FirstReplyAI Privacy Policy

Prepared: 26 October 2026 · Version: 2026-10-26-4

ABN: 63 382 118 963. Main business location: Queensland 4011, Australia. Effective date: 26 October 2026.

Privacy contact: support@firstreplyai.net

1. Scope

This policy explains how FirstReplyAI, the business identified by the ABN shown above, handles personal information in operating https://firstreplyai.net, customer workspaces, document processing, public demonstrations, support and the API. It applies to information about account holders and, where their organisations use our Service, people whose information appears in supplied material or questions.

Our obligations depend on the privacy laws that apply to our activities. This policy does not assert that a small-business exemption always applies, or that a customer can waive applicable privacy rights by accepting our terms. An organisation using our Service must provide its own appropriate notices and permissions to its staff and end users.

2. Information handled

We handle information you or an authorised organisation supplies, and information generated through operating the Service, including:

• Account email, verification status, business name, assistant settings and support contact.
• Uploaded or imported document text, website content, approved answers, extracted image descriptions and associated source/processing metadata. Documents and questions may contain personal information supplied by the customer.
• Questions, responses and conversation context used to generate answers and maintain an active conversation.
• Workspace/key identifiers, token counts, request and processing records, plan usage, operational error events and security information.
• Subscription, payment status, invoices, transaction references and billing events received from Stripe. Payment-card details are entered through Stripe; the application is not designed to collect or store the complete card number or card security code.
• Proportionate trial-abuse signals, including a normalised email identity hash, a hash derived from a Stripe card fingerprint, and hashed network identifiers. A hash can still be personal information when it can be linked to a person or account; it is not necessarily anonymous.
• Support correspondence and information voluntarily supplied to investigate an issue.
• Records of agreement to the Terms and acknowledgement of this policy, including the document version and integrity hashes, agreement time, linked workspace identifier and verification context. Signup agreements are attributed after email verification. An existing customer may expressly agree from a verified signed-in account; the record then identifies that account-review context and the time its session was checked. Publication or signing in alone is not recorded as agreement.
• Necessary session and security cookies, public-demo rate-limit identifiers and basic first-party event counters such as demo use, signup, verification and first setup milestones.

Our database stores hashed authentication tokens and integration-key verification values. Treat the original sign-in links and API keys as secrets; do not send them to support. Infrastructure and security services may also process connection information such as IP addresses and request metadata.

3. Purposes and collection

We use information to authenticate accounts, provide workspaces and answers, process and retrieve documents, manage subscriptions, enforce allowances, detect abuse, troubleshoot failures, deliver requested account messages and support, understand basic service usage and comply with legal obligations.

We usually collect account information directly from you, content from the person or organisation submitting it, and operational information through use of the Service. If essential information is withheld, we may be unable to create an account, provide an answer, take payment or investigate a request. Please minimise personal information in documents and questions and avoid unnecessary secrets or sensitive information.

We do not make uploaded private customer documents available as another customer's private workspace knowledge. Your organisation may choose to expose selected information or generated responses through its own assistant or integration. It controls that intended disclosure to its end users.

4. AI processing, images and public search

To generate an answer, the Service may send a question, relevant conversation context, assistant configuration and selected source passages to its configured AI inference provider. Document/image processing may send image or page content to the configured vision provider. The Service may use more than one model for retrieval planning, response generation or evidence review.

Where your organisation has enabled web search, the Service may send a query to its configured search provider and read public webpages or linked documents. The software filters certain recognisable secrets, contact details and private-account requests from search queries, but you should not rely on that filtering as a complete redaction system. A public-web mode can reach sources beyond the domains imported into the workspace.

FirstReplyAI does not train or fine-tune its own general-purpose AI models using your workspace content. Our current AI and image-processing endpoint is provided by Baseten. Baseten's published Security Practices describe no model training on Customer Content and zero persistent retention of inputs and outputs for its Model APIs, subject to the stated configuration and other exceptions. Those provider terms do not mean FirstReplyAI deletes stored documents, account records or usage metadata, or that every provider has the same practices. We do not promise zero retention across the Service.

Our current optional search provider is Tavily. Its published Privacy Policy permits retention of query information and, unless otherwise agreed, use of some query data to improve future responses. Queries can also be shared with search-index providers. Do not include confidential or sensitive personal information in questions that require public search. Your organisation can ask us to disable web search for its workspace. Imported private documents are not uploaded wholesale to Tavily by the search feature, but a generated query can contain details from the conversation.

FirstReplyAI generates support responses and uses automated security, quota and trial-eligibility checks. Shared-network trial signals are flagged for review rather than automatically blocking a trial. Contact support if an account or eligibility decision appears wrong. The Service is not intended, without a separate assessment and agreement, to make autonomous decisions significantly affecting an individual's rights or interests. Customers planning such a use must contact us first so applicable notice, assessment and oversight requirements can be addressed.

5. Service providers, access and overseas processing

We may disclose information to providers reasonably needed for hosting, security, payment, email, AI inference, image processing and public search; authorised staff or contractors providing support or security; professional advisers; and authorities where lawfully required. Authorised operators may access workspace content when reasonably needed for support, maintenance, security or legal compliance. Access must be limited to the legitimate purpose.

