Privacy Policy

Reeply is a WhatsApp customer support and sales platform operated by Mudarie LLC, a company based in Dubai, United Arab Emirates. This policy covers our website and the Reeply platform.

There are two very different groups of people in this policy, and the difference matters:

• Our customers — the businesses that use Reeply, and the people on their teams. For their data, we are the controller: we decide how it is used.
• Their customers — the people who message those businesses on WhatsApp. For their data, we are the processor: the business is the controller, and we act on its instructions. If you messaged a business on WhatsApp and want your data removed, contact that business first; we will help them do it.

From people who ask us for a demo

• What you type into the form — your name, work email and company, and optionally a phone number, your team size and whatever you tell us in the message box. You do not need an account to send this, and we ask for nothing else.
• We use it to contact you about a demo and for nothing else. It is not added to a marketing list, not sold, and not shared with anyone outside Mudarie LLC — apart from the email provider that carries our notification to our own inbox. We keep it while we are talking to you and delete it on request; see section 10.

From the people who use Reeply

• Account details — name, email address, and optionally a phone number and nationality, which we ask for during onboarding.
• Business details — company name, size, industry, trade licence number, region, business phone and WhatsApp numbers, and a named contact person.
• Security data — sign-in codes, two-factor authentication secrets and backup codes, and, for each session, the IP address and browser user-agent it was created from.
• Content you upload — knowledge-base documents, property listings and images, and your workspace logo.
• Usage counts — how many AI operations and messages your workspace has used in the current month, so we can apply your plan limits.
• Billing details — your plan, your billing status and method, and identifiers linking your workspace to its record with our payment processor. When you pay by card, the processor handles your card details; we do not see or store the card number, and your invoices are held by the processor.

From WhatsApp end-customers

When someone messages a business using Reeply, we store, on that business’s behalf:

• Their WhatsApp phone number, and their WhatsApp profile name if they have shared one.
• The full content of the messages exchanged, in both directions, along with timestamps and the detected language of the conversation.
• A lead profile inferred by AI — buy or rent intent, property type, preferred location, a budget range, and a purchase timeline. Please note: this is derived from the conversation by a language model, not collected from a form. See section 5.
• Viewing requests, including a preferred time and any notes.

We do not collect an end-customer’s email address, home address, date of birth, or any identity-document number as structured data. But message bodies are stored in full, so anything a person chooses to type into WhatsApp is stored.

Automatically

Our servers keep operational logs. As a matter of policy and engineering practice, those logs record metadata only — identifiers, counts, and message lengths — and never message bodies or customer phone numbers. Production is configured to refuse to log message content.

• To provide the platform: delivering, storing, and displaying WhatsApp conversations.
• To generate AI replies from the documents a business has uploaded, and to qualify leads (section 5).
• To authenticate you, and to keep your account secure.
• To apply your plan’s usage limits, and to invoice you.
• To provide support when you ask for it.
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To comply with our legal obligations.

We do not sell personal data. We do not rent or share it for advertising. We do not build advertising profiles, and we run no advertising or tracking technology of any kind.

Reeply connects to WhatsApp through the Meta WhatsApp Business Cloud API. When a business connects its number, we store the phone number ID, the WhatsApp Business Account ID, and an access token issued by Meta. That token is encrypted before it is written to our database, is never displayed back in the interface, and is never written to logs.

Messages travel through Meta’s infrastructure to reach us, and Meta processes them under its own terms and privacy policy. Inbound messages are delivered to us by a webhook, and we verify the cryptographic signature on every one before we accept it.

Our use of the WhatsApp platform is governed by Meta’s platform policies.

Reeply is an AI product, so we want to be specific about what leaves our servers rather than hide behind the word “AI”. We use third-party AI providers, and that means some of your content is sent to them.

We describe those providers by role rather than by name, because we may change them as the technology moves. That is not a way of avoiding the question: we will tell you who they currently are if you ask — write to contact@mudarie.com — and we will not add a new one without updating this policy first. What we send them, described below, does not change when the provider does.

Answering questions from your documents

When the assistant answers a customer, the customer’s question is sent to our search-indexing provider to be converted into a search vector, and the question together with up to eight excerpts from the relevant business’s own documents is sent to our AI provider to generate the reply. The customer’s phone number and name are not included in what we send.

Automatic AI replies are off by default. A business has to turn them on.

Lead qualification

To build the lead profile described in section 2, we send the recent conversation transcript — up to the last 40 messages, in full, in both directions — to our AI provider, together with the lead profile built so far.

You should assume that any personal detail a customer types into a WhatsApp conversation is included in that transcript. We do not strip or mask personal data before sending it.

