Privacy Policy

Rspond is operated by PT Baitech Inovasi Digital ("Rspond", "we", "us"), a company incorporated in Indonesia, which runs the messaging platform available at rspond.id. For businesses that connect a channel to Rspond, we act as a service provider (processor) that handles their customer conversations on their behalf and at their direction.

Contact: support@rspond.id.

Account & workspace data: your name, email, workspace name, team members and their roles.

Conversation data from connected channels: messages your customers send to your connected WhatsApp, Instagram, Telegram, or Web Chat, together with contact identifiers (e.g., phone number, username, display name), timestamps, and attachments, plus the replies sent by your bots/AI agent or human agents.

Customer contact details your team adds: names, phone numbers, email addresses, tags, and internal notes — typed in the Contacts menu or imported from a CSV file you upload.

Business content you add: chatbot flows, AI-agent instructions, uploaded knowledge-base documents, product catalog, and message templates.

Billing data: subscription and payment records. Card/bank details are handled by our payment provider (DOKU) and are not stored by Rspond.

Usage & technical data: log data, feature usage, quota counters, and information needed to keep the service secure and reliable — including technical error reports (see section 6) and, if two-step verification is on, one-time sign-in codes (stored only as a hash and valid for 10 minutes).

Customer satisfaction ratings: if a workspace turns on the chat survey, the rating (1–5) and optional comment a customer sends after a conversation.

To provide the service: receive incoming messages, route them to your chatbot/AI agent, show them in your shared inbox, and send replies to your customers.

To generate AI replies: message content may be processed by AI providers to produce automated responses and to search your knowledge base.

To operate billing, send you service notifications, enforce quotas, and secure and improve the platform.

Integrations you set up: when a workspace owner or admin creates an API key or a webhook, we send the workspace's data (for example messages, contacts, orders, tickets) to the systems they choose — such as their POS, Google Sheets, or Zapier. Those systems are controlled by the business, not by Rspond.

We do not sell your data, and we do not use your customers' message content for advertising.

When you connect a WhatsApp Business number or an Instagram Business account, Rspond receives and sends messages on your behalf solely to provide your shared inbox and automated replies.

We use this data only to operate the service for the business that connected the account. We handle Meta Platform data in accordance with the Meta Platform Terms and Developer Policies, and we do not share it with unauthorized third parties or use it for purposes other than providing the messaging service.

The Rspond app lets your team handle conversations from a phone. You sign in with the same Rspond account; your sign-in session is kept in the device's secure storage (iOS Keychain / Android Keystore) and removed when you sign out.

Push notifications: if you allow notifications, we store a push token for your device together with the platform (iOS or Android), the device name, the app version, and your app language, so we can alert you about handoffs, assigned chats, new customer messages, closing reply windows, and tickets. Notification content is delivered through Expo's push service, Apple Push Notification service, and Google Firebase Cloud Messaging. We also keep your notification preferences (which alerts you want, quiet hours and time zone, and whether message previews appear on the lock screen) and a 60-day in-app activity list.

Camera & photos: the app asks for camera or photo-library access only when you choose to send a photo to a customer. Only the photo you pick is resized and uploaded to that conversation; the app does not read the rest of your library.

Activity status: while the app is open we record when you were last active, so assignments and notifications work correctly — for example, the app stays quiet while you are active on the web dashboard.

The app does not collect your location or contacts, does not include advertising or third-party tracking SDKs, and does not track you across other apps or websites.

You can turn notifications off at any time in the app or in your phone settings. Signing out removes the device's push token; deleting your account removes your devices, preferences, and activity list.

We rely on trusted providers to run Rspond, including: Supabase (database & authentication), Vercel (hosting), Anthropic and OpenAI (AI generation and embeddings), DOKU (payments), Resend (transactional email), Telnyx (voice telephony), OCR.space (reading text from scanned documents you upload to a knowledge base), Meta (WhatsApp/Instagram messaging), Telegram (Telegram messaging), Expo, Apple, and Google (push notifications for the mobile app), and Sentry (technical error reports from the website and app — without message content, passwords, or tokens).

These providers process data only as needed to deliver their part of the service and under their own terms and security commitments.

We keep conversation data for as long as needed to provide the service. Older conversations and orphaned contacts are automatically purged after a configurable retention period.

You can request earlier deletion at any time — see our Data Deletion page (/data-deletion).

Channel credentials (such as access tokens) are stored encrypted and are never exposed to the browser. Access to each workspace's data is isolated at the database level.

No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

You can access and update your account and workspace information from within the app, disconnect any channel at any time, and request deletion of your data.

To delete your data, follow the steps on our Data Deletion page (/data-deletion) or email support@rspond.id.

Where Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) applies, you have the rights it grants to data subjects — including to obtain information about, access, correct, restrict, and delete your personal data and to withdraw consent. We respond to such requests within the periods the law requires.

Data may be processed in countries where we or our providers operate, with appropriate safeguards.

Rspond is a business tool and is not directed to children.

We may update this policy from time to time; material changes will be reflected on this page with a new "last updated" date.

Questions about this policy? Email support@rspond.id.