Privacy Policy

Effective date: October 14, 2026

1. Who we are

PrimeReply (primereply.com) is a software-as-a-service platform that lets businesses send and receive WhatsApp messages, run campaigns, build chatbots and capture leads using the official WhatsApp Business Platform from Meta. PrimeReply is operated by Prydio Technologies LLP, a limited liability partnership registered in India, with its registered office at 1/219A, Manjerikunnath, Vadakkumuri, Muduthala, Pattambi Police Station, Ottappalam, Palakkad - 679303, Kerala, India ("Prydio", "we", "us").

This policy covers two kinds of personal data:

• Account data about the businesses and team members who use PrimeReply. For this data we decide why and how it is processed (we are the "data fiduciary" or "controller").
• Customer data: the messages, contacts and form or lead answers that a business handles through PrimeReply about its own customers. We process this data only on that business's instructions, to provide the service to it (we act as a "data processor"). The business is responsible for having a lawful basis, such as opt-in consent, to message its customers.

In short: we use data only to run PrimeReply for you. We do not sell personal data, we do not use it for advertising, and we do not use your customers' messages for any purpose other than providing the service to you.

2. Information we collect

Information you give us

• Account and team details: name, email address, phone number, password (stored only as a one-way hash), workspace name, time zone, language and team roles. Optional: two-factor authentication settings and profile photo.
• Billing details: plan, invoices, billing name and address, GST or tax number, and payment status. Card, UPI and bank details are entered on our payment provider's secure page; we do not receive or store them.
• Support requests: the content of tickets and any files you attach.
• Content you create: message templates, chatbot flows, campaigns, saved replies, web forms, landing pages, click-to-chat links and AI knowledge-base material you upload or enter.

Customer data you handle through PrimeReply

• Your contacts' WhatsApp numbers, profile names and the details you store (such as email, company, tags, notes and custom fields), including their marketing opt-in or opt-out status.
• Messages and media sent and received through your WhatsApp numbers, with delivery and read statuses.
• Answers submitted through your WhatsApp Flows, web forms and Facebook lead forms, and the page a form was submitted from.

Information collected automatically

• IP address, browser and device type, pages visited in the app and timestamps, used for security, fraud and spam prevention and troubleshooting.
• For public web forms and click-to-chat links: the visitor's IP address (to block spam and count clicks once per visitor) and the referring page.

3. Data we receive from Meta (WhatsApp & Facebook)

When a business connects its WhatsApp number to PrimeReply through Meta's Embedded Signup (Facebook Login for Business), it grants PrimeReply permissions on its WhatsApp Business Account. We request only the permissions we need:

Permission	What we use it for
whatsapp_business_messaging	Sending and receiving WhatsApp messages for the business, and receiving delivery and read statuses.
whatsapp_business_management	Reading the business's WhatsApp account and phone numbers, managing message templates, WhatsApp Flows and the business profile, and registering webhooks so messages reach PrimeReply.
business_management (if requested)	Identifying the business portfolio that owns the connected WhatsApp account during signup.

From Meta we receive the WhatsApp Business Account ID, phone number IDs and display names, the business profile, an access token for the account (stored encrypted), message templates and their review status, incoming messages and media, and message statuses.

WhatsApp Business app coexistence: if a business chooses to keep using the WhatsApp Business app on the same number, Meta shares its contacts, messages sent from the phone and, if the business agrees in the app, up to six months of earlier chat history. This is used only to show the business its own conversations in PrimeReply.

Facebook Lead Ads (optional): if a business connects its Facebook Pages to receive lead-ad leads, we additionally request pages_show_list, pages_read_engagement, pages_manage_metadata, pages_manage_ads, leads_retrieval and ads_management. We receive the Page names and IDs, a Page access token (stored encrypted), the questions on the business's lead forms, and the answers people submit. We use them only to add those leads to the business's contacts and send the follow-up the business configured.

We never use data received from Meta for advertising, to build profiles of people, or for any purpose other than providing PrimeReply to the business that connected it. Our use of this data also follows Meta's Platform Terms. A business can remove PrimeReply's access at any time in its Meta Business settings (Business integrations), and can ask us to delete the data as described in section 10.

4. How we use information

• To provide PrimeReply: deliver and display messages, run campaigns, chatbots, automations, forms and lead capture as each business configures them.
• To create and secure accounts: sign-in, two-factor authentication, permissions within a team, and preventing abuse, spam and fraud.
• To bill: create invoices, confirm payments with our payment providers and keep accounting records required by law.
• To support you: answer tickets and fix problems.
• To send service emails: verification, password resets, invoices, renewal reminders, security and policy notices. We do not send marketing emails without your consent, and you can opt out at any time.
• To meet legal obligations and enforce our Terms of Service.

AI features: AI replies and writing help are off until a business turns them on. When they are on, the message text being answered or rewritten and the most relevant parts of that business's knowledge base are sent to the AI provider the business selected (for example OpenAI, Anthropic or Google), only to generate the reply. Uploaded knowledge files are converted to text and the original file is deleted.

5. Who we share information with

We do not sell or rent personal data. We share it only with:

• Meta Platforms, to send and receive WhatsApp messages and manage templates through the WhatsApp Business Platform, and to fetch Facebook leads when a business uses Lead Ads.
• Payment providers such as Razorpay, which process payments on their own secure pages.
• Infrastructure providers that host our servers, store backups and deliver our emails, under confidentiality and data-protection obligations.
• AI providers chosen by a business, only when that business turns on AI features (see section 4).
• Webhooks and integrations a business sets up: if a business connects PrimeReply to its own systems, we send the data it selected to the address it provided.
• Authorities, when required by Indian law or a valid legal order, or to protect the rights, safety or property of our users, the public or Prydio.
• A successor, if PrimeReply is merged or sold. We will tell you before your data becomes subject to a different policy.

6. Where data is processed

PrimeReply runs on servers operated by our hosting provider. WhatsApp messages also pass through Meta's infrastructure, and AI requests through the selected AI provider, which may be located outside India. Where data is transferred outside India, we do so as permitted under Indian law and with providers that protect it to a comparable standard.

7. How long we keep data

• While a workspace is active: we keep its account and customer data so the business can use it. The business can delete individual contacts, conversations, forms and other items at any time.
• After a workspace is deleted (by its owner, or by us when a closed account is removed): the workspace is closed immediately and its contacts, chats, campaigns, bots, forms and leads are permanently deleted after 30 days. The delay lets an owner recover from accidental deletion.
• Invoices and payment records: kept for as long as Indian tax and accounting law requires.
• Server logs: kept for about 14 days.
• Backups: deleted data may remain in encrypted backups until those backups are rotated out on their normal cycle.

8. Security

• All connections to PrimeReply use HTTPS.
• Access tokens for WhatsApp and Facebook, API keys and other secrets are encrypted in our database.
• Each workspace's data is kept separate from every other workspace's.
• Two-factor authentication is available for all users and can be required for administrators.
• Team members only see what their role allows, and important actions are recorded in an activity log.
• Incoming webhooks from Meta and payment providers are accepted only with a valid signature.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as required by law.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023, and similar laws elsewhere, you can:

• ask for a summary of the personal data we hold about you and how it is processed;
• ask us to correct, complete or update it;
• ask us to erase it, or withdraw consent you gave us;
• raise a grievance with us and, if it is not resolved, with the Data Protection Board of India;
• nominate someone to exercise these rights on your behalf in case of death or incapacity.

If you are a customer of a business that uses PrimeReply (for example, you received a WhatsApp message from a shop), that business controls your data. Please contact the business first. You can usually stop its marketing messages by replying "STOP". If you contact us, we will forward your request to the business and help it respond.

To exercise your rights, email hello@prydio.com. We respond within 30 days.

10. Deleting your data

Workspace owners can delete their workspace under Settings → Delete workspace in PrimeReply. Anyone can also ask us to delete their data by email. Step-by-step instructions, including how to remove PrimeReply's access to your Facebook or WhatsApp account, are on our Data Deletion page.

11. Cookies

PrimeReply uses only cookies needed for the service to work: a session cookie that keeps you signed in, and a security token that protects forms. Your light or dark mode choice is saved in your own browser's storage. We do not use advertising or cross-site tracking cookies. Public web forms embedded on other websites do not set cookies.

12. Children

PrimeReply is a business service for people aged 18 and over. We do not knowingly collect personal data from children through our own sign-up. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as PrimeReply or the law changes. We will change the "Last updated" date above and, for significant changes, notify workspace owners by email or in the app before the change takes effect.

14. Contact & grievance officer

• Company: Prydio Technologies LLP
• Registered office: 1/219A, Manjerikunnath, Vadakkumuri, Muduthala, Pattambi Police Station, Ottappalam, Palakkad - 679303, Kerala, India
• Email: hello@prydio.com
• Grievance officer: Abdu Ssamad MK, Partner, hello@prydio.com
• Service: primereply.com

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.