Like automatic replies, lead qualification is off by default. A business has to turn it on — during setup or later in Settings → AI behaviour. Until it does, no conversation is ever sent for qualification — not the transcript, not a summary, nothing. If you are a business and a customer objects to their messages being processed this way, you can turn it off and it stops.

Documents you upload

The full text of every document uploaded to a knowledge base, and the text of every property listing, is sent to our search-indexing provider to be converted into search vectors. Do not upload documents containing personal data you would not want processed this way.

What our AI providers may not do

We do not train any AI model on your content, your customers’ messages, or your documents. We use our providers’ business APIs, under terms in which they commit not to train their models on what is submitted through them. We rely on those commitments, and we will not engage a provider that does not make them.

Guardrails

• The assistant answers from a business’s own documents. Retrieval is filtered by business at the database level, so one business’s documents cannot reach another business’s AI conversation.
• Customer messages and document excerpts are always passed to the model as data, never as instructions, and the model is instructed to ignore any instruction found inside them.
• The model never decides who is allowed to see what. Every permission check happens in our backend.
• Bookings and viewings require a human on the business’s team to approve them.

We share personal data only with the service providers we need in order to run the platform, and only so that they can perform that role for us. They act on our instructions, they may not use your data for their own purposes, and we remain responsible to you for what they do with it.

• The WhatsApp platform — to deliver and receive messages. This one is not interchangeable: Reeply is built on WhatsApp, and section 4 explains what that means for your data.
• AI providers — to generate replies and, if you have turned it on, to qualify leads. Section 5 sets out exactly what is sent.
• A search-indexing provider — to turn your documents, listings, and customers’ questions into search vectors.
• A payment processor — to collect subscription fees and handle card payments and invoices. It receives your billing contact and workspace identifiers; when you pay by card, your card details go straight to it and we never see them.
• Hosting and storage providers — who run the servers, database, and file storage the platform operates on.
• A sign-in provider — only if you choose to sign in with a third-party account rather than an emailed code.

We name the providers by role rather than by company, because we may replace them. If you want to know who they are today — and you are entitled to — write to contact@mudarie.com and we will tell you. We will update this policy before a new provider starts processing your data.

That list is exhaustive. There is nobody else. We do not share personal data with advertisers, data brokers, marketing networks, or commercial partners of any kind, because we have none and we are not building any.

We may also disclose data where we are legally required to, to enforce our terms, or in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.

Our own staff can see workspace and billing information in order to run the business. They cannot read your customers’ messages, contacts, or leads from our internal tooling — the database itself blocks that access, not merely the user interface.

We are based in the UAE, but our service providers are not all located here. In particular the WhatsApp platform, our AI and search-indexing providers, our payment processor, and our hosting and storage providers process data outside the UAE, including in the United States. Personal data processed through Reeply will therefore be transferred outside the UAE.

We do not currently guarantee that data is stored in any particular country or region. If data residency is a requirement for your business, talk to us at contact@mudarie.com before you onboard.

These are the protections that are actually in place:

• No passwords. Sign-in is by one-time code sent to your email, or by Google. There is no password to steal or reuse.
• Two-factor authentication is required for workspace owners and for all of our own staff, and available to everyone else.
• Database-enforced isolation between businesses. Row-level security in the database means one business’s conversations, contacts, leads and documents cannot be read from another’s context — even by our own staff, and even if application code had a bug.
• Encrypted WhatsApp credentials. Meta access tokens are encrypted at rest with AES-256-GCM.
• Verified webhooks. Every inbound message is signature-checked, using a constant-time comparison, before it is accepted.
• Rate limiting on sign-in, one-time codes, and two-factor verification, to blunt brute-force and enumeration attacks.
• Encryption in transit (TLS) everywhere, and sessions that expire after 24 hours.
• Logs that exclude content. Message bodies and customer phone numbers are never written to our logs.

To be straight with you about the limits: beyond the encryption our database and storage providers apply to their disks, we do not separately encrypt individual message bodies, contact names, or lead records inside the database. Only WhatsApp access tokens get application-level encryption.

No system is perfectly secure. We cannot guarantee the security of data transmitted over the internet, and we do not promise that the platform will never be breached. If a breach affects your data, we will notify you and the relevant authority as the law requires.

We keep workspace data for as long as the workspace is open, and for as long as we need it to provide the service, resolve disputes, and meet our legal and accounting obligations.

We do not run an automatic deletion schedule, and that is a deliberate choice rather than an oversight. A conversation with a customer is the business’s record of that customer: what they were looking for, what they could spend, what they were told, what was agreed. A lead that goes quiet for a year and comes back is a lead the business needs its history for. Deleting that history on a timer would quietly destroy the thing our customers use Reeply to build.

