Privacy Policy

Effective date: August 15, 2026 · Last updated: August 15, 2026

This Privacy Policy (this “Policy”) describes how OkReply (“OkReply,” “we,” “us,” or “our”) collects, uses, discloses, retains, and otherwise processes personal information in connection with the OkReply website located at okreply.ai (the “Site”), the OkReply web application, and the related messaging-automation, scheduling, and conversation-management services we provide (collectively, the “Service”). It also describes the rights and choices available to you with respect to your personal information and how you may contact us about our privacy practices.

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you should not access or use the Service. This Policy does not apply to any third-party websites, applications, or services that we do not own or control, including the Facebook and Facebook Marketplace platforms operated by Meta Platforms, Inc. (see Section 13).

1. Definitions

For purposes of this Policy, the following terms have the meanings set forth below:

“Account” means the registered account through which a Seller accesses the Service.

“Buyer” means an individual who communicates with a Seller through an online marketplace in connection with a listing managed through the Service, and whose messages, identifiers, or related information are processed by the Service on behalf of the Seller.

“Conversation Data” means the contents of marketplace message threads processed through the Service, including message text, sender designations, timestamps, associated listing details, and any information contained within such messages (which may include names, addresses, telephone numbers, or other information a Buyer chooses to include).

“Personal Information” means any information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person, and includes “personal data” as defined under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and “personal information” as defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”).

“Seller” or “you” means the individual who registers for and uses the Service to manage marketplace communications, scheduling, and related activities.

“Subprocessor” means a third-party service provider engaged by OkReply to process Personal Information on OkReply’s behalf in connection with the operation of the Service.

2. Scope; Our Role in Processing

2.1 Scope. This Policy applies to Personal Information we process in connection with: (a) visitors to the Site; (b) Sellers who register for, sign in to, or use the Service; and (c) Buyers and other third parties whose information is contained in Conversation Data processed through the Service.

2.2 OkReply as Controller. With respect to Personal Information of Site visitors and Sellers — including Account registration data, authentication data, and usage of the Service — OkReply determines the purposes and means of processing and acts as a “controller” (or the equivalent role, such as a “business” under the CCPA) with respect to that information.

2.3 OkReply as Processor of Buyer Data. With respect to Conversation Data and other Personal Information relating to Buyers, OkReply processes such information on behalf of and at the direction of the applicable Seller in order to provide the Service. In that context, the Seller is responsible for the lawfulness of the collection and sharing of such information, and OkReply acts as a “processor” or “service provider.” Section 12 contains additional terms relating to Buyer information.

3. Personal Information We Collect

3.1 Information You Provide Directly

• Account and registration data. When you create an Account, we collect your email address and a password. If you elect to register or sign in using Google single sign-on, we receive your name, email address, and associated Google account identifier from Google in accordance with your Google account settings. We also store a display name and, where provided or detected, your timezone.
• Authentication and verification data. We process email-verification codes, verification status, and related security metadata in connection with confirming ownership of your email address and securing your Account.
• Service content. We collect and store the content you create, upload, configure, or manage within the Service, including listing titles and prices, reply text you compose or approve, booking and test drive details (including dates, times, prices, notes, and addresses), weekly availability rules, and dated availability overrides (including any free-text reasons you provide).
• Communications with us. If you contact us directly (for example, by email), we collect the contents of your communication and any contact information you provide.

3.2 Information Processed on Your Behalf (Buyer and Conversation Data)

In order to provide the Service’s core functionality — responding to marketplace inquiries, scheduling test drives, and filtering unqualified leads — we process and store Conversation Data and related information originating from your marketplace account, which may include:

• Buyer display names, abbreviated names, profile photographs, and platform-assigned identifiers;
• the contents of messages exchanged between you (or the Service acting on your behalf) and Buyers, including any Personal Information a Buyer includes in a message;
• listing information associated with a conversation, including listing titles, descriptions, prices, images, condition, approximate location, and platform URLs;
• scheduling information, including proposed and confirmed test drive dates, times, and addresses; and
• conversation-state information maintained by the Service, such as thread status, follow-up state, and do-not-contact designations.

