Privacy Policy

Who we are

TopReply is provided by Valmark Ltd, registration number HE 477569, Archiepiskopou Makariou III, 34, Hadjiyianni Building, 2nd floor, Office 203, 3065 Limassol, Cyprus ("we", "us"). You can contact us about privacy at [email protected].

When we are the controller, and when we are not

We are the controller of personal data about visitors to topreply.io, people who sign up for or use TopReply (our customers and their team members), and people who contact us. This policy explains how we handle that data.

We are a processor when businesses use TopReply to run a chatbot on their own website. For conversations, lead form answers and other data that visitors share with those chatbots, the business that owns the chatbot is the controller and decides how the data is used. We process it only on their behalf and on their instructions. If you chatted with a chatbot on another website, please read that business's privacy notice and contact them to exercise your rights. If you contact us, we will forward your request to them.

Personal data we collect

Data you give us

• Account data: your name, email address, password (stored only as a secure hash), role and the organisation you belong to. If you sign in with Google or Apple, we receive your name, email address and an account identifier from that provider.
• Billing data: company name, billing address, VAT number, plan and payment history. Card details are handled by our payment provider, and we only see limited information such as the card type, last four digits and expiry date.
• Customer Content: the websites, files, snippets, answers, instructions and settings you add to train and configure your chatbot. This may contain personal data if you include it.
• Communications: messages you send us by email, the contact page or support, and our replies.

Data we collect automatically

• Usage and log data: IP address, browser and device type, pages viewed in the dashboard, actions taken, timestamps and error logs.
• Audit log: actions by team members in your organisation, such as replying to, closing or deleting a conversation.
• Website analytics: if you accept analytics cookies, how you found and used topreply.io, such as pages visited, referring site, approximate location and device information.

Data processed for our customers

When a business uses TopReply, we process its visitors' messages, lead form answers, the page path where the chat took place (never the query string), language and approximate time, on that business's behalf as described in section 2.

Why we use it, and our legal bases

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time, as described in section 9.

How we use AI

TopReply uses AI models from carefully selected providers to understand your content and to generate answers. When a chatbot answers a question, the relevant parts of the business's content and the conversation are sent to the AI provider to generate the reply.

• We do not use your content or conversations to train AI models, and our AI providers may not use them to train theirs.
• AI providers process the data only to provide their service to us, and may keep it for a limited period to detect abuse, as their terms require.
• We do not use AI to make decisions about you that have legal or similarly significant effects.

Who we share data with

We never sell personal data or share it for advertising. We share it only with:

• Service providers who help us run TopReply, in these categories: hosting and infrastructure, AI model providers, email delivery, payment processing, website crawling, website analytics and customer support tools. They act on our instructions under data processing agreements and may not use the data for their own purposes.
• Sign-in providers you choose to use, such as Google or Apple.
• Members of your organisation, who can see the data that their role gives access to.
• Professional advisers, such as lawyers, auditors and accountants, under confidentiality obligations.
• Authorities, when the law requires it, or when it is necessary to protect our rights, our users or the public.
• A buyer or successor, if all or part of our business is sold or merged. They will have to respect this policy.

Customers who need the current list of service providers that process their chatbot data can request it under our Data Processing Agreement at [email protected].

International transfers

We store personal data on servers in Germany, in the European Union. Some of our service providers, including AI model providers, may process data outside the European Economic Area (EEA), for example in the United States. When that happens, we protect the data with one of the safeguards the GDPR requires: an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the provider is certified) or the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can ask us for more information about these safeguards.

How long we keep data

• Account data and Customer Content: for as long as your account is active. When your account is closed, we delete it within 30 days. Copies in backups are deleted as backups rotate out.
• Chatbot conversations and leads: for the retention period the business chooses in its settings, or until it deletes them, and at the latest within 30 days after its account is closed.
• Billing records: for as long as tax and accounting laws require.
• Security logs and audit logs: for a limited period needed to keep the Service secure and investigate incidents.
• Support messages: for as long as needed to help you, and for a reasonable time afterwards in case you contact us again.
• Website analytics: for a limited period, after which it is deleted or kept only in aggregated form.

We may keep data longer if we need it to establish, exercise or defend a legal claim.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted, unless we need to keep it, for example for legal reasons;
• restrict how we use your data in certain cases;
• receive your data in a portable format and have it sent to another provider (portability);
• object to our use of your data based on legitimate interests, and to direct marketing at any time; and
• withdraw your consent at any time, without affecting what we did before you withdrew it.

To use your rights, email [email protected]. We will reply within one month and may ask you to confirm your identity first. It is free of charge.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy). We would appreciate the chance to resolve your concern first.

Cookies and local storage

• Strictly necessary cookies keep you signed in to the dashboard and protect forms against cross-site request forgery. They are needed for the Service to work and do not require consent.
• Analytics cookies on topreply.io help us understand how the website is used. We only set them if you accept them, and you can change your choice at any time in the cookie settings.
• The chat widget on our customers' websites does not set cookies. It uses the browser's local storage to keep a visitor's conversation open between page loads and to remember settings such as sound and whether a lead form has been sent. The business that runs the chatbot is responsible for informing its visitors and asking for consent where its local law requires it.

Security

We protect personal data with technical and organisational measures, including encryption in transit (HTTPS with HSTS), role-based access for team members, a separate access token for each chat visitor, rate limits, an audit log, hashed passwords and restricted staff access. No system is completely secure, but if a breach affects your data, we will notify you and the authorities as the law requires.

Children

TopReply is not intended for anyone under 18, and we do not knowingly collect their personal data in our own role as controller. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy when our Service or the law changes. The date at the top shows when it was last changed. If we make significant changes, we will tell customers by email or in the Service before they take effect.

Contact