Privacy Policy

Last updated: 21 October 2026

ReplyBox is operated by UTOPIA ACCELERATOR SDN BHD (“ReplyBox”, “we”, “us”, or “our”). We provide a multi-tenant shared inbox that lets teams receive and reply to messages from channels such as WhatsApp. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have. It applies to the ReplyBox web application and related services (collectively, the “Service”).

By using the Service you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect the following categories of information:

  • Account information. Your name, email address, hashed password, organization details, and role assignments when you register or are invited to a workspace.
  • Messaging content. Messages, attachments, contact names and phone numbers, and related metadata exchanged through connected channels (for example, WhatsApp conversations) so they can be displayed and managed in your shared inbox.
  • Channel connection data. Encrypted session credentials required to keep your messaging channel connected. These are stored in encrypted form and are used solely to operate the channel on your behalf.
  • Usage and technical data. Log data, IP address, browser and device information, and diagnostic information used to operate, secure, and improve the Service.

2. How We Use Information

We use the information we collect to:

  • Provide, maintain, and operate the shared inbox and its features.
  • Deliver, route, and synchronize messages between your team and connected channels such as WhatsApp.
  • Authenticate users and enforce role-based access controls.
  • Secure the Service, prevent abuse, and troubleshoot issues.
  • Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use the content of your messages for advertising.

3. WhatsApp and Third-Party Platforms

When you connect a WhatsApp account, your use of WhatsApp is also governed by WhatsApp’s and Meta’s own terms and privacy policies. Message content is transmitted through WhatsApp’s infrastructure to enable delivery. We access this data only to provide the Service to you and in accordance with the applicable platform terms and developer policies.

4. Google User Data

ReplyBox offers two optional Google features. We request only the access each one needs.

  • Sign in with Google. We receive your name, email address, and profile picture from Google to create or sign in to your ReplyBox account.
  • Google Calendar. A workspace admin may connect one Google account so that Message Flows can offer appointment times and book them. With that permission we:
    • read free/busy times only on the connected calendar, to work out which slots are open. We do not read the titles, descriptions, or guests of your existing events;
    • create a booking event with a Google Meet link when a customer picks a time. The event holds the customer’s name, phone number, and the email address they gave, and Google sends that address the invitation;
    • store the connected account’s email address and a refresh token, encrypted at rest, so bookings keep working. We keep the booking’s time and event ID with the flow run.

Google user data is used only to provide these features to your workspace. We do not sell it, use it for advertising, or use it to train artificial-intelligence models, and people cannot read it except where you ask us for support, where needed for security, or where the law requires.

AI features. The Google Calendar steps do not use AI. The messages a flow sends from them (the offered times, the booked time and the Meet link) become part of the WhatsApp conversation, and ReplyBox’s optional AI features, such as reply drafts and the Message Flow AI step, may process that conversation text to answer. These features currently use Anthropic (Claude) and OpenAI (ChatGPT/Codex) models, with model training turned off on every account we use. We never use Google user data, whether raw, aggregated, anonymised or derived, to create, train or improve generalised or foundational AI or machine-learning models, and we never transfer it to a service that would.

An admin can disconnect Google Calendar at any time in Settings → Integrations. We then delete the stored token and revoke our access at Google. You can also remove ReplyBox’s access from your Google Account’s security settings.

ReplyBox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

5. How We Share Information

We share information only in the following circumstances:

  • Within your organization. Members of your workspace can access conversations and data according to their assigned roles and permissions.
  • Service providers. Trusted infrastructure and processing partners (for example, cloud hosting, database, and storage providers) who process data on our behalf under confidentiality obligations.
  • Legal reasons. When required by law, regulation, legal process, or to protect the rights, property, or safety of ReplyBox, our users, or others.

6. Data Storage and Security

We implement technical and organizational measures designed to protect your information. Passwords are stored using one-way hashing, channel session credentials are encrypted at rest, and access to data is tenant-isolated so each organization can only access its own data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account or organization is active or as needed to provide the Service. We will delete or anonymize information when it is no longer required, unless a longer retention period is required or permitted by law.

8. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. You may also request deletion of your account and associated data at any time.

9. Children's Privacy

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. International Data Transfers

Your information may be processed and stored in countries other than your own. Where required, we take steps to ensure that appropriate safeguards are in place for such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at accelerator.utopia@gmail.com.