Built GDPR-first.
ReplyTown is designed around UK GDPR and PECR: explicit consent, data minimisation, and erasure on request, from day one.
- Explicit consent
Opt-in for cookies and SMS, never pre-ticked.
- Data minimisation
Only what the intake flow needs, nothing more.
- Retention limits
Leads archived after 12 months; opt-outs kept forever.
- Right to erasure
Delete a lead and its messages on request.
Our compliance position
ReplyTown is built for the UK market under UK GDPR and PECR. We treat website consent and SMS consent as two separate obligations and keep them separate in code, copy, and documentation.
Website cookies
Cloudflare Web Analytics is cookieless, first-party, and collects no personal data, so it needs no consent banner. The Cloudflare Zaraz Consent Management Platform appears on first visit and gates any consent-required tools by purpose. All purposes are opt-in by default and stored in a first-party cookie for audit.
SMS opt-in
SMS consent is a separate, explicit flow. The first message identifies the business and includes opt-out instructions. Every STOP reply is honoured and logged, and no message is ever sent without a lawful basis, such as a missed call, web lead, or existing customer relationship.
Data handling and AI
We collect only what the intake flow needs and never log full message bodies into generic logs. Gemini receives the minimum lead context and runs under a hard monthly spend cap. OpenRouter free models are never used for personal data.
Security
Clerk protects all dashboard routes, admin-only settings are gated, and provider secrets live only in the environment, never in the repository. Consent records are immutable append-only once written.
Your rights
Under UK GDPR you have the right to access, correct, and erase your data, and to object to processing. Contact us to exercise any of these rights, and we will respond within the statutory period.
Contact
For data requests or compliance questions, contact us.