The current service providers and processing arrangements are:

Information is processed outside Australia. The application database and indexed documents are stored on our Google Cloud VM in the United States. Tavily is US based. Cloudflare describes primary storage in the United States and European Economic Area and access through its global operations. Baseten, Google and Stripe also use international infrastructure or service providers. These arrangements do not provide an Australian-only storage or processing commitment, and the VM's location does not fix every provider's processing location. Countries for a particular provider operation can vary; contact support@firstreplyai.net for information about your proposed use before submitting material with residency restrictions. Any safeguards or accountability required by applicable privacy law continue to apply.

Provider information is available in the Google Cloud Privacy Notice and its linked customer data-processing terms, Baseten Data Processing Agreement, Cloudflare Privacy Policy, Stripe Privacy Policy and Tavily Privacy Policy. Those notices explain the providers' own handling; they do not replace our responsibilities to you or guarantee that every provider feature described there is enabled here.

We do not sell private workspace content for advertising. A proposed business sale or transfer may involve appropriate due diligence and transfer subject to applicable law, confidentiality and reasonable privacy protections; it does not permit unrestricted public disclosure of customer documents.

6. Retention, deletion and backups

Uploaded/imported document content, extracted text and image descriptions, approved answers and settings are stored in the application database on Google Cloud. They remain available until an authorised person removes them, replaces them or deletes the workspace. Cancelling a paid subscription does not itself delete stored documents. We do not currently apply a fixed automatic document-expiry period.

The standard chat flow uses temporary conversation caches in server memory rather than a permanent transcript archive in the application database. Cache cleanup considers conversations inactive after approximately 30 minutes when subsequent requests trigger cleanup; memory limits, service restarts and access changes can clear them sooner. This is not a guaranteed deletion deadline for every copy: a user's browser or integration, support correspondence, diagnostic records and external providers can hold information separately.

Account, usage, token-count, payment, import-processing and security records are also stored; storage is not limited to documents. We have no single fixed retention period or automatic deletion deadline covering all of those records. Some records are cleaned up during normal activity, while others remain until account deletion or an appropriate manual cleanup. Expired authentication credentials cannot be used, but expiry does not itself physically delete every corresponding database record.

You can remove documents using the workspace controls. After cancellation/reconciliation of an active paid subscription, the account-deletion control removes active workspace documents, settings and account access. The current implementation retains some records, including unusable key/customer tombstones and trial-abuse prevention records; legal, payment, support, infrastructure and provider records may also remain where justified. Stripe and other providers can hold their own records under their legal obligations and applicable arrangements.

There is no fixed FirstReplyAI-wide expiry schedule for backup copies, service logs or support correspondence. Copies made for maintenance or recovery can contain information already removed from the active database, and deleting an active document does not automatically erase every copy. Log rotation depends on server settings and storage limits. We do not promise a specific backup-deletion deadline or immediate erasure from all systems. If a restoration brings back previously deleted data, contact support so we can investigate and arrange appropriate removal. Infrastructure and other providers can also retain records under their own applicable terms and legal obligations.

Contact support@firstreplyai.net for deletion or retention questions, including copies outside the active workspace. We may verify authority and identity, explain records we must or may lawfully retain, and arrange deletion or de-identification where appropriate or legally required. The absence of a fixed schedule does not authorise indefinite retention regardless of need: applicable requirements to remove or de-identify information that is no longer needed still apply. Necessary billing, dispute, security and legal records may have a different retention period from documents.

7. Cookies, communications and security

The Service uses a host-only account-session cookie and request-security controls. The website remembers a chosen billing interval in local browser storage; the integration-key access option can hold a supplied key in browser session storage. Its first-party conversion counters record event counts and hashed account-linked setup milestones, rather than supplied document or chat content. Related abuse controls use hashed network identifiers. The current application pages do not include third-party advertising pixels or Google Analytics scripts. Cloudflare and externally opened services such as Stripe checkout may process connection information and use their own security cookies or storage under their applicable notices. Browser settings can clear local storage and cookies; blocking necessary session cookies prevents account sign-in.

We send account verification, security, billing and requested support messages needed to operate the Service. Trial setup reminders have an account preference to turn them off. Any separate marketing must comply with applicable consent, identification and unsubscribe requirements; agreeing to service terms is not blanket consent to unrelated marketing.

We take reasonable steps to protect personal information through access controls, credential protection and appropriate operational measures. No internet service can guarantee absolute security. Tell us promptly about suspected unauthorised access. We will assess incidents and provide notifications or remedies where required by applicable law. This section is not a promise of certifications, encryption-at-rest coverage or security features that have not been verified.

8. Access, correction and complaints

Contact support@firstreplyai.net to request access to, correction of or deletion of personal information, ask about overseas recipients, or complain about handling of information. We may need proportionate evidence of identity or authority. We will explain an applicable refusal or restriction and available complaint avenues rather than assume every request can be fulfilled without exceptions.

We aim to acknowledge a privacy complaint within five business days and provide a substantive response within 30 calendar days, or explain a reasonable need for more time. If the Australian Privacy Act applies and you remain dissatisfied, you may be able to complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints. Other applicable rights and regulators are not excluded.

9. Policy updates

We will publish a version and effective date for updates and give reasonable notice of material changes where appropriate or required. A revised notice does not retrospectively authorise an unrelated use or disclosure. If a change needs consent or another lawful basis, we must obtain or establish it before carrying out that processing.

Privacy contact: support@firstreplyai.net