So conversations, contacts, messages and leads are kept for the life of the workspace, and they are deleted when someone decides to delete them — not on a clock we set. There are two ways to do that, both in the product:

• Erase one customer. An owner or admin can open a conversation in the inbox and erase that customer from the contact panel. It deletes the contact and every conversation, message, lead and viewing request we hold for them, immediately and permanently.
• Erase the whole workspace. The workspace owner can do this from Settings → Your data. The workspace locks straight away — nobody can sign in and we stop storing incoming messages — and after 30 days our staff permanently destroy it, including its stored files. You can ask us to cancel it during those 30 days; after that there is nothing left to restore.

Keeping history does not override your right to be erased. If you messaged a business on WhatsApp and you want your data gone, the business can erase you with the first control above — completely, and on the day you ask. That a business finds your history useful is not a reason for it to keep you against your wishes. Ask them; if you would rather come to us, write to contact@mudarie.com and we will take it up with them.

When an erasure runs we keep a record that it happened: how much was destroyed, who did it, and when. For an erased customer, that record refers to them only by a one-way reference — never by their phone number — so it cannot be used to identify them again. We keep it because we may need to show that we honoured the request. Backups may take up to a further 90 days to cycle out.

One exception: we keep a security audit log of administrative actions taken on accounts (for example, a change of plan or a suspension), including who did it and when. These records are retained after an account is deleted, because their whole purpose is to survive it. They contain staff identities and account names — not customer messages.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, other data protection law, you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Have inaccurate data corrected.
• Ask us to delete your data.
• Ask us to restrict or stop a particular kind of processing.
• Receive your data in a portable, machine-readable format.
• Object to processing, including automated processing.
• Withdraw consent, where our processing relies on consent.
• Complain to the UAE Data Office.

To exercise any of these, write to contact@mudarie.com. We will verify who you are before we act — we are not going to hand over or delete data on the say-so of an unverified email — and we will respond within 30 days.

If you are a WhatsApp end-customer rather than one of our account holders, the business you messaged is the controller of your data. Please ask them — they can erase you from Reeply themselves, and it takes them a few clicks. If you contact us directly, we will pass your request to them and support them in carrying it out.

On automated processing specifically: the lead profile described in section 5 is generated by an AI model. It informs how a business follows up with you; it is not used to make any decision with a legal effect, and a human at the business sees every conversation. You may ask for a lead profile to be corrected or deleted.

We use strictly necessary cookies only. There is no advertising pixel and no third-party tracker anywhere on this site or in the product — not Google Analytics, not a Meta pixel, nothing. Nobody outside Reeply is sent anything about your visit.

We do count visits to our three public pages — this page, the home page and the terms — and we do it ourselves, on our own servers, storing the counts in our own database. There is no tracking script in the page, so there is nothing here for an ad blocker to block and nothing that runs in your browser. For each visit we record the page, the day, where you arrived from (the referring website’s name only, never the full address, so a search you ran elsewhere never reaches us) and, if you followed one of our campaign links, which campaign it was.

To count people rather than page loads we need to tell one visitor from another, and we do that without setting a cookie. Your IP address and browser version are combined with a secret and today’s date, and turned into a one-way fingerprint. Neither your IP address nor your browser version is ever stored. The fingerprint is deliberately useless tomorrow: the date is part of it, so the same visit made today and again next week produces two unrelated values with nothing linking them. That is a real limitation and not a rounding error — we genuinely cannot tell a returning visitor from a new one, and our own numbers overstate visitor counts because of it. We would rather have that than a durable identifier for you.

None of this applies to the signed-in product or to WhatsApp conversations, which are never counted this way. The cookies we set are:

• A session cookie, so you stay signed in. It is HttpOnly and signed, and expires after 24 hours.
• A short-lived two-factor challenge cookie while you are completing a second-factor check.
• If you choose to trust a device, a trusted-device cookie lasting 30 days, so you are not asked for a code every time.
• Short-lived sign-in cookies during a Google sign-in, to protect the flow against interception.

The product also remembers small display preferences — your light or dark theme, and your inbox layout — in your browser’s local storage. That never reaches our servers.

Because these cookies are all strictly necessary for the service to function, blocking them will stop you from signing in.

Reeply is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, write to contact@mudarie.com and we will delete it.

We may update this policy. If a change materially affects how we handle personal data, we will notify account holders by email or through the product before it takes effect. The date at the top of this page always shows when it last changed.

For any privacy question, or to exercise a right under section 10, contact our privacy team: