Privacy Policy | Replyvoo

This is a draft prepared for review by a qualified lawyer before publication.

This Privacy Policy explains how Zedapex Limited ("Zedapex", "we", "us" or "our"), based in Lagos, Nigeria, handles personal data in connection with Replyvoo (replyvoo.com), its web app, AI Closers, the Juno assistant and related services (the "Service").

We follow the Nigeria Data Protection Act 2023 ("NDPA") and, where they apply to people in the European Union or United Kingdom, the EU General Data Protection Regulation and the UK GDPR (together, "GDPR").

1. Our two roles: controller and processor

Replyvoo is used by businesses to talk to their own customers. That means we play two different roles.

We are the controller for personal data about our own customers and visitors, such as:

account holders and team members who sign up for Replyvoo;
billing contacts and payment records;
people who visit replyvoo.com, contact support, or join the Voo Squad referral programme.

We are a processor for personal data that our business customers send through Replyvoo about their customers ("end-users"), such as Telegram chat messages, names, usernames, phone numbers, lead scores and notes. For this data, the business customer is the controller and decides why and how it is used. We process it only on their instructions, as set out in our Data Processing Addendum.

If you are an end-user who chatted with a business that uses Replyvoo, please contact that business first about your data. We will help them respond to your request, and if you contact us directly we will pass your request to them where we can identify them.

2. Data we collect as controller

Account and profile data

name, email address, phone number, password (stored in hashed form), business name, country, language and time zone;
workspace names, team member invitations and roles.

Billing and transaction data

plan, billing period, invoices, Voo Credit purchases and usage, coupons used;
payment status and limited payment details from our payment processors (for example, card type and last four digits, or a crypto wallet address and transaction hash). We do not store full card numbers.

Referral data

your referral link and code, who signed up through it, commission earned, payout method and payout details.

Usage and device data

log-in times, pages and features used, IP address, browser and device type, approximate location derived from IP, error logs and security events.

Communications

messages you send to our support team, survey answers and your conversations with Juno.

Connected channel data

identifiers and tokens needed to connect your Telegram bots, groups or Telegram Business account (and other channels when launched).

3. Data we process as processor

On behalf of our business customers, we process:

end-users' messages, attachments, voice notes and media;
end-users' names, usernames, profile photos, phone numbers and platform IDs;
lead scores, tags, notes, conversation history and payment-link status;
broadcast (Blast) recipient lists and delivery status.

The business customer is responsible for having a lawful basis to collect and use this data and for giving its end-users any required notices.

4. How we use data and our lawful bases

We use controller data for the following purposes:

To provide the Service: creating and running your account, workspaces and AI Closers. Lawful basis: performance of a contract.
To bill you and manage credits: processing payments, renewals, credit balances, coupons and invoices. Lawful basis: performance of a contract; legal obligation (tax and accounting).
To run the referral programme: tracking referrals and paying commission. Lawful basis: performance of a contract.
To provide support: answering questions and fixing problems. Lawful basis: performance of a contract; legitimate interests.
To keep the Service secure: preventing fraud, spam, abuse and enforcing our Acceptable Use Policy. Lawful basis: legitimate interests; legal obligation.
To improve the Service: understanding how features are used, using aggregated or de-identified data where possible. Lawful basis: legitimate interests.
To send service messages: account, security, billing and policy updates. Lawful basis: performance of a contract; legal obligation.
To send marketing: product news and offers. Lawful basis: consent, or legitimate interests where the law allows. You can unsubscribe at any time.
To comply with the law: responding to lawful requests and keeping required records. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more details.

5. AI processing

Replyvoo uses large language models to generate AI Closer replies, score leads, summarise conversations and power Juno.

Message content, your AI Closer instructions and relevant knowledge-base content are sent to our AI model provider, currently Anthropic, to produce a response.
We use AI model providers under terms that do not allow them to use API data to train their general models, and that limit how long they keep data, subject to their policies for safety and legal compliance.
AI Closers do not make decisions that produce legal effects on end-users by themselves. Lead scores are estimates to help businesses prioritise conversations. Businesses remain responsible for any decisions they make.
AI output can be wrong. See our Terms of Service and Disclaimer.

