Privacy policy
Updated on 13 November 2026
This policy explains what personal data Replivo processes, why, on what legal basis, who receives it and what rights you have. Replivo is a live chat service: businesses (“customers”) add it to their websites to talk to their visitors.
1. Who is responsible
For the data of customer accounts and of this website, the controller is the operator of the Replivo platform. For conversations between a business and the visitors of its website, that business is the controller and Replivo acts as its processor, under the data processing terms in our Terms of use. We have not appointed a data protection officer; privacy questions reach us at info@replivochat.com.
2. What we process, why and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Agent account: name, email, password (stored hashed), role | Creating and securing the account, signing in | Performance of the contract |
| Conversations, files, tickets; the visitor's name and email when given | Delivering messages between the business and its visitors | Processed on the business's instructions (the business determines its own basis) |
| Visit data: page address and title, browser and device type, time, an anonymous identifier | Showing the business who is on its site, continuing a conversation when the visitor returns | The business's instructions; for our own security and abuse prevention, our legitimate interest |
| Rating (1–5) after a conversation | Service quality statistics for the business | The business's instructions |
| Invoices and payment records | Billing and accounting | Contract and legal obligation |
| Email address for service messages (welcome, verification, password reset, invoices) | Running the account | Performance of the contract |
| Technical logs, rate limits, reCAPTCHA signals | Protecting the platform from abuse | Legitimate interest in a secure service |
Account data is required to provide the service: without it an account cannot be created. Visitors are never obliged to give their name or email in the chat, unless the business asks for them before a conversation. We do not use personal data for advertising, we do not sell it, and we make no decisions about people by automated means.
3. Storage in the browser
Replivo does not use advertising or analytics cookies. It stores a small amount of information in the browser that the service needs to work: the sign-in session, the chosen language, and, in the chat window, an anonymous identifier so a conversation continues when the visitor returns. A business can switch its chat window to a mode where nothing is stored until the visitor opens the chat. Google reCAPTCHA, used to block automated abuse, may set its own cookies.
4. Who receives the data
- The business you are talking to — its agents see the conversation and the visit data described above.
- Google Firebase / Google Cloud — sign-in, databases, files and server functions.
- Google reCAPTCHA — verifies that requests come from a real browser.
- Vercel — serves the website and the chat window's files.
- Resend — delivers account emails.
We tell customers before adding or replacing a provider that processes conversation data.
5. Transfers outside the country
Conversations are stored in data centres in the European Union. Some providers process limited data elsewhere, mainly in the United States: sign-in records, email delivery, website delivery and reCAPTCHA. These transfers rely on the safeguards those providers offer, such as standard contractual clauses or an equivalent recognised mechanism. Ask us for details at the address above.
6. How long we keep it
- Conversations, tickets and files: while the business's account is active, or until the business deletes them or asks us to.
- Live presence: removed as soon as the visitor leaves the page.
- Account data: until the account is closed, then deleted within a reasonable period unless law requires longer.
- Invoices: for the period accounting law requires.
- Email log and abuse counters: up to 90 days.
7. Your rights
You may ask for access to your data, a copy of it, correction, deletion, restriction of processing, or object to processing based on legitimate interest. Where processing relies on consent you may withdraw it at any time. If you are a visitor of a website that uses Replivo, contact that business first; we help it answer you. To exercise a right with us, write to info@replivochat.com; we reply within one month. You may also complain to the data protection authority; in Albania this is the Information and Data Protection Commissioner.
8. Security
Access is enforced on the server: agents see only their own business's data, and a visitor only their own conversation. Communication is encrypted in transit (HTTPS) and data is encrypted at rest by our infrastructure provider. API keys are never exposed to browsers.
9. Children
The service is intended for businesses and is not directed at children.
10. Changes
We update this policy when the service changes. The date at the top shows the latest version; we notify customers of material changes.