How we collect, use, and protect your data
📅 Last updated: March 2025 — Subject to Swiss law and the European GDPR
| Data | Source | Required |
|---|---|---|
| First and last name | Registration form | Yes |
| Professional email address | Registration form | Yes |
| Phone number | Account configuration | No |
| Business name and address | Account configuration | Yes |
| Payment information | Stripe (never stored by us) | Yes |
| Google Calendar tokens | Google OAuth authorization | No |
| Usage data (logins, actions) | Automatic | Automatic |
| Data | Source | Required |
|---|---|---|
| Conversation messages | Chat widget | Yes |
| Name (if provided for an appointment) | Conversation | No |
| Phone (if provided for an appointment) | Conversation | No |
| Email (if provided for an appointment) | Conversation | No |
| Detected language | Automatic | Automatic |
| Anonymized IP address | Automatic | Automatic |
| Session identifier (hash) | Automatic | Automatic |
| Purpose | Legal basis (GDPR) |
|---|---|
| Service delivery (AI, appointments, dashboard) | Contract performance — Art. 6(1)(b) |
| Billing and subscription management | Contract performance — Art. 6(1)(b) |
| Transactional emails (confirmations, alerts) | Contract performance — Art. 6(1)(b) |
| Service improvement and anomaly detection | Legitimate interest — Art. 6(1)(f) |
| Compliance with legal obligations | Legal obligation — Art. 6(1)(c) |
| Marketing emails (if consent given) | Consent — Art. 6(1)(a) |
Conversation data is processed to provide AI responses. It is not used to train our AI models without explicit consent.
LocalReply uses the following providers, each with their own privacy policy:
| Provider | Role | Location | Policy |
|---|---|---|---|
| Stripe | Payment processing | US / EU | stripe.com/privacy |
| SendGrid (Twilio) | Email delivery | US | sendgrid.com |
| Google Calendar API | Calendar sync | US / EU | policies.google.com |
| OpenAI | AI conversation processing | US | openai.com/privacy |
| Twilio | SMS delivery (Pro plan) | US | twilio.com/legal |
| Render | Backend hosting | US | render.com/privacy |
Transfers to countries outside the EU/Switzerland are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or other adequate transfer mechanisms.
As a LocalReply subscriber deploying the chat widget to your end customers, you act as a data controller and LocalReply acts as a data processor on your behalf for end customer data.
By accepting these Terms of Service, you also enter into a Data Processing Agreement (DPA) with LocalReply. Under this DPA:
A full copy of our DPA is available upon request at support@localreply.ai.
ℹ️ Note on OpenAI: Data sent to OpenAI via the API is not used to train OpenAI models by default, pursuant to OpenAI's API data usage policy. LocalReply does not enable training on your data.
| Data type | Retention period |
|---|---|
| Account data (subscriber) | Duration of subscription + 3 years |
| Billing data | 10 years (legal accounting obligation) |
| Conversations and messages | 12 months after last activity |
| Appointment data | 24 months after appointment date |
| Technical logs | 90 days |
| End customer data (visitors) | 6 months after the conversation |
Upon expiry of these periods, data is irreversibly deleted or anonymized.
Under GDPR (EU 2016/679) and the Swiss Federal Act on Data Protection (nFADP), you have the following rights:
To exercise these rights, contact us at support@localreply.ai. We will respond within 30 days.
You also have the right to lodge a complaint with the competent data protection authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).
LocalReply implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction:
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you within 72 hours in accordance with Art. 33 GDPR.
LocalReply uses a limited number of strictly necessary cookies for the service to function:
| Cookie | Purpose | Duration |
|---|---|---|
| auth_token | Authentication of logged-in user | Session / 30 days |
| business_id | Identification of active business | Session |
We do not use advertising or third-party tracking cookies. No data is shared with advertising networks.
LocalReply is a service intended for professionals and adults. We do not knowingly collect personal data from children under 16. If you believe a minor has provided us with data, contact us for immediate deletion.
We reserve the right to modify this privacy policy at any time. In case of a material change, you will be notified by email at least 30 days before the new provisions come into effect.
The current version is always accessible on this page. The date of last update appears at the top of this document.
For any questions regarding this policy or to exercise your rights: