Privacy Policy

Tenreply ("we", "our", "us") is operated by PYALM LABS LLP, a limited liability partnership registered in India, with offices at HiLITE Business Park, Kozhikode, Kerala, India. PYALM LABS LLP operates the Tenreply platform (the "Service") and is responsible for the data described in this policy, including data we receive from Meta and other platforms you connect. This Privacy Policy describes how we collect, use, and share information when you use our Service.

1. Information we collect

Account information

When you register, we collect your name, email address, business name, and password. We also collect payment information through our payment processor (we do not store card numbers directly).

WhatsApp conversation data

To provide the Service, we process WhatsApp messages sent and received through your connected business number. This includes message content, timestamps, media files, and contact phone numbers. When you connect WhatsApp through Meta's Embedded Signup, we also receive the IDs of your WhatsApp Business Account, phone number, and the Meta business portfolio that owns them, and an access token that lets the Service send and receive messages for you.

Instagram, Facebook, and Messenger data

When you connect an Instagram professional account or a Facebook Page, we receive from Meta:

Account details: the account or Page ID, username or Page name, and profile picture, so you can see which account is connected.
Access tokens: issued by Meta so the Service can act for the connected account. They are stored encrypted.
Direct messages: Instagram and Messenger messages sent to your account, including message content, attachments, timestamps, and the sender's name, username, and profile picture, so your team can read and reply to them in the Service.
Comments: comments on your account's posts, including the comment text, the commenter's username, and the post it belongs to, so you can see and reply to them and run the keyword replies you set up.
Posts you publish: the captions and media you publish through the Service, and the post IDs and basic engagement counts Meta returns for them.

We use this data only to provide these features to you. The people who message or comment on your accounts are your customers: we process their messages and comments on your behalf, to let you respond to them.

LinkedIn data

When you connect LinkedIn, we receive your profile name and ID, the company pages you administer, and an access token, so the Service can publish posts you create.

Usage data

We automatically collect information about how you use the Service, including log data, IP addresses, approximate location (country, and where available region and city) supplied by our network provider, Cloudflare, browser and major version, operating system, device type, timezone, language, pages visited, and actions taken within the platform. We use this information for account security, abuse and denial-of-service prevention, attribution, and aggregate product analytics. We do not collect device MAC addresses or precise GPS location during signup.

On our website, we count visits using a random visitor identifier stored in your browser, so we can see how many visitors become users. Website visits are recorded with the page, the channel that brought you to us, your device type and approximate location; the IP address is stored only as a one-way hash and never in readable form. Visit records are deleted after about 13 months.

Marketing attribution

If you arrive at our website via a marketing link, we may capture UTM parameters and referrer information to understand which channels bring users to Tenreply. This data is stored in your browser's localStorage and is only submitted when you create an account.

Job applications

When you apply for a role, we collect the information you submit, including your contact details, résumé, professional profile links, and cover letter. We use this information only to evaluate and communicate with you about employment opportunities at Tenreply.

2. How we use your information

To provide, operate, and improve the Service
To authenticate you and manage your account
To process payments and send billing communications
To send product updates, security notices, and support communications
To analyse usage patterns and improve the platform
To evaluate job applications and manage recruitment
To comply with legal obligations

We do not sell your personal data to third parties. We do not use conversation data, comments, or any other data received from Meta or LinkedIn for advertising, and we do not use it for any purpose other than providing the Service to you.

AI-assisted replies

If you turn on AI replies, the text of incoming customer messages and the knowledge documents you upload are sent to our AI provider, Anthropic, to draft or send a reply. This happens only for businesses that enable the feature. Anthropic processes this data on our behalf to generate replies and does not use it to train its models.

Push notifications

If you use the Tenreply mobile app, we send notifications about new messages containing the sender's name and a short preview of the message.

We share data with third parties only as necessary to provide the Service:

Meta (WhatsApp, Instagram, Facebook, Messenger): Messages, comments, and posts are sent and received through Meta's APIs. Meta's own privacy policy governs their data handling.
LinkedIn: Posts you publish to LinkedIn are sent through LinkedIn's API.
Payment processors: Payment information is handled by a PCI-compliant payment processor.
Analytics tools: We may use aggregated, anonymised analytics to understand Service usage.

We use the following service providers, which process data on our behalf, under contract, and only to run the Service:

Railway (United States): hosts our application servers and database, where the data described in this policy is stored.
Vercel (United States, with a global edge network): hosts our web app and carries requests between your browser and our servers.
Cloudflare (United States, with a global edge network): provides DNS, encryption in transit, and network protection for our API.
Anthropic (United States): generates AI replies, only for businesses that turn the feature on.
Expo (United States): delivers push notifications to our mobile app, through Apple Push Notification service and Google Firebase Cloud Messaging.
Resend (United States): sends account and notification emails.

All data is encrypted in transit, and access tokens are additionally encrypted at rest. Some of these providers process data outside your country, including in the United States.

4. Data retention

We retain your account data for as long as your account is active. Raw signup IP addresses and user-agent strings are encrypted and normally retained for up to 30 days for security investigations, after which they are automatically removed. Pseudonymised IP hashes and coarse device or country information may be retained with the account for fraud prevention and aggregate analytics. Conversation data is retained for 12 months by default; you can configure retention within the platform. When you delete your account, we delete your data within 30 days, except where we are required by law to retain it longer.

When you disconnect a WhatsApp, Instagram, Facebook, or LinkedIn account in Tenreply, we immediately delete its access token and stop receiving its messages and comments. Conversations and comments already received stay in your account history until you delete them or your account. You can also remove Tenreply's access in your Meta Business settings or Facebook settings, after which we can no longer access those accounts. If you send a data deletion request through Meta, or to us at hello@tenreply.com, we delete the data we received from Meta about you and give you a confirmation code to track the request.

5. Your rights

Depending on your location, you may have rights including the right to access, correct, or delete your personal data. To exercise these rights, contact us at hello@tenreply.com.

6. Security

We implement industry-standard security measures including encryption at rest and in transit, access controls, and regular security reviews. However, no system is completely secure and we cannot guarantee absolute security.

7. Cookies

We use cookies for authentication and analytics. See our Cookie Policy for details.

8. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via email or a notice within the Service.

9. Contact

For privacy-related questions, contact PYALM LABS LLP at hello@tenreply.com, via the contact form, or by post at HiLITE Business Park, Kozhikode, Kerala, India.