Privacy Policy

1. Introduction

Tennyson Labs LLC, operator of SocialRepl.ai ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use SocialRepl.ai (the "Service"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us, including:

• Shopify store information (store name, domain, and related data)
• Instagram account information when you connect your account
• Settings and preferences for automated messaging
• Brand voice customization data

2.2 Information We Collect Automatically

When you use our Service, we automatically collect certain information, including:

• Instagram messages and comments received by your account, including the message text, sender's Instagram user ID, and sender's username
• Customer interaction data (message content, timestamps, channel type, AI-classified intent and sentiment)
• Click-through data from checkout links sent via our Service, including IP addresses and user agent strings of visitors who click checkout links
• Order attribution data when customers make purchases through our checkout links
• Analytics and usage statistics

2.3 Information from Third Parties

We receive information from third-party services you connect to our Service:

• Shopify: Store metadata, product catalog data, store policies and pages, and order metadata (order ID, total amount, currency, attribution URLs such as landing_siteand referring_site). We do not request or store individual Shopify customer profiles, addresses, emails, or payment information.
• Meta (Facebook/Instagram): Instagram account data, messages, comments, and media content for the connected Instagram Business account.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Service
• Process and respond to Instagram messages and comments
• Generate and send automated checkout links to customers
• Track and attribute orders to Instagram interactions
• Generate analytics and insights about your messaging performance
• Improve, personalize, and expand our Service
• Communicate with you about your account and our Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. Data Processing and AI

Our Service uses artificial intelligence (AI) to analyze customer messages and generate automated responses. This includes:

• Classifying message intent and sentiment
• Generating personalized response messages based on your brand voice
• Determining when to send automated checkout links

Message content is processed by OpenAI's API to provide these features. Message text is sent to OpenAI for classification and reply generation but is not used by OpenAI to train their models. We ensure that any third-party AI services we use comply with applicable data protection standards.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We may share information with third-party service providers who perform services on our behalf, including:

• Cloud hosting and database services (Supabase)
• AI and machine learning services (OpenAI)
• Analytics and monitoring services

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

5.3 Business Transfers

If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

6. Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention and Deletion

We retain your information only as long as necessary to provide the Service. While the app is installed on your Shopify store, message and click data is retained so we can power analytics, attribution, and follow-up automation. When you uninstall the app from Shopify, all shop-scoped data — including messages, checkout links, click records, follow-ups, attribution, settings, and brand voice configuration — is automatically deleted within 48 hours of uninstall via Shopify's mandatory shop/redact compliance webhook.

7.1 Shopify privacy compliance

We comply with Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, and shop/redact) per Shopify's privacy law compliance requirements. Because we do not store individual Shopify customer profiles, the customer-scoped webhooks are processed and acknowledged but require no data deletion on our side. The shop-scoped webhook performs the full cascade delete described above.

7.2 Meta (Instagram) data deletion

We support Meta's Data Deletion Callback. The callback endpoint is https://dm-checkout-ai-production.up.railway.app/meta/data-deletion. When an Instagram user requests deletion of their data through Meta, we automatically remove their messages, checkout links, click records, follow-up records, and attribution data from our systems. End-users can also email support@socialrepl.ai to request deletion of their data; we will respond within 30 days.

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data to another service
• Objection: Object to certain processing of your information

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

8.1 California residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the following rights regarding their personal information:

• Right to know: Request disclosure of the categories and specific pieces of personal information we collect, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: We do not use or disclose sensitive personal information for purposes other than providing the Service.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise these rights, email support@socialrepl.ai. We will respond within 45 days of receiving a verifiable request. You may also designate an authorized agent to make a request on your behalf.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using our Service, you consent to the transfer of your information to these countries.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Tennyson Labs LLC
SocialRepl.ai
Email: support@socialrepl.ai
Website: https://www.socialrepl.ai