Privacy policy

Last updated 2026-09-30

Replayfy is operated by APPIFY COMMERCE, Ground Floor, 9 A, Gyaneshwar Park Society, IOC Depot Road, Chenpur Village, Ahmedabad, Gujarat 382470, India. This policy covers two different relationships, and it is worth separating them because our obligations differ.

1. Data we control: our own customers

When you sign up we hold your email address, your name if you give one, your hashed password, your workspace and team membership, your plan and subscription status, and a record of the actions you take in the product. We use it to run your account, to bill you, to answer your support requests, and to send you service messages such as a quota notice. Our lawful basis is the contract between us.

When you start a checkout for a plan we also hold the billing details you give at checkout: your billing country, your state (for Indian customers), your billing address (when you give a GSTIN or are billed outside India) and, if you enter them, your business name and GSTIN. If you are billed outside India and enter no business name, we record the name on your account with them as the buyer's name. We need them for your tax invoice, and they go to our payment processor, Razorpay, as soon as the checkout starts. When you pay, we keep them with our invoice records for the period tax law requires. If you do not pay, we delete them from our own records after 30 days; Razorpay keeps the copy it received.

Pages on replayfy.com, including the dashboard, are counted by Cloudflare Web Analytics, run by our hosting provider: the page address, the referring page, the browser type and how long the page took to load. It sets no cookie, and Cloudflare does not use it to identify or fingerprint anyone.

We also note which link brought you to sign up (for example a campaign tag in the address) and the steps you take from signing up to paying, to understand what works. We keep this for 13 months, set no cookie for it, and never sell it or share it with advertisers.

The dashboard has a support chat, which runs on our own Chatwoot server on Google Cloud and loads only on dashboard pages, never on the public site. When it loads it identifies you to our team by your account email and name, with your workspace id, plan and role, and it keeps what you write in the chat so we can answer you. The chat stores a conversation identifier in your browser so a conversation carries on from page to page.

We do not sell it, do not use it to train models, and do not share it with advertising networks.

2. Data we process on your behalf: your visitors

When you install our recorder on your site, you decide what is recorded and why. In that relationship you are the controller and we are your processor, acting only on your instructions. The terms of that are in our data processing addendum, which forms part of our agreement with you.

What the recorder captures:

• Changes to the page's structure, so the page can be replayed
• The page's text, including text typed into a rich-text editor, unless the site owner has masked or blocked it
• Mouse movement, clicks and scrolling
• The fact that a typed form field changed, with one asterisk for each character — never the characters
• Which checkbox or radio button is ticked, including the option's own value, unless the site owner has blocked that field (an element with data-sr-block or class="sr-block" around it)
• Page addresses, with sensitive parameters replaced before storage
• The referring page, the browser's user-agent string, viewport size, and the country the request came from
• JavaScript error messages (no stack traces)

What it never captures:

• The characters of a value typed or chosen in a text input, text area, dropdown, password, hidden or file field (each becomes an asterisk, so only the length is kept). Checkboxes and radio buttons are the exception above.
• Shopify checkout pages, and any page whose path has a /checkout or /checkouts segment
• IP addresses — the country is derived at the edge and the address discarded
• Anything inside an element the site owner has marked as blocked

There are no cookies and no persistent identifier. A session identifier lives in the browser tab's own storage and dies with the tab, so we cannot recognise a returning visitor.

3. Retention

Recordings are deleted when their retention window ends — set by the site owner, up to their plan's ceiling. A nightly job enforces it and a storage-level expiry sits behind that as a backstop. Account data is kept while the account exists. To close an account, email support@appifycommerce.com from the owner's address: we cancel any subscription first, then delete the workspace and its recordings within 30 days — except where we must keep an invoice for tax purposes. Billing records (payments, invoices and the billing details on them) are kept for the period tax law requires, including after an account is closed.

Our audit log is kept for two years, deliberately longer than the recordings it describes.

4. Where it is stored

On Cloudflare's network, in accounts we control; support-chat conversations on our own server on Google Cloud. See our sub-processor list for everyone involved and what each one does.

5. Your rights

If you are one of our customers, write to us and we will give you a copy of what we hold, correct it, or delete it. If you are a visitor to a site that uses Replayfy, your request belongs with that site's owner — they decide what is collected and we act on their instruction. Tell us anyway and we will pass it on and help them action it.

Site owners: any single recording can be deleted from the dashboard immediately. There is no one-step deletion of everything one person produced yet. If your site links sessions to your own user id with __sr.identify(), email us that id and we find and delete the recordings linked to it. A visitor your site did not identify cannot be tied to their recordings — there is no cookie and no persistent identifier — so only recordings you can pick out yourself can be deleted (see erasure requests).

6. Contact and grievances

support@appifycommerce.com, or by post to APPIFY COMMERCE, Ground Floor, 9 A, Gyaneshwar Park Society, IOC Depot Road, Chenpur Village, Ahmedabad, Gujarat 382470, India.

Grievances (India): email support@appifycommerce.com with "Grievance" in the subject. We acknowledge within 48 hours and resolve within one month. More ways to reach us are on the contact page.