Last updated: May 19, 2026
This Privacy Policy describes how Remly ("we", "us", or "our") collects, uses, and shares personal information when you visit goremly.com, sign up as a customer, or interact with chatbots powered by our platform.
Scope. This policy covers two groups: (1) site visitors and paying customers of Remly, and (2) end-customers who chat with a Remly-powered chatbot on a third party's website. For end-customer chat conversations, the business operating the chatbot (our "Customer") is the data controller and its own privacy policy governs how that data is used. Remly acts as a data processor on behalf of that Customer. See Scope of this Policy below for details.
We do not sell personal information, and we do not use end-customer chat content to train AI models. See AI below.
Where the GDPR applies, we rely on these legal bases:
We use the following third-party services to operate Remly. We share only what each one needs.
| Subprocessor | Purpose | Data shared |
|---|---|---|
| Amazon Web Services (AWS Lightsail, US) | Hosting and database storage | All data, encrypted in transit |
| Anthropic, PBC | AI chat responses (Claude API) | Chat messages and configuration prompts |
| Stripe, Inc. | Payment processing | Billing details, customer name and email |
| Twilio, Inc. | SMS, voice, missed-call routing | Phone numbers, message bodies |
| Google LLC | Workspace email (info@goremly.com), Sheets export, OAuth login | Email content, sheet rows, account email |
| Intuit, Inc. (QuickBooks Online) | Customer, invoice, and estimate sync | Customer name, contact, invoice line items |
| Meta Platforms, Inc. (WhatsApp Cloud API) | WhatsApp messaging (when enabled) | Phone numbers, message bodies, media |
We may also disclose information when required by law (subpoena, court order), to enforce our Terms, or to protect rights and safety. We will give notice where legally permitted.
If we are involved in a merger, acquisition, or sale of assets, your information may transfer to the successor entity, subject to the protections in this policy.
Remly uses Anthropic's Claude API (Haiku model family) to generate chatbot responses. When an end-customer sends a message:
AI-generated responses can be inaccurate. For the avoidance of doubt: chatbot answers are not professional advice (legal, medical, electrical, etc.) and should not be relied on as such. Pricing, availability, and scheduling shown by the bot are estimates until confirmed by the business.
Per California Business & Professions Code §17940 (the Bot Disclosure Law) and similar rules, our chatbot identifies itself as automated when interacting with users.
We retain personal information for as long as it is needed to provide the service or to comply with our legal obligations. In practice:
We do not currently auto-delete data on a fixed schedule. If you want your data removed sooner, see Your rights.
We protect data with administrative and technical safeguards reasonable for a small SaaS:
What we do not currently do: our database files are not encrypted at rest at the disk level. Daily snapshots of the server are taken by AWS Lightsail and are subject to AWS's security controls. We may add at-rest encryption as we grow. No system is perfectly secure; you use the service at your own risk.
You can ask us to:
To exercise any of these rights, email privacy@goremly.com. We aim to respond within 30 days. We may need to verify your identity before acting on a request.
If you are an end-customer of one of our paying Customers, please contact that business first — they control the data and we act on their instructions. We will help them respond.
Residents of certain U.S. states (including California, Virginia, Colorado, Connecticut, Utah, Texas, and others as laws come into effect) have additional rights, including the right to access, correct, delete, and obtain a copy of their personal information, and the right to opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not knowingly process sensitive personal information for purposes that would trigger TDPSA disclosure obligations. If you would like to exercise a state-law right, email privacy@goremly.com.
You may also designate an authorized agent to make a request on your behalf. We may verify the request directly with you.
California "Shine the Light" requests can be sent to the same address.
We use a small number of cookies:
We do not currently use third-party advertising or analytics cookies. If we add analytics in the future, we will update this policy and provide a way to opt out where required.
If you give a phone number to a Remly-powered chatbot, the operating business may contact you by SMS, voice, or WhatsApp. Message and data rates may apply. SMS opt-in is collected at the point where you provide the number; you can reply STOP to any SMS to opt out, or HELP for assistance.
Mobile information (phone number, opt-in status, message content) is not shared with third parties or affiliates for marketing or promotional purposes. It is shared only with subprocessors that deliver the messaging itself (Twilio, Meta WhatsApp).
This policy applies to data Remly collects directly: visits to goremly.com and the accounts of paying Customers.
For chat conversations between an end-customer and a Customer's chatbot, the Customer is the data controller. They decide what data to collect, how long to keep it, and what to do with it. Remly processes that data on the Customer's instructions under our Data Processing Addendum, which is incorporated by reference into the Terms of Service. End-customers should consult the Customer's own privacy policy for the complete picture.
Remly is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their personal information. If you believe we have, contact us and we will delete it.
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated to active Customers by email.
Questions, requests, or complaints:
Remly is operated by REMLY LLC, a New York limited liability company based in the United States. EU/UK residents may also lodge a complaint with their local data protection authority.
Portions of this policy are adapted from 37signals' open-source policies under the Creative Commons Attribution 4.0 license.