Privacy policy
This policy explains how Fareply handles personal data. Fareply is operated by Fayanka Tech Addons (OPC) Private Limited (CIN U74999JK2022OPC013763), registered office 9 Chadoora, PO PS Chadoora Masjid Sharief, Budgam, Jammu and Kashmir 191113, India ("we", "us"). Questions and requests: [email protected].
1. Two different roles
- Our customers' users (people at travel agencies who sign in to Fareply): for their account, billing and usage data, we decide how the data is used. Under the GDPR we are the controller; under India's Digital Personal Data Protection Act 2023 (DPDP Act) we are the data fiduciary.
- Travellers who write to an agency through WhatsApp, Instagram, Messenger, WeChat or a website chat that uses Fareply: the agency decides why and how their messages are handled. We process that data only on the agency's instructions, as its processor. Travellers should contact the agency first; we will help the agency answer.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account data | Name, email address, agency name, role | To create and secure your account and sign you in with one-time email links (no passwords) |
| Agency content | Tour catalogs, price tables, policies you upload or approve | To provide the service |
| Traveller messages (processor role) | WhatsApp number or WhatsApp username identifier; the Instagram or Messenger identifier that Meta assigns for the agency's account, with name and username; the WeChat OpenID for the agency's Official Account; email address if given in the website chat; for the website chat, the address path and title of the page the traveller wrote from (without query strings); photos and PDF files sent in the website chat (photos are re-saved without their hidden metadata, such as location); a satisfaction rating and comment, if the traveller gives one; message text; delivery and read status | To show conversations to the agency, draft replies and deliver the agency's replies, including one email with a reply the traveller has not seen when they left an email address and the agency uses this option |
| Billing data | Plan, invoices, billing country | To charge for the service. Card details are handled by our payment provider Paddle, not by us |
| Security and technical data | Server logs with IP address, browser type, time; audit log of actions in the dashboard | To keep the service secure, prevent abuse and fix problems |
We do not sell personal data and do not use it for advertising. The audit log records actions (for example "reply sent") but never the text of messages or travellers' phone numbers.
3. Legal bases
Under the GDPR and the UK GDPR we rely on: performance of our contract with the agency (Art. 6(1)(b)); our legitimate interests in securing and improving the service (Art. 6(1)(f)); and legal obligations such as tax records (Art. 6(1)(c)). Under the DPDP Act we process account data for the specified purpose you gave it for and for the legitimate uses the Act allows; under Turkey's Law No. 6698 (KVKK) we rely on the conditions in its Article 5, such as performance of a contract and legitimate interest. For traveller data, the agency is responsible for having a legal basis and for informing travellers.
4. How the AI features work
- To read catalogs and draft replies, relevant text (catalog content, the conversation, approved policies) is sent to
our AI provider, OpenAI. Under OpenAI's API terms, data sent through the API is not used to train its models unless
the customer opts in (we do not), and it may be kept for up to 30 days for abuse monitoring. We ask OpenAI not to
store responses (
store=false). - Voice messages from travellers are sent to OpenAI to be written out as text, unless the agency switches this off. Fareply keeps only the text, like a typed message; the audio itself is not stored.
- Prices in replies come only from price tables the agency approved. The AI never decides a price.
- By default replies are drafts that a person at the agency reviews and sends. An agency can choose to send price quotes, answers from its approved policies and requests for missing details automatically; these replies say that an AI assistant wrote them. Bookings, discounts, complaints and unclear requests always go to a person. We make no decisions about travellers that have legal or similarly significant effects.
- We do not use customer content or traveller messages to train any AI model.
5. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Our servers | Application and database hosting | Germany (production), the Netherlands (testing and encrypted backups) |
| Our mail server | Our company email (for example privacy@ and support@) and this website | Finland |
| Cloudflare, Inc. | Network security, content delivery, DNS | Global network |
| OpenAI | AI catalog reading, reply drafting and writing out voice messages | United States |
| Meta Platforms (WhatsApp Business Platform, Messenger Platform, Instagram messaging) | Receiving and sending WhatsApp, Messenger and Instagram messages for agencies that connect those accounts | Global |
| Tencent (WeChat Official Accounts Platform) | Receiving and sending WeChat messages for agencies that connect a WeChat Official Account | China and global |
| Resend | Sending sign-in emails; receiving and sending email for agencies that connect their mailbox | United States |
| Paddle | Payments, invoicing and tax, as merchant of record | United Kingdom and global |
We will update this list before adding a new provider. Where data leaves the European Economic Area, the UK or another country that restricts transfers, we rely on adequacy decisions or standard contractual clauses and the providers' own safeguards. When an agency connects WeChat, messages from travellers in mainland China are processed on our servers outside China; the agency is responsible for the notices and consents China's Personal Information Protection Law requires for that transfer, and we support it with our Data Processing Addendum.
6. Cookies and similar technology
- The Fareply dashboard uses one strictly necessary cookie to keep you signed in. No analytics or advertising cookies.
- The website chat stores a random identifier in the visitor's browser so the conversation continues across pages. We keep only a one-way hash of it. It is not used for tracking or advertising.
- This website (fareply.com) sets no cookies.
7. How long we keep data
- Account and agency content: while the account is active, then deleted within 30 days after the account is closed, except invoices and records we must keep by law (normally up to 8 years for tax).
- Traveller conversations: as long as the agency keeps them, and in any case deleted within 30 days after the agency's account is closed. Agencies will be able to set automatic deletion after a period they choose.
- Server and security logs: kept only as long as needed for security and troubleshooting, normally no longer than 30 days.
- Encrypted database backups: kept in rotation for up to 6 months, then overwritten. Data deleted from the service disappears from backups as they rotate.
8. Security
Traffic is encrypted in transit (TLS). Each agency's data is separated in the database with row-level security, so one agency cannot read another's data even through a software error in the application. Sign-in links are single use and expire after 15 minutes; only hashes of tokens are stored. Access to servers is restricted to key-based login. No system is perfectly secure; if a breach affects your data we will inform you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict processing, withdraw consent, and nominate someone to exercise your rights (DPDP Act). Write to [email protected]. We answer within 30 days and may need to confirm your identity. Travellers' requests about agency conversations are passed to the agency, which decides as controller.
You can also complain to a data protection authority, for example the authority in your EU country, the UK Information Commissioner's Office, the Data Protection Board of India, or Turkey's Personal Data Protection Authority. Our grievance contact under Indian law is our privacy team at [email protected].
10. Children
Fareply is a business service and is not meant for people under 18. Agencies must not use it to target children.
11. Changes
If we change this policy in a way that matters, we will tell account owners by email at least 30 days before the change takes effect. The date at the top shows the current version.