ReplyFast privacy notice (draft)

Status: draft template for pilots. Not legal advice. Review before publishing and before the first live pilot.

Controller: Finan Weldemikael trading as ReplyFast (working name), London, UK. Contact: [add email before go-live].

Last updated: 12 October 2026.

What ReplyFast does

ReplyFast helps UK tradespeople respond when they miss a call or get a website enquiry. When a caller or enquirer contacts a client business, ReplyFast can send an automatic text in that business's name, flag urgent jobs to the trade, and keep a simple callback list.

Whose data we process

Clients (the tradesperson or firm using ReplyFast): name, business name, phone, email, billing details, setup notes.
Callers and website enquirers (people who contact a client): phone number, name if provided, message content, time of contact, urgency category we infer from the text, and SMS delivery status.

For callers and enquirers, the client is usually the controller. ReplyFast acts as their processor under a short data-processing clause in the terms.

Why we process it (UK GDPR)

Purpose	Lawful basis (typical)
Send the missed-call or enquiry auto-reply SMS	Legitimate interests of the client (responding to someone who just contacted them) / steps needed to provide the service
Flag emergencies and keep a callback list for the client	Contract with the client / legitimate interests
Account, billing, support	Contract / legitimate interests
Security, abuse prevention, logs	Legitimate interests
Legal and ICO obligations	Legal obligation

We do not sell personal data. We do not use caller data for ReplyFast's own marketing.

SMS and PECR

Auto-replies are service messages to someone who just called or submitted an enquiry. Each SMS identifies the client business and includes Reply STOP to opt out. Opt-outs are honoured for that client number.

Cold marketing texts or emails to sole traders are not part of this product without prior consent.

What we store and for how long

Lead records (phone, message, urgency, status): kept while the client account is active, then deleted or anonymised within 90 days of account closure unless the client asks for an earlier export/delete.
SMS provider logs (e.g. Twilio): subject to that provider's retention; we keep only what we need for delivery proof and support (typically up to 12 months).
Server and access logs: typically 30–90 days.

Who we share with

SMS / voice provider (planned: Twilio) to deliver texts and receive webhooks.
Hosting (Hetzner Cloud or successor) where the app runs.
Payment provider (Stripe or bank transfer) for client billing only.
Professional advisers or authorities if required by law.

Providers are under contract. We do not share caller lists with other trades or advertisers.

International transfers

Hosting is intended in the EEA/UK. If a provider processes data outside the UK/EEA, we use an appropriate safeguard (e.g. UK IDTA / SCCs) where required.

Your rights

Under UK GDPR you can ask for access, correction, erasure, restriction, objection, and data portability where applicable. Contact the email above. You can complain to the ICO.

Callers should usually contact the trade they rang first; we will help that client respond to rights requests that involve our systems.

Security

Access to the server and admin surfaces is restricted (SSH keys, secrets in env, firewall). The service is currently operated in dry-run until Twilio credentials and a live domain are approved. No method is perfect; report issues promptly.

Children

ReplyFast is for business use. We do not knowingly target under-18s.

Changes

We will update this notice when the product or providers change and note the date above.