1. Who we are
AckReply is a customer-support platform operated by Bistank Pte. Ltd., a company incorporated in Singapore ("AckReply", "we", "us"). You can reach us about anything in this policy at support@ackreply.com.
2. What this policy covers
This policy applies to the AckReply service, which consists of:
- the public website at ackreply.com;
- the web dashboard at app.ackreply.com, used by businesses and their staff;
- the AckReply chat widget, which businesses embed on their own websites so their visitors can chat with them;
- the AckReply iOS and Android apps, which let staff members reply to conversations and receive notifications on their phones.
In this policy, "account holders" or "staff" means people who sign up for AckReply or are invited to a workspace. "Visitors" means people who chat with a business through an AckReply chat widget.
3. Our role: controller and processor
AckReply is a business-to-business service. Each business that uses AckReply ("customer") sets up a workspace and decides which websites the widget runs on and how conversations are handled.
- For account holder data (for example, your login details), we are the controller.
- For visitor data and conversation content collected through a customer's widget, the customer is the controller and AckReply acts as a processor (service provider) on the customer's behalf, processing that data only to provide the service to them. If you chatted with a business through its widget, that business's own privacy policy governs how it uses your information, and you should contact that business first to exercise your rights. We will help the business respond.
- Where the widget runs on our own website (ackreply.com), we are the controller of that visitor data.
4. Information we collect from account holders
- Account details: your name, email address and password. Passwords are stored only as a one-way hash (Argon2); we never store them in readable form.
- Sign in with Google or Apple: if you use these options, we receive and store the account identifier the provider gives us, together with your name and email address as shared by the provider. If you use Apple's "Hide My Email", we receive the relay address.
- Profile and preferences: an optional profile photo, preferred language, online/offline status, last-seen time, notification settings and, if you enable it, two-factor authentication settings.
- Push notification tokens: when you allow notifications in the iOS or Android app, we store the device token issued by Apple Push Notification service or Firebase Cloud Messaging, the platform and a device name. If you enable browser notifications in the web dashboard, we store the browser push subscription.
- Workspace data: workspace names, websites, team membership and roles, AI settings and instructions, knowledge-base content (articles, Q&A pairs, text snippets and pages imported from your website), saved replies, tags, and the replies and internal notes you write in conversations.
- Billing information: if you buy a paid plan, our payment processor handles your card details. We receive and store subscription status, plan, invoice records and limited payment metadata, but never your full card number.
- Technical and security data: IP address, browser or device type and app version when you use the service, plus error reports and diagnostic logs used to keep the service reliable and secure.
5. Information we process about website visitors
When a visitor opens or uses an AckReply chat widget on a customer's website, we process on the customer's behalf:
- Chat content: the messages a visitor sends, and any files or images they attach.
- Contact details the visitor provides: for example a name or email address, if the visitor enters them or the customer's website passes them to the widget. A visitor who provides an email address may receive email notifications of replies.
- A visitor identifier: a random token stored in the widget's browser storage (localStorage) so the visitor can return to earlier conversations on the same browser.
- Device and browser information: browser and version, operating system, device type, screen resolution, time zone, language and user-agent string.
- IP address and approximate location: the visitor's IP address, and the city, country and approximate coordinates derived from it through an IP-geolocation service. We do not use device GPS.
- Page activity during a visit: the URL and title of the page where the widget is open, pages visited during the session, the landing page, referrer and campaign (UTM) parameters, and session start and end times.
The widget does not use advertising cookies or cross-site tracking identifiers.
6. How we use information
- To provide the service: creating and securing accounts, delivering chat messages in real time, showing conversations and visitor context to the customer's staff, and storing conversation history.
- To generate AI replies, suggestions and staff-only image insights, where the workspace has AI enabled (see section 7).
- To send notifications: push notifications to staff devices, and transactional emails such as verification, password reset, team invitations and reply notifications.
- To process payments and manage subscriptions.
- To keep the service secure and reliable: preventing abuse and fraud, enforcing rate limits, debugging errors and monitoring performance.
- To provide support when you contact us, and to send important service or policy notices.
- To comply with legal obligations and enforce our Terms of Service.
Where the law requires a legal basis, we rely on performing our contract with you or with the customer, our legitimate interests in running a secure and reliable service, your consent where we ask for it (for example, push notifications), and compliance with legal obligations.
7. AI processing of conversations
Conversation content, including images, may be sent to third-party AI model providers. When a workspace has AI enabled, the text of visitor messages, recent conversation history and relevant extracts from the workspace's knowledge base are sent to an AI model provider so it can generate a reply. When a visitor sends an image, the image may be sent to an AI vision model to produce a short description and extract any text in it. These image insights are shown only to the workspace's staff, not to the visitor.
