Privacy Policy

GO & REPLY Privacy Policy: how we store and process data, OAuth tokens, and how to delete your account.

GO & REPLY Privacy Policy

Data controller: GO & REPLY, registered at Calle Armiche 13, Arona, Santa Cruz de Tenerife (Islas Canarias), 38652, Spain. Contact: support@goandreply.com (privacy: privacy@goandreply.com).

GO & REPLY is an AI social-media assistant that provides a smart inbox, comment management, an AI autopilot and analytics for creators across Instagram, TikTok, X (Twitter), YouTube, Telegram, Facebook, Threads and WhatsApp Business.

Data we collect

Account data: email, name if provided, password stored as a bcrypt hash, or Google ID when signing in with Google.
Connected social accounts: OAuth access and refresh tokens stored encrypted, account identifiers, display name and avatar provided by each platform.
Content from connected accounts: text of direct messages, comments and chats, author name, avatar, identifier and timestamp, received only under the permissions you grant.
Subscription and payment data: plan, subscription status and Stripe identifiers. Card details are processed and stored solely by Stripe; we never receive or store them.
Technical data: IP address, user agent, API request logs and telemetry events.

Why we process it

To provide and operate the service you request, to authenticate you, to process payments, and to keep the service secure. Legal bases: performance of a contract, your consent for connecting a social network via OAuth and processing its data which you can withdraw at any time, and our legitimate interests.

Instagram and Meta data

Data obtained through Instagram and other Meta platforms is used only to deliver the features you enable, such as reading and replying to direct messages and comments and publishing posts you create. We handle it in accordance with the Meta Platform Terms and Developer Policies.

Sharing

We share data with AI providers for message analysis and content generation, with Stripe for payments, and with our hosting and email providers, strictly to operate the service. We do not sell personal data.

Retention

Account data is kept while the account is active. After account deletion the data is soft-deleted for 30 days and then permanently erased. Disconnecting a social network revokes its tokens and deletes the associated messages within 30 days. Accounting records are kept as required by law, typically 5 to 7 years.

Your rights

Under the GDPR and applicable law you can access, rectify, erase, restrict and port your data, and object to processing. To exercise these rights or withdraw consent, email support@goandreply.com; we respond within 30 days.

The complete, localized privacy policy is displayed on this page in full once loaded.