3.3 Information Collected Automatically

• Authentication cookies and session data. We use first-party cookies to establish and maintain your authenticated session and to route you appropriately within the Service, as described in Section 7.
• Technical and log information. Our hosting and infrastructure providers may automatically record standard technical information when you access the Service, such as IP address, browser type and version, device and operating system information, request timestamps, and the pages or endpoints accessed. This information is used for security, debugging, and operation of the Service.
• Operational configuration data. Where the Service’s automation features are enabled for your Account, we store operational settings associated with your connected marketplace account, which may include a display name, browser and locale configuration values, and activity timestamps used to operate the automation reliably.

3.4 Information from Third-Party Sources

If you sign in with Google, we receive Personal Information from Google as described in Section 3.1. Where you connect the Service to a marketplace platform, we receive Conversation Data and listing information from that platform environment as described in Section 3.2. We do not purchase Personal Information from data brokers.

3.5 Information We Do Not Collect

We do not knowingly collect payment card information (the Service does not process payments), government-issued identifiers, precise geolocation derived from device sensors (addresses appear only as free-text entries you provide in your account settings, in bookings, and in listings), or biometric information. We do not use third-party advertising or analytics trackers on the Service.

4. Purposes of Processing; Legal Bases

4.1 Purposes. We process Personal Information for the following purposes:

1. to provide, operate, and maintain the Service, including generating suggested or automated replies to Buyer messages, extracting and surfacing Buyer questions, scheduling and managing test drives, and maintaining your calendar and availability;
2. to create, authenticate, and secure your Account, including verifying your email address and maintaining your signed-in session;
3. to send transactional communications, such as email-verification codes; we do not send marketing or promotional email;
4. to monitor, troubleshoot, debug, and improve the Service, and to develop new features and functionality;
5. to detect, investigate, and prevent fraudulent, abusive, unauthorized, or illegal activity, and to enforce our agreements;
6. to comply with applicable law, regulation, legal process, or governmental request; and
7. to establish, exercise, or defend legal claims, and to protect the rights, property, or safety of OkReply, our users, or others.

4.2 Legal Bases (EEA, UK, and Similar Jurisdictions). Where the GDPR or similar law applies, we rely on the following legal bases:

5. Artificial Intelligence and Automated Processing

5.1 AI-Assisted Replies. The Service uses large language model technology provided by our Subprocessor Anthropic, PBC to analyze Conversation Data and associated listing details and to generate suggested or automated replies, scheduling proposals, and related determinations (for example, whether an inquiry appears to be an unqualified lead). Conversation Data submitted to this Subprocessor is used solely to provide the Service and is processed under contractual terms that prohibit its use for the Subprocessor’s own purposes, including model training on our API data.

5.2 Human Oversight. The Service is designed so that you retain control over automated activity, including the ability to review pending questions, compose or edit replies, enable or disable automated operation for your Account, and reschedule or cancel bookings. Automated replies and scheduling actions are performed on your behalf and under your instructions.

5.3 No Legal or Similarly Significant Effects. We do not use Personal Information to make automated decisions that produce legal effects concerning you or that similarly significantly affect you within the meaning of Article 22 of the GDPR.

6. How We Disclose Personal Information

6.1 No Sale of Personal Information. We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding twelve (12) months.

6.2 Subprocessors and Service Providers. We disclose Personal Information to the following categories of Subprocessors, which are contractually restricted from using it other than to provide services to us:

6.3 Legal and Protective Disclosures. We may disclose Personal Information where we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or a governmental request; (b) enforce our agreements and policies; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of OkReply, our users, or the public.

6.4 Business Transfers. If OkReply is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, Personal Information may be transferred as part of that transaction, subject to this Policy or a successor policy providing no less protection, and subject to any notice required by applicable law.

