1Who the controller is and what this covers
The data controller is Go&Reply, with details at the end of this document. The policy covers the goandreply.com site, the web application and the processing of data that arrives from the social networks you connect.
2What data we process
The list is closed: everything that enters the system is named below. Social network passwords, one time codes and bank card details are not part of it.
- Account data: your email address, your name if you provided it, and your password as an irreversible hash, or a Google identifier when signing in with Google
- Access to connected networks: the access token issued by the network, or your own Telegram account session over the MTProto protocol; all stored encrypted
- The content of incoming items: the text of private messages, comments, mentions, story replies and reviews, the author name, avatar, identifier and time, within the permissions you granted
- Created material: drafts and sent replies, post copy, generated images and video
- Subscription data: the plan, the payment status and the payment identifiers at the payment provider
- Technical data: the connection address, browser details, request logs and interface events
3Why, and on what legal basis
The data is processed to deliver the service itself: show incoming items in one inbox, score them, prepare and send a reply, publish content and calculate reports. The legal basis is the performance of our contract with you.
Connecting each social network happens with your separate consent, which can be withdrawn at any time by disconnecting the network. Technical logs and abuse protection rely on our legitimate interest in keeping the service secure. Accounting records for payments are kept to comply with the law.
4Social network data and platform rules
Data obtained through Instagram, Facebook, Threads and WhatsApp Business is processed in accordance with the Meta platform terms and developer policies. YouTube data is processed under the Google services rules, TikTok and X data under their platform rules.
Telegram is connected as a session of your own account over the MTProto protocol rather than through a separate bot, so the inbox receives the chats, groups and comments that this account can see. That is why we recommend connecting a work account. The session is visible in Telegram settings and can be closed there.
5Google user data (YouTube and Google sign-in)
When you sign in with Google or connect a YouTube channel, Go&Reply receives data from Google APIs only within the permissions you approve on the Google consent screen. Connecting YouTube is optional, and you can disconnect it at any time.
We use Google user data only to provide and improve the user-facing features described above. We do not sell it, we do not use it for advertising, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models. The text of a comment may be sent to our artificial intelligence providers solely to detect its intent and prepare a reply draft for you; they process it on our instructions and may not use it to train their models.
People at Go&Reply do not read your Google user data, except with your explicit permission for a specific support request, when necessary for security purposes such as investigating abuse, or to comply with the law.
Google access tokens are stored encrypted and transmitted only over encrypted connections. When you disconnect YouTube in Go&Reply, the token is deleted immediately; you can also revoke access at any time at https://myaccount.google.com/permissions. Synced comments and other data are deleted together with the workspace or the account, on request, as described in the retention section and on the data deletion page.
- Your Google account email address (userinfo.email): to identify which Google account the connected channel belongs to and to show it in your settings
- YouTube channel and video data and the comments on your videos (youtube.force-ssl): to show incoming comments in your inbox, to post the replies you write or approve, and to show your videos and their statistics in the dashboard
- Uploading videos (youtube.upload): to publish to your channel only the videos you create or schedule in Go&Reply, at the time you choose
- Google sign-in: your email address, name and Google identifier, to create your Go&Reply account and sign you in
6Who the data is shared with
We do not sell personal data and we do not hand conversations to advertising networks. Only the processors the service cannot run without are involved, and each of them handles data under contract and on our instructions.
- Artificial intelligence providers: they receive the text of an item to detect the intent and prepare a draft reply; using that data to train shared models is prohibited by contract
- The payment provider: it processes the payment and keeps card details on its own side, reporting only the subscription status to us
- Hosting and infrastructure: running the application and the database
- The email service: sign in letters, payment notices and system notifications
7How the data is protected
Connections run only over a secure channel, tokens and content are stored encrypted, and the password for our own service is kept as an irreversible hash. Workspaces are isolated, access for a member of your team follows their role, and automated actions are written to a log.
Our staff do not read your conversations as part of normal work. If a support case needs access we ask for permission, and the access itself is recorded.
8How long we keep the data
Account data and workspace content are kept while the account exists: without the conversation history neither an operator nor the autopilot can answer with context. The token of a connected network is deleted the moment that network is disconnected.
After a deletion request the content disappears from the interface at once, and backups are overwritten within 30 days. Only the accounting records for payments required by law live longer, and they contain no conversations.
9Your rights
You can request a copy of your data, correct it, restrict the processing, withdraw the consent for a connected network and demand deletion. Requests are accepted at privacy@goandreply.com from the account email, with an answer within 30 days.
If our answer does not satisfy you, you have the right to complain to the data protection authority of your country. Withdrawing consent does not make unlawful the processing already carried out before the withdrawal.
10Age of users
The service is built for business and is not intended for children. We do not knowingly collect data of persons under 16; if such data reached us, write to us and we will delete it.
11Changes to this policy
We update this document when the product or the platform requirements change, and the update date is shown at the top. Material changes are announced to the account email in advance.
12How to reach us
Questions about this document, deletion requests and data subject requests are accepted by email. We answer within 30 days, usually sooner.
Service operator: Go&Reply, Calle Armiche 13, Arona, Santa Cruz de Tenerife (Islas Canarias), 38652, Spain.