We do not sell personal data. We share it only as follows:

Sub-processors and service providers, under contracts that require them to protect the data:

AI model providers, for example Anthropic;
messaging platforms you connect, for example Telegram (and Meta for WhatsApp and Instagram, and TikTok, when those channels launch);
payment processors, for example Paystack, Flutterwave and a crypto payment processor for USDT;
an email delivery provider, for account and service emails;
a cloud hosting and database provider;
error monitoring, analytics and customer-support tools.

An up-to-date list of sub-processors is available on request at [email protected] and is described in our Data Processing Addendum.

Other sharing

Within our group: with Joinvoo or other Zedapex products, only where you choose to connect them or where needed to provide a service you asked for.
Your referrer: if you signed up through a Voo Squad link, your referrer can see limited information, such as that you signed up and whether you became a paying customer, but not your conversations.
Legal and safety: with courts, regulators, law enforcement or others where required by law, or to protect rights, safety and the integrity of the Service.
Business transfers: with a buyer or investor in connection with a merger, acquisition or sale of assets, subject to confidentiality.

7. International transfers

We are based in Nigeria, and some of our providers (including AI and hosting providers) are located in other countries, such as the United States or countries in the European Union. When we transfer personal data outside Nigeria, or outside the EU or UK, we use appropriate safeguards, such as:

transfers to countries recognised as providing adequate protection;
standard contractual clauses or similar contractual commitments;
other mechanisms allowed under the NDPA and GDPR.

You can ask us for more information about these safeguards.

8. How long we keep data

We keep personal data only as long as we need it:

Account data: while your account is active, then up to 30 days to allow export, then deleted or anonymised, unless we need to keep some of it longer for the reasons below.
Billing and tax records: as long as required by tax and accounting laws, usually up to 6 years.
End-user conversation data: for as long as the business customer keeps it in Replyvoo, and deleted within 30 days after the business customer deletes it or closes its account, except for backups, which are overwritten on a rolling schedule.
Security and log data: usually up to 12 months.
Referral records: as long as needed to calculate and pay commission and handle disputes.
Marketing preferences: until you unsubscribe, after which we keep a record so we do not contact you again.

9. Security

We use reasonable technical and organisational measures to protect personal data, including:

encryption of data in transit (TLS) and, where supported by our hosting provider, at rest;
hashed passwords and encrypted storage of channel tokens and API keys;
role-based access controls and limited staff access on a need-to-know basis;
logging and monitoring for suspicious activity;
regular backups.

No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

10. Your rights

Depending on where you live, you may have the right to:

be informed about how your data is used;
access a copy of your personal data;
correct inaccurate or incomplete data;
delete your data;
restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
data portability, meaning receiving your data in a commonly used format;
withdraw consent at any time, without affecting earlier processing;
not be subject to decisions based solely on automated processing that significantly affect you;
complain to a data protection authority.

To use these rights, email [email protected]. We may need to verify your identity. We will respond within the time required by law, normally within 30 days. If your request is about data we process as a processor, we will forward it to the relevant business customer and help them respond.

11. Children

Replyvoo is for businesses and people aged 18 or over. We do not knowingly collect personal data from children for our own purposes. Business customers must not use Replyvoo to target children or to process children's data unlawfully. If you believe a child has given us personal data, contact [email protected] and we will delete it.

12. Cookies

We use a small number of cookies and similar technologies, including an essential session cookie, a referral cookie and a language preference cookie. We do not use third-party advertising cookies by default. See our Cookie Policy for details.

13. Marketing

We will only send you marketing emails where the law allows. Every marketing email includes an unsubscribe link. Service messages, such as security alerts and billing notices, are not marketing and you will still receive them while you have an account.

14. Changes to this policy

We may update this Privacy Policy from time to time. If a change is significant, we will tell you by email or in the app before it takes effect. The "updated" date at the top shows when it was last changed.

15. Contact and complaints

For any privacy question or request, contact our privacy team:

Zedapex Limited, Lagos, Nigeria

Email: [email protected]

If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC), the data protection authority in Nigeria. If you are in the EU or UK, you can also complain to your local data protection authority, such as the UK Information Commissioner's Office. We would appreciate the chance to address your concerns first.