6.5 With Your Direction. Replies, scheduling proposals, and other content generated or sent through the Service are transmitted to the applicable marketplace platform and to Buyers on your behalf and at your direction.

7. Cookies and Similar Technologies

7.1 Cookies We Use. The Service uses only first-party cookies that are strictly necessary or serve limited functional purposes:

7.2 No Tracking Technologies. We do not use third-party advertising cookies, analytics cookies, pixels, or other cross-site tracking technologies on the Service.

7.3 Your Choices. Most browsers allow you to refuse or delete cookies through their settings. Because the cookies we use are necessary for authentication and core functionality, disabling them may prevent you from signing in to or using portions of the Service.

8. Data Retention

8.1 General. We retain Personal Information for as long as reasonably necessary to fulfill the purposes described in this Policy, including for as long as your Account remains active, and thereafter as necessary to comply with legal obligations, resolve disputes, enforce agreements, and maintain appropriate business records.

8.2 Criteria. In determining retention periods, we consider: (a) the nature and sensitivity of the information; (b) the purposes for which it is processed; (c) applicable legal, accounting, or reporting requirements; and (d) whether the purposes can be achieved through retention of less information or for a shorter period.

8.3 Deletion. Upon deletion of your Account, or upon a verified deletion request under Section 11, we will delete or de-identify Personal Information associated with your Account within a reasonable period, except where retention is required or permitted by law. Residual copies may persist for a limited period in encrypted backups maintained by our infrastructure providers before being overwritten in the ordinary course.

9. Data Security

We implement and maintain administrative, technical, and organizational measures designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the nature of the information and the risks presented by our processing. These measures include encryption of data in transit; hashed and salted storage of passwords; database-level access controls (including row-level security) that restrict each Account’s data to its owner; segregation of privileged credentials to server-side environments; and rate limiting of authentication operations. Notwithstanding the foregoing, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying us promptly of any suspected unauthorized access to your Account.

10. International Data Transfers

We and our Subprocessors may store and process Personal Information in the United States and in other jurisdictions that may not provide the same level of data protection as your home jurisdiction. Where we transfer Personal Information originating from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that has not received an adequacy determination, we implement appropriate safeguards recognized under applicable law, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary measures as appropriate. You may contact us as set forth in Section 18 for further information regarding the safeguards applicable to a particular transfer.

11. Your Privacy Rights and Choices

11.1 Rights Available to All Users

Regardless of your location, you may: (a) access and update certain Account information from within the Service; (b) request a copy of the Personal Information we hold about you; (c) request correction of inaccurate Personal Information; and (d) request deletion of your Account and associated Personal Information, in each case by contacting us as set forth in Section 18.

11.2 European Economic Area, United Kingdom, and Switzerland

Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, you have the right, subject to conditions and exceptions under applicable law, to: (a) request access to your Personal Information; (b) request rectification of inaccurate or incomplete Personal Information; (c) request erasure of your Personal Information; (d) request restriction of processing; (e) object to processing based on legitimate interests; (f) receive your Personal Information in a structured, commonly used, machine-readable format and transmit it to another controller (data portability); and (g) withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority in the member state of your habitual residence, place of work, or place of an alleged infringement.

11.3 California

If you are a California resident, the CCPA provides you, subject to certain exceptions, with the right to: (a) know the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties to whom Personal Information is disclosed; (b) request deletion of Personal Information we have collected from you; (c) request correction of inaccurate Personal Information; and (d) not receive discriminatory treatment for exercising your rights. As stated in Section 6.1, we do not sell Personal Information and do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the Personal Information of consumers under sixteen (16) years of age; accordingly, we do not offer an opt-out because there is no sale or sharing to opt out of. We do not use or disclose sensitive personal information for purposes requiring a right to limit under the CCPA. The categories of Personal Information we collect are described in Section 3, the purposes in Section 4, and the categories of recipients in Section 6.

