ReplyTown is designed around UK GDPR and PECR: explicit consent, data minimisation, and erasure on request, from day one.
Opt-in for cookies and SMS, never pre-ticked.
Only what the intake flow needs, nothing more.
Leads archived after 12 months; opt-outs kept forever.
Delete a lead and its messages on request.
ReplyTown is built for the UK market under UK GDPR and PECR. We treat website consent and SMS consent as two separate obligations and keep them separate in code, copy, and documentation.
Cloudflare Web Analytics is cookieless, first-party, and collects no personal data, so it needs no consent banner. The Cloudflare Zaraz Consent Management Platform appears on first visit and gates any consent-required tools by purpose. All purposes are opt-in by default and stored in a first-party cookie for audit.
SMS consent is a separate, explicit flow. The first message identifies the business and includes opt-out instructions. Every STOP reply is honoured and logged, and no message is ever sent without a lawful basis, such as a missed call, web lead, or existing customer relationship.
We collect only what the intake flow needs and never log full message bodies into generic logs. Gemini receives the minimum lead context and runs under a hard monthly spend cap. OpenRouter free models are never used for personal data.
Clerk protects all dashboard routes, admin-only settings are gated, and provider secrets live only in the environment, never in the repository. Consent records are immutable append-only once written.
Under UK GDPR you have the right to access, correct, and erase your data, and to object to processing. Contact us to exercise any of these rights, and we will respond within the statutory period.
For data requests or compliance questions, contact us.