Reply

Privacy

Last updated 11 November 2026

Who we are

Reply is run by ONEBIT TECHNOLOGY SOLUTIONS LIMITED, RC 1919657, 51 Sani Zangon Daura Estate, Kado, FCT, Nigeria. Write to us at [email protected].

Reply answers customer messages for businesses. Each business decides to connect Reply. For the messages it receives, the business is responsible for its customers' data and we process that data on its behalf.

What we collect

  • From a business: its Instagram account name and id, an access token, and what it teaches Reply, such as menus, prices, hours and policies.
  • From people who contact that business: their Instagram username and id, the messages and comments they send to it, and the replies they receive.
  • When anyone visits this site: basic server logs, such as IP address and browser type.

How we use it

  • To read messages sent to the business and write replies to them.
  • To show the business its conversations and bring it the questions Reply cannot answer.
  • To keep the service working and secure.

We do not sell this data, use it for advertising, or use one business's data to answer for another.

Who else handles it

  • Our AI provider, Anthropic, receives message text so it can write replies. It works in the United States and does not train its models on this data.
  • Our servers are run by Hostinger in France.
  • Cloudflare carries traffic to and from this site, in the United States and Europe.
  • Meta delivers the messages, under its own terms.

We share data beyond this only where the law requires it, as set out below.

Requests from public authorities

If a court, regulator, police force or other public authority asks us for data about a business or the people who message it:

  • We check that the request is lawful and comes from an authority with the power to make it.
  • We challenge a request we believe is unlawful, too broad or not properly made.
  • We share only the minimum data the request requires.
  • We keep a record of each request, our response, the legal reasons and the people involved.
  • Unless the law forbids it, we tell the business concerned before we share anything.

We have not received any such request.

How long we keep it

We keep conversations while a business stays connected. When a business disconnects, we delete its token at once and its messages within 30 days. During the pilot, raw message deliveries are kept for 30 days at most so we can test the service.

How we protect it

Access tokens are encrypted. Data sits on private storage that only the service and our administrators can reach. All traffic uses HTTPS.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask to see, correct or delete your data, or object to how we use it. Write to [email protected]. You can also complain to the Nigeria Data Protection Commission. See Data deletion for the steps.

Automated replies

Replies may be written by AI. Reply says so in its first message of a conversation, and a person at the business can step in.

Changes

If this policy changes we will update the date above and tell connected businesses.