11.4 Exercising Your Rights

You may exercise the rights described in this Section 11 by contacting us as set forth in Section 18. We will verify your request using the email address associated with your Account or such other information as is reasonably necessary to confirm your identity, and we will respond within the time period required by applicable law. Where permitted, you may designate an authorized agent to submit a request on your behalf, provided the agent supplies evidence of authorization and we are able to verify your identity. We will not discriminate against you for exercising any of your privacy rights.

11.5 Requests Relating to Buyer Information

Because we process Buyer information on behalf of Sellers (Section 2.3), if we receive a rights request from a Buyer, we may redirect the request to, or notify, the applicable Seller, and we will provide reasonable assistance to the Seller in responding, consistent with our role as a processor or service provider and with applicable law.

12. Information Relating to Buyers and Other Third Parties

12.1 Seller Responsibilities. The Service processes Conversation Data that contains Personal Information relating to Buyers and potentially other third parties. As between you and OkReply, you are responsible for: (a) ensuring that you have a lawful basis and all rights, consents, and permissions necessary to collect, share, and instruct the processing of such information through the Service; (b) complying with all laws applicable to your use of the Service, including privacy, consumer-protection, and electronic-communications laws; and (c) complying with the terms of service of any marketplace platform on which you use the Service.

12.2 Our Commitments. With respect to Buyer information, we: (a) process it solely to provide the Service to the applicable Seller and for no other purpose; (b) do not sell it or use it for advertising; (c) apply the same security measures described in Section 9; and (d) impose written obligations on Subprocessors that receive it consistent with our role as processor or service provider.

13. Third-Party Platforms and Links

The Service interoperates with third-party marketplace platforms, including Facebook Marketplace, and may contain links to third-party websites or services. Such platforms and services are governed by their own privacy policies and terms, which we do not control and for which we are not responsible. Information you or Buyers submit directly to a marketplace platform is collected by that platform under its own policies, independent of this Policy. We encourage you to review the privacy policies of any third-party platform or service that you use.

14. Children’s Privacy

The Service is intended for use by adults and is not directed to children under the age of sixteen (16) (or such higher age of consent as applies in your jurisdiction). We do not knowingly collect Personal Information from children. If you believe that a child has provided Personal Information to us, please contact us as set forth in Section 18, and we will take reasonable steps to delete such information promptly.

15. Do Not Track Signals

Some browsers transmit “Do Not Track” (“DNT”) signals. Because there is not yet a common industry standard for recognizing and implementing DNT signals, the Service does not currently respond to them. As described in Section 7, we do not engage in cross-site tracking irrespective of any DNT setting.

16. Changes to This Policy

We may amend this Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will provide notice as required by applicable law, such as by email to the address associated with your Account or by prominent notice within the Service, prior to the change becoming effective. The “Last updated” date at the top of this Policy indicates when it was most recently revised. Your continued use of the Service after the effective date of a revised Policy constitutes your acknowledgment of the revised Policy.

17. Text Messages and Mobile Information

If you choose to add and verify a mobile telephone number on your Account, we send you automated text messages about your own Account activity, and you may reply to them. Participation is optional and is not a condition of purchasing any product or service from us. The terms of that program, including how to opt in, how often messages are sent, and how to stop them, are set out in our Text Messaging Terms.

We do not sell, rent, or share mobile telephone numbers or text messaging consent with third parties or affiliates for their own marketing or promotional purposes. We disclose your mobile number to the telecommunications provider that transmits the messages on our behalf, solely so that it can deliver them, and otherwise only as described in Section 6. You may withdraw consent at any time by replying STOP to any message or by removing the number from your Account, and we delete the number from your Account when you remove it.

18. How to Contact Us

If you have questions, concerns, or complaints regarding this Policy or our processing of Personal Information, or if you wish to exercise any of the rights described in Section 11, please contact us at:

OkReply — Privacy
Email: privacy@okreply.ai
Website: okreply.ai

We will endeavor to respond to all legitimate inquiries within the time periods required by applicable law. If you are located in the EEA or the United Kingdom and are dissatisfied with our response, you may lodge a complaint with your local data protection authority.