Privacy Policy

1. What this covers

This policy explains how PT Nusa Inti Telekomunikasi ("Repli", "we") — the Indonesian company that operates Repli — handles personal data when you visit this website, when you talk to us about buying the product, and when your team uses the Repli workspace.

Two different relationships are covered here, and the distinction matters:

• For your own account data — the names, emails and phone numbers of your staff, your billing details, your support messages — we are the controller. We decide what to collect and why.
• For your customers' data — everyone who messages your WhatsApp number — we are a processor acting on your instructions. You are the controller. You decide what is collected, why, and for how long; we execute that and nothing more.

If your organisation needs that written into a contract, ask for our data processing agreement at privacy@repli.site. We sign it before onboarding, not after.

2. What we collect

From this website

Page requests are logged by our host with an IP address and user agent for security and abuse prevention, and those logs are discarded after 30 days. We do not run advertising pixels, cross-site trackers, or third-party analytics that build a profile of you. There is no cookie banner on this site because there is nothing to consent to.

When you contact us

The access-request and contact forms on this site do not submit to a server. They compose a message in WhatsApp or your email client, which you then choose to send. Whatever you send us that way — name, company, phone number, whatever you wrote in the notes field — sits in our inbox and our CRM until you ask us to remove it.

When your team uses the product

• Account data: workspace name, seat names, work emails, roles, password hashes.
• Billing data: company details, tax identifiers, invoice history. Card details go straight to our payment processor and never touch our servers.
• Usage data: which features a seat uses, when they log in, what they change. This is what the audit log shows you, and it is how we debug your problems.
• Support data: the messages you send us and the screenshots you attach.

3. WhatsApp conversation data

This is the sensitive part, so it gets its own section. When you connect a WhatsApp Business number, Repli receives and stores:

• the phone number, WhatsApp profile name, and any contact fields your team fills in;
• the full text of messages exchanged with your number, in both directions;
• media your customers send — images, documents, voice notes — and media you send back;
• delivery and read status, timestamps, and which seat handled which conversation;
• derived values: lead score, assigned owner, pipeline stage, tags, internal notes.

We store this because it is the product. A CRM that forgets the conversation is a spreadsheet. What we do not do is read it for our own purposes: no employee opens a customer conversation unless you ask us to look at something specific, or unless a system alert requires it to keep the service running. Those accesses are logged and available to you.

Your customers are messaging you, not us. Telling them how you use their data is your responsibility as controller — including honouring opt-outs, which the product supports and which the AI agent respects automatically.

4. How we use it

We use data for these purposes and no others:

• To run the service you are paying for — routing messages, scoring leads, firing automations, drawing reports.
• To support you when you report a problem.
• To bill you and to meet our own tax and accounting obligations.
• To keep the service secure — rate limiting, abuse detection, fraud prevention.
• To improve the product in aggregate — counts and timings such as "median first-response time fell this month". Aggregate means aggregate: no message content, no identifiers, nothing that resolves back to a person.

We do not sell personal data. We do not share it with advertisers or data brokers. We do not build a cross-customer contact graph. If we ever want to do something with your data that is not on this list, we will ask you first, in writing, and a "no" costs you nothing.

5. AI processing

The AI agent, lead scoring and summarisation features send conversation content to a large language model provider to generate a reply or a score. This matters enough to spell out:

• Your data is never used to train a shared model. We use enterprise API tiers with training disabled and zero data retention on the provider side, so prompts are not kept after the response is returned.
• The agent only sees what it needs. Prompts are scoped to the conversation being handled plus the knowledge base you uploaded — not your whole database, and never another workspace.
• You choose what it may say. Anything you mark as escalate-to-human is handed over, not answered.
• You can turn it off. Disable AI features per workspace and the calls stop immediately. The rest of the CRM keeps working.
• Every AI action is logged with the prompt, the output, and the seat or trigger that caused it, so an AI reply is as auditable as a human one.

6. Who else touches it

We keep this list short on purpose, and we will tell you at least 30 days before adding to it.

• Cloud infrastructure — hosting, managed database and object storage in the Singapore region.
• WhatsApp Business Platform — the channel itself. Messages transit Meta's infrastructure under their terms; that is inherent to using WhatsApp at all.
• AI model provider — enterprise tier, training disabled, zero retention, as described above.
• Payment processor — card handling and invoicing. They hold your billing data; we hold a reference.

Each one is bound by a written agreement no weaker than this policy. The current list with legal entity names and regions is in the DPA — ask and it arrives the same day.

7. Where it lives, and for how long

Primary storage is in Singapore. Scale customers can request Jakarta hosting where a data-residency requirement applies. Data is encrypted in transit with TLS 1.3 and at rest with AES-256, and every workspace is logically isolated with row-level access control.

• While you are a customer: conversations and contacts are kept until you delete them. You set your own retention rules per workspace; we do not impose one.
• Encrypted backups: retained 30 days on a rolling window, then overwritten.
• Audit and access logs: 12 months, because that is what a security review needs.
• After you cancel: your workspace stays available for 30 days so you can export. We delete production data 60 days after cancellation and confirm in writing when it is gone.
• Invoices: kept as long as Indonesian tax law requires, regardless of deletion requests. That obligation overrides our preference.

8. Your rights

Depending on where you or your customers are, you may have the right to access, correct, export, restrict or delete personal data, and to object to certain processing. Under Indonesia's Personal Data Protection Law (UU 27/2022) and, where it applies, the GDPR, those rights are enforceable — and we would honour them either way.

In practice: everything in the product is exportable to CSV or JSON from the interface, without asking us. Contacts, conversations, media and scores. If you would rather we did it, or you need something the export does not cover, write to privacy@repli.site.

We answer within 7 days and complete the request within 30. If the request concerns one of your customers, we will point them back to you — you are the controller, and it is not our place to act on your data without your instruction.

If a breach affects your data, we notify you without undue delay and no later than 72 hours after we confirm it, with what happened, what we know, and what we are doing. We will not wait until we have a tidy story.

9. Changes and contact

When this policy changes materially we email every workspace admin and update the date at the top of this page. We do not backdate revisions, and we do not treat continued use as consent to a change you were never told about.

Write to privacy@repli.site for anything on this page — DPAs, deletion requests, security questionnaires, or a plain question. Postal address: PT Nusa Inti Telekomunikasi, Spazio Tower, 10th Floor, Jl. Mayjend. Jonosewojo Kav. 3, Pradahkalikendal, Dukuhpakis District, Surabaya, East Java 60225.

Our practical security posture, including what we are not certified for, is on the security page.