Legal
Privacy Policy
CasaReply (“we”, “us”) gives a business an AI assistant that answers its customers on WhatsApp. This policy explains what we process, why, and what you can ask us to do about it. We collect only what the service needs, and we never sell data.
Last updated September 23, 2026
Two kinds of data, and who controls them
Your account and your business information are yours, and we process them to provide the service to you.
Your customers’ messages are different. When someone messages your WhatsApp number, you decide why you hold that conversation and what you do with it; we process it on your instructions in order to run the assistant and show you the conversation. Put plainly: you are responsible for your customers’ data, and we handle it for you.
What we collect
- Account details you give us: your name, email address, and your business’s name and contact details.
- The business knowledge you add so the assistant can answer: your services, prices, hours, policies, documents and FAQs.
- Conversations on your connected WhatsApp number: the messages themselves, the sender’s WhatsApp number and display name, and what the assistant did with each one.
- Usage and diagnostic records needed to operate the service and investigate faults.
How we use it
To deliver the service you signed up for: generating replies grounded in your own business information, passing a conversation to your team when the assistant should not answer, organising your contacts, and showing you what happened in your dashboard.
To keep the service running and secure, and to answer you when you contact support.
Your business information and your customers’ messages are never used to train shared or third-party models.
Keeping workspaces apart
Every record belongs to exactly one workspace, and the database enforces that rather than the application asking politely. One customer cannot read or write another customer’s conversations, contacts or settings.
Security
Credentials such as WhatsApp access tokens are encrypted before they are stored and are never sent to a browser. Traffic is encrypted in transit. Access to production data is limited to what a task requires. Incoming WhatsApp deliveries are verified as genuinely from Meta before they are accepted.
Who else processes data for us
We use a small number of providers, each only to deliver the service and each bound by its own data-processing terms:
- Vercel: application hosting.
- Supabase: database, authentication and file storage.
- Meta Platforms: the WhatsApp Business Cloud API that carries your messages.
- Google: the language model that generates the assistant’s replies.
- Resend: sending account and invitation emails.
How long we keep it
Conversations, contacts and business information are kept for as long as your workspace is active, because the service exists to show them to you. Raw delivery payloads from WhatsApp are kept only briefly and then discarded. When a workspace is closed we delete its data, except anything we must keep to meet a legal obligation.
Your rights, and how to use them
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to the address below and we will confirm within 30 days. We will ask you to verify that you own the account before acting.
Some of it you can do yourself, without asking: change your name and password, archive a contact, remove someone from your team, disconnect a WhatsApp number, or leave a workspace. There is no self-service export or account deletion today: both are done by contacting us, and we would rather say so than imply a button that does not exist.
If one of your own customers asks you to delete their conversation, contact us and we will carry it out for you.
Changes to this policy
If we change how we handle data in a way that affects you, we will update this page and change the date at the top, and tell account owners before the change takes effect.
Contact
Questions, or a request about your data? Email casareply@gmail.com and a person will answer.