and backups held by our providers are deleted on their own schedule, normally within 30 days of the original data.

7. Cookies and local storage

We use only what the service needs to work: a sign-in cookie, a cookie that remembers the language you chose, the device notification settings in local storage described above, and, in the chat widget, the visitor token in local storage described above. These are strictly necessary for a service you asked for, so under the ePrivacy rules (in Italy, art. 122 of the Privacy Code) they need no consent. We do not use advertising, analytics or tracking cookies, so we do not show a cookie banner. When you pay, Stripe's checkout page, on Stripe's own website, sets its own cookies for security and fraud prevention.

8. Your rights

You can ask us for access to your data, to correct or delete it, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. Write to support@polyreply.app; we answer within one month. If your data is part of a store's conversations, we forward your request to that store. Store owners can also download a copy of their workspace's data (Settings › General › Export data) and delete the workspace themselves.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italy), or the data protection authority of the country where you live or work.

9. Security

Data is encrypted in transit (HTTPS). Passwords are hashed, store connection secrets are encrypted, workspaces are isolated from each other on every request, and public endpoints are rate limited. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as the law requires.

10. Children

The service is meant for businesses and is not directed at children under 16.

11. Changes

We will update this page when our processing changes and change the date at the top. Important changes are announced by email to account holders.

12. Contact

Riccardo Micalizzi, Via San Giacomo 11c, 98025 Itala (ME), Italy. Email: support@polyreply.app