Legal
Privacy Policy
Prepared under the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
Last updated: October 2026
1. Who we are
ReplyOff is a messaging and customer-service platform for online stores. It sends order, shipping and cart notifications over WhatsApp, answers customer questions with an AI assistant and provides a shared inbox. ReplyOff is operated by Duran Çelik ("we", "us").
Address: Kırkkonaklar Mahallesi, 360 Sk. No: 13 İç Kapı No: 12, Çankaya / Ankara, Türkiye
Email: business@replyoff.com
Website: https://replyoff.com
2. Our two roles
- •Controller — for merchants: For the data of the businesses and staff who use ReplyOff (account, billing and usage data), we decide how and why the data is processed.
- •Processor — for merchants' customers: When you connect a store (Shopify, ikas) or a messaging account (WhatsApp, Instagram), we process your customers' personal data only on your behalf and according to your instructions. You, the merchant, are the controller of that data.
3. Data we process about merchants
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, phone number, business name | Sign-up and settings |
| Billing data | Plan, invoices, billing address. Card numbers are handled only by the payment provider (Shopify Billing or iyzico) and never reach us. | Payment flow |
| Technical data | IP address, browser, device, logs | Collected automatically |
| Usage data | Pages visited, features used | Collected automatically |
| Business content | Products, prices, FAQs, message templates, AI settings | Entered by you or synced from your store |
4. Data we process from connected stores (Shopify, ikas)
When you install ReplyOff on your store, we access only the data covered by the permissions you approve, and only for the purposes below.
| Data | Purpose |
|---|---|
| Customer name, phone number, email address, country | Sending order, shipping, delivery and abandoned-cart messages on WhatsApp; showing your customer list and segments |
| Customer marketing (SMS) consent status | Sending marketing messages only to customers who consented (can be enforced in Settings) |
| Orders (items, amounts, status, tracking details) | Triggering messages based on order status; reporting revenue recovered by messages |
| Abandoned checkouts | Sending cart reminder messages |
| Products, store policies and store information | Letting the AI assistant answer customer questions accurately |
| WhatsApp / Instagram conversations | Showing conversations in your inbox and generating AI replies |
- •We collect the minimum data needed. We do not store payment card data or full street addresses.
- •We never sell or rent customer data, never use it for advertising, and never share it with other merchants.
- •We do not make automated decisions that have legal or similarly significant effects on individuals.
- •AI replies are generated from your store data and the conversation. Providers we use for AI do not use this data to train their models.
- •Requests from your customers about their data are forwarded to you, and we help you respond to them.
5. Legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Providing the service, account management | Performance of a contract |
| Billing, tax and accounting records | Legal obligation |
| Security, fraud prevention, access logging | Legitimate interests |
| Product improvement and usage analytics | Legitimate interests |
| Our own marketing emails to merchants | Consent (can be withdrawn at any time) |
| Measuring our ads and showing them to people who may be interested (Meta Pixel / Conversions API, public pages only) | Consent, given in the cookie notice (can be withdrawn at any time) |
| Processing merchants' customer data | On the merchant's instructions, under the data processing terms (section 7) of our Terms of Use |
6. Sub-processors
We use the following service providers to run ReplyOff. Each is bound by data protection terms.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt, Germany) |
| Vercel | Application hosting and server functions | United States / global edge network |
| OpenAI | AI replies and text generation | United States |
| Meta Platforms (WhatsApp, Instagram) | Sending and receiving messages for accounts you connect | United States / EU |
| Meta Platforms Ireland (Meta Pixel / Conversions API) | Ad measurement on our public pages, only with your consent: page visited, browser/device data, IP address and, on sign-up or contact form submission, hashed email and phone. Merchants' customer data is never shared. | EU / United States |
| Shopify, ikas | Store data access, only for stores that install ReplyOff | Their own infrastructure |
| Shopify Billing, iyzico | Subscription payments | Their own infrastructure |
7. International transfers
Our database is hosted in the EU. Some providers above process data in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, and by the transfer rules of Article 9 of KVKK.
8. Retention and deletion
| Data | Retention |
|---|---|
| Account data | While the account is active, then up to 1 year after a deletion request |
| Invoices and payment records | 10 years (Turkish tax law) |
| Technical logs | Up to 2 years (Turkish Law No. 5651) |
| Messages (inbox history) | While the account is active; deleted 90 days after the subscription ends |
| Data synced from Shopify or ikas | While the app is installed. Deleted automatically 24 hours after the app is uninstalled. |
| Access logs | 1 year |
We automatically handle Shopify's privacy webhooks. When a customer asks for erasure (customers/redact), that customer's data is deleted. After a store uninstalls the app (shop/redact), all of the store's data is deleted. Erasure requests are completed within 30 days at the latest. If you reinstall within 24 hours of uninstalling, your data is kept.
9. Security
- •Encryption in transit (TLS) for all connections, and encryption at rest (AES-256) for the database and backups
- •Row-level security in the database; store access tokens and other secrets can only be read by our servers
- •Verification of webhook signatures; unsigned requests are rejected
- •Staff access limited to what is strictly necessary; two-factor authentication on all admin accounts
- •Logging of administrative access to personal data and of customer data exports
- •A written incident response procedure. We notify affected merchants without undue delay and notify authorities within 72 hours where required.
10. Your rights
Under GDPR and KVKK you can request access to your data, and its correction, erasure, restriction or portability. You can also object to processing based on legitimate interests and withdraw your consent at any time. To do this, email business@replyoff.com. We reply within 30 days. You can also complain to your local data protection authority. In Türkiye, this is the Personal Data Protection Authority (kvkk.gov.tr).
If you are a customer of a store that uses ReplyOff, please contact that store first. It controls your data. We will help the store respond to your request.
11. Cookies
We use cookies needed for sign-in, security and your settings. On our public pages, and only with your consent, we also use Meta Pixel cookies to measure our ads. Advertising cookies are never used inside the app dashboard. See our Cookie Policy.