- AI model providers process this data to return a result to us, under their business API terms. We send only what is needed to produce the reply or insight.
- Knowledge-base content is also converted into numerical representations ("embeddings") by an AI provider so relevant answers can be found.
- Each workspace controls AI. Owners and administrators can turn AI replies off for the whole workspace or for individual websites, and staff can pause AI in any conversation to reply personally. When AI is off, messages are not sent to AI model providers to generate replies.
- AI-generated replies can be wrong. Staff can review conversations and take over at any time.
8. Service providers we share data with
We share personal data only with service providers that help us run AckReply, and only as needed for the purposes above:
| Provider type | What they do |
|---|---|
| Hosting and infrastructure | Servers and databases that run the AckReply application and store account and conversation data. |
| Cloudflare | Content delivery, DNS, network security, hosting of ackreply.com, file storage for attachments and images (Cloudflare R2), and delivery of transactional email. |
| AI model providers, such as Microsoft Azure AI and other model-inference providers | Generating AI replies, image insights and knowledge-base embeddings (see section 7). |
| Apple Push Notification service and Firebase Cloud Messaging (Google) | Delivering push notifications to the iOS and Android apps. Browser push notifications are delivered through the browser vendor's push service. |
| Google and Apple | Sign in with Google and Sign in with Apple, if you choose to use them. |
| Payment processor (Stripe) | Processing payments and managing subscriptions for paid plans. |
| IP geolocation service | Converting a visitor's IP address into an approximate city and country. |
| Error monitoring (Sentry) | Collecting crash and error reports, which may include technical data such as IP address, browser and the page where the error happened. |
| Web crawling and search services | Fetching the public pages of a customer's website when the customer asks AckReply to learn from it. |
We may also disclose information if required by law, to protect the rights, property or safety of AckReply, our customers or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred data.
9. No selling, no advertising, no tracking
- We do not sell or rent personal data.
- We do not show ads, and we do not share data with advertising networks or data brokers.
- We do not track you across other companies' apps or websites. The iOS and Android apps contain no advertising or third-party analytics SDKs.
10. International transfers
We are based in Singapore, and our service providers operate in several countries, including the United States. Your information may therefore be processed outside the country where you live. When we transfer personal data, we take steps to ensure it receives a comparable standard of protection, for example through contractual commitments with our providers.
11. How long we keep data
- Account data is kept while your account is active. When you delete your account, it is removed from our live systems immediately (see how account deletion works).
- Workspace and conversation data, including visitor data, is kept for as long as the customer's workspace exists, or until the customer deletes it. Data belonging to a deleted workspace is removed from our live database immediately. Stored attachment files are erased within 30 days of a request to support@ackreply.com.
- Backups: we keep database backups for disaster recovery. Nightly backups are overwritten on a rolling basis and kept for up to 14 days, so deleted data may remain in backups for up to that period before it is permanently erased. We do not restore deleted accounts from backups.
- Billing records may be kept by us or our payment processor for as long as required by tax and accounting law.
- Logs and error reports are kept for a limited time for security and troubleshooting, then deleted.
12. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- correct inaccurate data (you can edit your name and profile in your settings);
- delete your data or your account;
- object to or restrict certain processing, or withdraw consent you gave (for example, by turning off notifications in your device settings);
- complain to your local data protection authority. In Singapore this is the Personal Data Protection Commission.
To make a request, email support@ackreply.com from the email address on your account. We may need to verify your identity, and we aim to respond within 30 days. If you are a visitor and your request concerns a conversation with a business that uses AckReply, please contact that business; if you contact us instead, we will pass your request to them.
13. Deleting your account
You can delete your AckReply account at any time, without contacting us, from Settings → Delete Account in the iOS or Android app, or by emailing support@ackreply.com from your account's email address. Full instructions, including exactly what is deleted and what is kept, are on our account deletion page.
14. Security
We protect data with encryption in transit (HTTPS/TLS) for all connections, hashed passwords, optional two-factor authentication, access controls that limit staff data to members of the same workspace, and secure token storage in the mobile apps (the iOS Keychain and Android encrypted storage). No system is perfectly secure, but we work to protect your information and will notify affected customers and authorities of a data breach where the law requires.
15. Children
AckReply is a business tool and is not directed at children. Account holders must be at least 18 years old (or the age of majority where they live). We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
16. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date above, and if the changes are significant we will notify account holders by email or in the app before they take effect.
17. Contact us
Bistank Pte. Ltd.
Singapore
Email: support@ackreply.com