Privacy Policy

Last updated: 12 October 2026.

This policy explains how NextReply ("NextReply", "we", "us") collects, uses, shares and protects personal data. NextReply is operated by Meridian Digital, Business Bay, Dubai, United Arab Emirates. The policy covers our marketing website at nextreply.io, our application at app.nextreply.io, and the AI receptionist service that answers WhatsApp messages for the businesses that subscribe to it. If we add other messaging channels in future, such as Instagram, Facebook Messenger or Telegram, which are coming soon, we will update this policy before they go live.

We have written it in plain language. If anything is unclear, email hello@nextreply.io or use our contact page.

When we act as controller. For data about our own customers (the businesses that sign up), visitors to our website, and people who contact us, we decide why and how the data is used. In those cases we are the controller.

When we act as processor. When a business uses NextReply to talk to its own customers, the business decides why those conversations happen and what happens to them. The business is the controller and we process the conversation data on its behalf and on its instructions. If you messaged a business that uses NextReply and want to exercise your privacy rights, please contact that business first. We will help it respond.

We do not sell personal data.

To reply to a customer, NextReply's AI reads the incoming message (and, for voice notes and photos, interprets the audio or image), combines it with the business's own configuration, and generates a reply or a booking. The AI is designed to stay on the business's topics and to hand conversations to the business's staff when needed, in line with WhatsApp's Business Solution Terms.

The AI does not make decisions that have legal or similarly significant effects on individuals. A business can review conversations and take over at any time. Businesses should not use NextReply to collect more sensitive data than a booking requires; for clinics, the AI books and answers logistics and does not give medical advice.

If a business connects Google Calendar, we access calendar data only to read availability and create, update or cancel the appointments booked through NextReply. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. A business can disconnect Google Calendar at any time from its Google account settings or from NextReply. Google's documentation on the Calendar API explains how this access works.

Opt-in campaigns, such as feedback requests and event updates, and appointment reminders are coming soon. On WhatsApp these messages use templates approved by Meta, and businesses must have the customer's permission before sending them. We record consent where it is collected through a NextReply conversation, and we honour opt-out requests such as "stop" by flagging them to the business. Businesses remain responsible for having a lawful basis for any message they choose to send and for respecting WhatsApp's rules.

We share personal data only as needed to run the service, with:

• Messaging platforms: Meta, which operates WhatsApp, to send and receive messages. Meta's own terms and privacy policy apply to its processing.
• Google: for calendar sync when a business connects it.
• Infrastructure providers: hosting, database, AI processing, email delivery, payments and error monitoring, under contracts that restrict their use of data.
• Integrations a business turns on: for example CRM, Zapier, Make, HubSpot or Google Sheets on the Business plan. Data goes where the business sends it.
• Authorities: where the law requires it, or to protect rights and safety.

An up-to-date list of our subprocessors is available on request from hello@nextreply.io.

We are based in the UAE and some of our providers operate in other countries. Where personal data moves across borders, we use appropriate safeguards required by the applicable law, such as standard contractual clauses for transfers from the European Economic Area or the UK, and the transfer conditions of the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

• Conversation and booking data: for as long as the business keeps its account, unless the business deletes it earlier, then deleted or anonymised within a reasonable period after the account closes.
• Account and billing records: for the life of the account and as long as tax and accounting laws require afterwards.
• Website logs and analytics: for a limited period needed for security and statistics.

We use technical and organisational measures appropriate to the data, including encryption in transit, access controls based on role, logging and regular review of who can reach production systems. No system is perfectly secure; if a breach affects personal data, we will notify affected businesses and, where required, regulators, within the time limits the law sets.

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data-protection authority. These rights come from laws including the EU General Data Protection Regulation, the UK GDPR, the UAE Personal Data Protection Law, and US state laws such as the California Consumer Privacy Act as amended.

To exercise a right, contact us. If your request is about conversations with a business that uses NextReply, we will pass it to that business, which decides how to respond as controller. We will not discriminate against you for exercising your rights.

Children. NextReply is a business service and is not directed at children. Businesses that serve minors, such as tutoring centres, should make sure parents or guardians handle bookings where the law requires it.

Cookies. Our website uses essential cookies to work, and analytics cookies only where you allow them. You can change your choice in your browser or our cookie banner.

Changes. We will update this policy when our practices change and show the new date at the top. For significant changes we will notify subscribing businesses by email.

Questions, requests or complaints about privacy: email hello@nextreply.io with "Privacy" in the subject line, or use the contact page. Our postal location is Meridian Digital, Business Bay, Dubai, United Arab Emirates. You can learn more about what the service does on our features page, how bookings work on the appointment booking page, which channels are live on the channels overview, and what each plan includes on the pricing page. Return to the home page.